How to configure Google Workspace to relay outbound mail to MXGuardian

In order to use MXGuardian's outbound filtering service, you must configure Google Workspace to relay all outbound mail to MXGuardian. This is sometimes called a smarthost. This guide will walk you through configuring an outbound gateway and configuring it to relay outbound mail to MX Guardian. 

Note: Make sure outbound filtering is enabled on your account before following this procedure.

Step 1: Configure Google Workspace to handle internal mail

First, we need to configure Google Workspace to handle your internal company mail so that mail from one user to another doesn't get routed to MXGuardian

1. Sign in to the Google Admin Console
2. Select Apps, and then Google Workspace, and then Gmail
3. Scroll down to the section labeled Hosts, and click Add Route
4. Give the new route a name like "Internal Company Mail"
5. Under Specify email server, choose Single Host, and enter aspmx.l.google.com, and the port number 25
   
   
   
   
6. Make sure the checkbox Perform MX lookup on host is NOT checked. Check the boxes 
   • Require mail to be transmitted via a secure (TLS) connection (Recommended)
   • Require CA signed certificate (Recommended)
   • Validate certificate hostname (Recommended)
7. Click Save

Step 2: Configure Google Workspace to route outbound mail to MXGuardian

1. In the breadcrumbs at the top, select Settings for Gmail to navigate back to the settings page.

2. Scroll down and click the section labeled Routing. (Not Default Routing)
3. Click the section Outbound Gateway
4. Under Route outgoing emails to the following SMTP Server, enter smtp.mxguardian.net and click Save
   
   
   
   

5. Under Routing click Add another rule

6. Give the route a name like Internal Mail Route

7. Select the checkbox Internal - Sending
   
   
   
   

8. In section #2, Make sure the Modify message menu item is checked, and choose the checkbox Change Route and use the menu below that to chose the host you set up earlier Internal Company Mail
   
9. Scroll all the way down to the bottom and click Show options

10. In Section B, choose the checkboxes

    • Users
    • Groups

11. In Section C choose the checkbox Only affect specific envelope senders, choose Pattern Match from the dropdown menu, and enter your domain in the Regexp field:
    

12. Click Save

Step 3: Configure your SPF record for both Google Workspace and MXGuardian

Your SPF record MUST include both the entries for MXGuardian and for Google Workspace, so it must include include:spf.mxguardian.net and include:_spf.google.com

For example, a minimal SPF record would look like this:

     "v=spf1 include:spf.mxguardian.net include:_spf.google.com -all" 

Your SPF record may include other hosts if you need to send mail from a third party (i.e. marking platforms, CRM systems, etc...)