Google Workspace MX Migration Checklist
A mail migration is not complete when one DNS lookup shows the new MX records. Sending systems use different recursive resolvers, and old MX answers can remain cached while SPF, DKIM or DMARC records still point at the previous setup.
Check MX records first
Confirm the domain returns the intended mail exchangers and that the priorities match the provider documentation. Then compare several public resolvers.
dig example.com MX +short
dig @1.1.1.1 example.com MX
dig @8.8.8.8 example.com MXCheck outbound authentication
- SPF is a TXT record at the envelope-from domain.
- DKIM is published below a selector such as selector1._domainkey.example.com.
- DMARC is published at _dmarc.example.com.
- Do not delete old provider records until outbound mail no longer uses them.
Watch the transition period
Keep the old mail system able to receive or forward during cache expiry. Some senders may still attempt delivery to the previous MX host until their resolver cache refreshes.
dig example.com TXT +short
dig _dmarc.example.com TXT +short
dig selector1._domainkey.example.com TXT +shortCommon migration mistakes
Changing MX but not SPF
Inbound routing and outbound authorization are separate DNS concerns.
Removing the old provider immediately
Cached senders can still deliver to the previous MX host.
Testing DKIM at the root domain
DKIM uses selector-specific hostnames.
Publishing multiple SPF records
A domain should have one SPF policy beginning with v=spf1.