How to setup Google Workspace Emails from cpanel or dns manager

Google Workspace gives your business professional email (Gmail) on your own domain, such as you@yourdomain.co.tz. To make it work, you need to add a few DNS records to your domain. This guide shows you exactly what to add and where — using either cPanel Zone Editor or the Netpoa DNS Manager in your client area.

Time needed: about 20 minutes of work, plus up to 72 hours for DNS changes to take effect (usually much faster).

Before you start

1. Have your Google Workspace account ready. Sign in to the Google Admin console as an administrator. You will copy some values from there.
2. Create your users in Google Workspace first. Add every mailbox you need (e.g. info@, sales@, your name) before you change your MX record. Otherwise, emails sent to addresses that don't exist in Google yet will bounce.
3. Back up existing email. If you currently use cPanel email with Netpoa, moving to Google means new emails go to Gmail. Old emails stay on cPanel until you migrate them. Google's free data import tool (Admin console → Data → Data import & export → Data import → IMAP) can copy old emails across.
4. Choose the right place to edit DNS. Only one of the two methods below applies to your domain:

Tip: Editing DNS in the wrong place has no effect. If you're not sure which applies to you, contact Netpoa Support before making changes.

The records you will add

Replace yourdomain.co.tz with your real domain. Values marked from Google are unique to your account — copy them from the Admin console.

Where to find Google's values:

• Verification TXT: Admin console → Account → Domains → Manage domains → click Verify domain next to your domain → copy the TXT record value.
• DKIM key: Admin console → Apps → Google Workspace → Gmail → Authenticate email → select your domain → Generate new record. Choose 2048 bit key length and keep the prefix as google. For a brand-new Google Workspace account, the DKIM option can take 24–72 hours to become available.

Already using Google Workspace from before 2023? Your MX records may point to aspmx.l.google.com and its alternates. If your email is working, you don't need to change them.

Method A — cPanel Zone Editor

Step 1: Open the Zone Editor

1. Log in to your Netpoa client area at netpoa.com and open cPanel for your hosting service. (See: How to Auto-Login to Your cPanel via Netpoa.com.)
2. In cPanel, go to Domains → Zone Editor.
3. Click Manage next to your domain.

Step 2: Add the verification TXT record

1. Click the arrow next to + Add Record and choose Add TXT Record.
2. Name: type your domain followed by a dot, e.g. yourdomain.co.tz.
3. TTL: leave the default.
4. Record: paste the google-site-verification=… value from Google (without quotes).
5. Click Save Record.
6. Go back to the Google Admin console and click Verify. If it doesn't verify immediately, wait a little and try again.

Step 3: Replace the MX records

1. Click the MX filter button to show only mail records.
2. Delete every existing MX record (usually one pointing to your domain or mail.yourdomain.co.tz). Click Delete and confirm.
3. Click the arrow next to + Add Record → Add MX Record.

• Name: yourdomain.co.tz.
• Priority: 1
• Destination: smtp.google.com

Step 4: Set Email Routing to Remote

This step is important. Without it, emails sent from your own website or server (for example contact forms) can stay stuck in cPanel instead of reaching Gmail.

1. In cPanel, go to Email → Email Routing.
2. Select your domain.
3. Choose Remote Mail Exchanger and click Change.

Step 5: Update the SPF record

cPanel usually creates an SPF record automatically. A domain must have only one SPF record, so edit the existing one instead of adding a second.

1. Click the TXT filter button.
2. Find the record whose value starts with v=spf1 (for example v=spf1 +a +mx +ip4:… ~all) and click Edit.
3. Replace the value with: v=spf1 include:_spf.google.com ~all
4. Click Save Record.

Does your website on this hosting send email (e.g. WordPress contact forms or order notifications)? Use this value instead, so your server can still send: v=spf1 +a include:_spf.google.com ~all. Even better, configure your website to send through Google using an SMTP plugin.

If there was no SPF record, add a new TXT record with the name yourdomain.co.tz. and the value above.

Step 6: Add the DKIM record

1. Click + Add Record arrow → Add TXT Record.
2. Name: google._domainkey.yourdomain.co.tz. (you can also type google._domainkey and cPanel adds your domain).
3. Record: paste the full DKIM value from Google on one line (v=DKIM1; k=rsa; p=…). Don't add quotes.
4. Click Save Record.
5. Return to the Admin console → Apps → Google Workspace → Gmail → Authenticate email and click Start authentication.

You may already see a TXT record called default._domainkey. That is cPanel's own DKIM key. It does not conflict with Google's google._domainkey record, so you can leave it.

Step 7: Add the DMARC record

1. Click + Add Record arrow → Add TXT Record.
2. Name: _dmarc.yourdomain.co.tz.
3. Record: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.tz (Replace the email address with a mailbox that will receive DMARC reports.)
4. Click Save Record.

Warning: After switching to Google, cPanel's Email Deliverability page may show "problems" with your SPF or DKIM. This is expected. Do not click "Repair" — it will overwrite your Google SPF record with cPanel's default.

You're done with cPanel. Skip to Check that everything works.

Method B — Netpoa DNS Manager

Use this method if your domain is registered with Netpoa but is not on a Netpoa hosting plan.

Step 1: Open DNS Management

1. Log in to your client area at netpoa.com.
2. Go to Domains → My Domains.
3. Click your domain (or Manage Domain).
4. In the Manage menu on the left, click DNS Management.

Don't see DNS Management? It may not be enabled for your domain yet. Contact Netpoa Support and we'll enable it for you.

You'll see a table with the columns Host Name, Record Type, Address, and Priority, with an empty row at the bottom for adding a new record. Add one record at a time, then click Save Changes before adding the next.

Step 2: Add the verification TXT record

Click Save Changes, then click Verify in the Google Admin console.

Step 3: Replace the MX records

1. Remove any existing MX records: clear the row (or use the delete option) and click Save Changes.
2. Add the Google MX record:

1. Click Save Changes.

Choose MX (Mail), not MXE (Mail Easy). MXE is for pointing mail to an IP address and won't work with Google.

Step 4: Add or update the SPF record

If there's already a TXT record starting with v=spf1, edit it instead of adding a new one. Otherwise add:

Click Save Changes.

Step 5: Add the DKIM record

Click Save Changes, then go to the Admin console → Gmail → Authenticate email and click Start authentication.

Long key problem? 2048-bit DKIM keys are long. If the record won't save or looks cut off, go back to Google, click Generate new record, choose 1024 bit, and add that shorter value instead.

Step 6: Add the DMARC record

Click Save Changes.

Check that everything works

DNS changes usually show up within an hour, but can take up to 72 hours.

1. In Google Admin console: your domain should show as Verified, Gmail should show as Active, and DKIM should say Authenticating email.
2. Use Google's checker: go to Google Admin Toolbox – Check MX, enter your domain, and fix anything it flags.
3. Send a test: from a personal Gmail account, send an email to your new Google Workspace address. Then reply from Workspace back to the personal account. In the personal Gmail, open the message → ⋮ → Show original. You should see SPF: PASS, DKIM: PASS, and DMARC: PASS.
4. Command line (optional): dig MX yourdomain.co.tz +short
5. dig TXT yourdomain.co.tz +short
6. dig TXT google._domainkey.yourdomain.co.tz +short
7. dig TXT _dmarc.yourdomain.co.tz +short
   On Windows, use nslookup -type=MX yourdomain.co.tz.

Troubleshooting

Google says it can't verify my domain. Check that the TXT record is on the root domain (@ or yourdomain.co.tz.), not on www. Make sure there are no extra quotes or spaces, and that you edited DNS in the right place (see Before you start). Keep the record in place — Google checks for it repeatedly for up to 72 hours.

Emails are still arriving in cPanel webmail. Make sure all old MX records are deleted and only smtp.google.com remains. On cPanel, confirm Email Routing is set to Remote Mail Exchanger. Some senders may use cached DNS for a few hours.

Emails to one address bounce. That user or alias probably doesn't exist in Google Workspace yet. Add it as a user, alias, or group in the Admin console.

My emails go to spam, or SPF fails. Check you have only one v=spf1 record. Two SPF records cause both to fail. Also make sure DKIM is authenticating and a DMARC record exists — Gmail and other providers expect all three.

The DKIM option isn't available in the Admin console. New Google Workspace accounts may need to wait 24–72 hours after Gmail is set up before the DKIM key can be generated.

Will this affect my website? No. These steps only change email records. Don't edit or delete your A, AAAA, or CNAME records for the website.

When should I tighten DMARC? Start with p=none and watch the reports for a few weeks. Once all your legitimate email passes SPF and DKIM, you can change to p=quarantine and later p=reject for stronger protection against spoofing.

Need help?

Netpoa Support can check your records for you. Open a ticket from your client area at netpoa.com or call +255 755 212 222.