Google Workspace DNS record generator

{
  "tool": "google-workspace-dns-generator",
  "input": {
    "domain": ""
  },
  "result": {
    "verdict": {
      "tone": "success",
      "headline": "MX and SPF ready for your domain",
      "summary": "Add these as MX and TXT records at the root of your domain, then add DKIM and verification from the Admin Console."
    },
    "findings": [
      {
        "id": "personalize-with-domain",
        "severity": "info",
        "title": "The MX and SPF records below do not need your domain",
        "detail": "Google publishes the same MX target and SPF include for every Workspace account, so there is nothing to fill in to get them right. Typing your domain only makes this page name it instead of speaking generically."
      },
      {
        "id": "old-aspmx-records-still-supported",
        "severity": "info",
        "title": "An older domain may already have different, still-supported MX records",
        "detail": "Google's own current help page says a domain set up before the single record existed \"might have different MX record values that start with 'aspmx'\" and that Google still supports them - it does not list what they are, and this generator will not print values Google itself no longer documents.",
        "fix": "If this domain already has MX records starting with \"aspmx\", leave them as they are rather than replacing them with the single record above - both are supported, and switching is not required."
      },
      {
        "id": "dkim-in-admin-console",
        "severity": "info",
        "title": "DKIM is generated per account, not published here",
        "detail": "Google generates a distinct DKIM key for every Workspace account, so there is no fixed TXT value this generator could print - a realistic-looking placeholder here would be wrong for every domain that pasted it.",
        "fix": "Open the Google Admin Console, go to Apps > Google Workspace > Gmail > Authenticate email, and copy the DKIM TXT record it generates there for this domain."
      },
      {
        "id": "verification-token-in-admin-console",
        "severity": "info",
        "title": "The domain-verification token is also account-specific",
        "detail": "Google issues a one-time verification TXT or HTML-file token when a domain is added to Workspace, unique to that signup - there is no fixed value a generator could emit for it.",
        "fix": "Open the Google Admin Console setup wizard for this domain and copy the verification value it shows there."
      },
      {
        "id": "current-mx-ready",
        "severity": "pass",
        "title": "One MX record is what Google now documents",
        "detail": "Google Workspace issues this single record to every domain signing up today, and its own setup help page no longer lists a multi-record alternative to choose instead."
      },
      {
        "id": "spf-include-ready",
        "severity": "pass",
        "title": "One SPF record, with Google Workspace as the only sender",
        "detail": "This assumes Google Workspace is the only thing sending mail as this domain. Add another provider through the SPF generator next door rather than editing this line by hand."
      }
    ],
    "parts": [
      {
        "kind": "record",
        "title": "MX record to publish",
        "value": "1 smtp.google.com",
        "note": "Priority then host, at the root of the domain, not a subdomain. Leave an existing \"aspmx\" MX setup alone rather than replacing it with this.",
        "at": {
          "name": "@",
          "type": "MX"
        }
      },
      {
        "kind": "record",
        "title": "SPF record to publish",
        "value": "v=spf1 include:_spf.google.com ~all",
        "note": "Publish this at the domain itself. A domain may only have one SPF record - add senders to this one rather than publishing a second.",
        "at": {
          "name": "@",
          "type": "TXT"
        }
      },
      {
        "kind": "table",
        "title": "DNS records for your domain",
        "columns": [
          "Host",
          "Type",
          "Value",
          "Priority"
        ],
        "mono": [
          2
        ],
        "rows": [
          [
            "@",
            "MX",
            "smtp.google.com",
            "1"
          ],
          [
            "@",
            "TXT",
            "v=spf1 include:_spf.google.com ~all",
            "-"
          ]
        ],
        "note": "DKIM and the domain-verification token are missing on purpose - both are generated per Workspace account and only ever shown inside the Admin Console."
      },
      {
        "kind": "text",
        "title": "Still to do in the Admin Console",
        "body": "Copy the DKIM TXT record from Apps > Google Workspace > Gmail > Authenticate email, and publish it alongside the records above.\n\nCopy the domain-verification value from the setup wizard for this domain, and publish or upload it as Google asks."
      }
    ],
    "limits": [
      "The DKIM TXT value and the domain-verification token are unique per Workspace account and only ever appear in the Admin Console - this tool cannot generate either and does not guess at a value.",
      "An older domain may already carry different MX records starting with \"aspmx\" from before the single record above existed; Google still supports them but no longer publishes what they are, so none is printed here."
    ]
  }
}