DNS Pre-Flight Checklist Before You Send Your First Business Email

Most “Gmail is broken” tickets are DNS tickets. Run this checklist before anyone sends from a new Google Workspace domain.

The checklist

1. Domain verified in Google Admin.
2. MX points only to Google (priorities correct; old host removed).
3. SPF — single TXT, includes _spf.google.com, lookup count ≤ 10.
4. DKIM — key published; Admin shows authenticating.
5. DMARC — at least p=none with a real rua mailbox you monitor.
6. TTL — lowered before cutover, raised after stable.
7. CAA / extras — not blocking needed certificates if you terminate TLS elsewhere.
8. Test headers — SPF/DKIM/DMARC PASS to Gmail and Outlook.

Registrar pitfalls

• Some panels append the domain to hostnames twice (_dmarc.domain.com.domain.com).
• Flattening SPF incorrectly can remove Google’s include.
• “Email forwarding” features at the registrar can silently add MX you did not want.

Ship it with confidence

If you want the checklist executed for you, MailJuke’s setup flow is built around domain + Workspace + authentication — so your first business email is verified, not experimental.