Collapser — setup guide 01 of 02
The one org that holds every domain you own, where you're the only person. Everything else hangs off this.
01 / In order, because order matters
workspace.google.com → Get started. Business name, "just you" for size, and the domain you already own.
Business Starter has every single thing this needs: custom domain, secondary domains, aliases, DKIM. $7 a month on a year's commitment, $8.40 monthly.
Google gives you record 01. Add it, come back, verify. Usually under a minute.
Back in Manage domains, hit Activate Gmail. This is where record 02 comes from. Add it — then go look at what else is on the domain.
Record 03. Nothing to generate — it's the same line for everyone using Google.
Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key, paste it at google._domainkey, wait for DNS, then come back and click Start authentication. If Vercel warns that this record overrides a wildcard entry, say yes. DKIM is looked up at that exact name, so the specific record is the one you want. Everything else still falls through to the wildcard.
Record 05, set to p=none. It reports without enforcing, which is what you want while you're still moving things.
02 / Don't trust the green checkmarks
The Admin console will tell you everything is fine well before it is. The only real proof is a message that left your domain and arrived somewhere else. Send one from an outside address, reply to it, and open the reply's original.
Send from an account that isn't this one. If it doesn't land within a few minutes, MX is wrong or DNS hasn't caught up.
In the received copy, the signature should name your domain — not Google's, not anyone else's. If it names something else, DKIM was generated but never started.
SPF, DKIM, and DMARC should all read as passing. Two out of three is not a pass — it's a thing that works today and stops working when a recipient tightens their rules.
If the recipient sees either of those, the message is wearing a costume rather than being you. That's the whole point of the four records above.
03 / If something's off
A domain lives in exactly one Google organisation, ever. If you half-started a Workspace on it once, or bought it through a Google partner, or someone set one up years ago — it's spoken for, and Google will refuse to let you create a second one without explaining why.
Sign in with whatever account you'd have used back then and look at admin.google.com. Either you already own the thing you're trying to build, or you'll find the account holding it hostage.
DNS has a convention where @means "the domain itself." Some control panels expect it. Some don't, and will take it literally.
Vercel wants the field empty. Type @and you'll create a record for a subdomain named "@", which resolves to nothing and gives you no error — just a verification that never completes and no clue why.
The tell: after saving, the panel should show the record against your bare domain. If it shows anything else, that's the bug.
MX records have priority numbers, and lower wins. Everything else is a fallback for when the first one can't be reached.
That sounds like insurance. It isn't. A leftover MX from an old forwarder means that on the day Google has a hiccup, your mail quietly goes to a service you forgot you had — and you won't find out, because nothing failed. It succeeded, somewhere else.
Google needs exactly one MX now. Anything else on the domain is old wiring. Pull it.
Two things prove a message really came from your domain. One checks the servers it passed through. The other is a signature Google applies to the message itself, using a key only it holds, which anyone can verify against the public half you published in DNS.
The first one is fragile — it breaks the moment mail gets forwarded, because the path changes. The signature doesn't. It travels with the message.
That's why DKIM is the record that matters. It's what lets you send as six different addresses from one mailbox and have every one of them verify. Without it you're relying on the fragile check alone, which works right up until it doesn't, and then your mail starts quietly failing at recipients who take it seriously.
Starter gives you 30GB, and it's shared across Gmail, Drive, and Photos rather than 30GB each.
As a mail-only inbox, that's years — mail is small. It stops being years the moment you start treating this as your main Drive.
Worth knowing now because this is about to become the address you give people for the rest of your life. Upgrading later is a click, but running out is discovered at the worst moment.
04 / Next
What you just built is the expensive part, and it's the only expensive part. Every other domain you own gets added to this same org as a secondary domain, costs nothing, and hangs its addresses on the mailbox you now have.
Same five records each. Different verification string, same everything else. Guide 02.