Connect Google Workspace

Google Workspace sends your outbound mail to PXCMail through an SMTP relay route added under Gmail → Routing, authenticated with a credential the console generates; internal mail never leaves Google, and directory sync keeps seats matched to your people.

Before you start

Your relay credential from Console → Domains & connection → Google Workspace. It is shown once and can be rotated later.
Super-admin access to admin.google.com.
DNS records added: the SPF include and DKIM CNAMEs from DNS setup, so relayed mail still passes SPF and carries your signature.
Decide whether to start with everyone or one organizational unit (OU); see Phased rollout.

Steps

Admin console → Apps → Google Workspace → Gmail → Hosts → Add route. Name PXCMail Gateway; single host smtp-out.pxcmail.com, port 587. Enable “Require mail to be transmitted via a secure (TLS) connection”, “Require CA signed certificate” and “Validate certificate hostname”. Save.
Gmail → Routing → Outbound routing → Configure. Messages to affect: Outbound. Envelope filter: only affect messages from your domains. Route: change route → PXCMail Gateway. Authentication: SMTP AUTH with the relay username and password from the console. Leave “Also reroute spam” unchecked.
Optionally add an envelope filter so internal recipients are excluded; they never leave Google anyway. Choose the OU the rule applies to (top level for everyone).
Save. Google applies routing changes within an hour, usually within minutes.
Back in the console, turn on Directory sync and approve the OAuth consent for read-only access to users and groups. New hires appear automatically; removed accounts are disabled within 15 minutes.
Press Send test in the console. It sends through Google to a seed mailbox and shows each hop with TLS status.

Verify

Console → Domains & connection shows “Relay: receiving from Google Workspace” with a last-message time, and the test message appears in Console → Archive & audit with TLS ✓ and your DKIM selector. In Gmail, the sent message’s “show original” lists smtp-out.pxcmail.com as a received hop.

Troubleshooting

Mail sits in Google’s queue or bounces with an authentication error. Cause: the SMTP AUTH password pasted with a trailing space, or port 465 was used. Fix: re-enter the credential and confirm port 587 with TLS required.
Recipients see “via pxcmail.com”. Cause: the DKIM CNAMEs are not live. Fix: wait for DNS or recheck the selector; the wizard re-checks every five minutes.
Some users bypass the route. Cause: the routing rule is scoped to an OU they are not in. Fix: move them or apply the rule at the top level.
Internal mail shows up in the audit trail. Cause: the envelope filter was not restricted to external recipients. Fix: add the exclusion in step 3; nothing leaked, it simply went through the relay.
Calendar invitations are not delivered. Cause: an SPF record that drops the Google include. Fix: keep include:_spf.google.com alongside the PXCMail include.

Example

Lakeside Family Dental’s office manager adds the host and route on a lunch break, scoped first to the “Front desk” OU. A pre-authorization from insurance@ with a patient’s MRN goes out as locked delivery, rule “PHI → encrypt”; a routine appointment reminder goes out with TLS and nothing else changes. Dentrix sends treatment plans through the practice’s Google addresses, so it inherits the same policy with no integration work. The next week she moves the rule to the top level and all 12 users are covered.

FAQ

Does Gmail look any different to staff?

No. They keep Gmail on the web and on their phones. The only visible change is that sensitive messages leave as locked delivery and a warn comes back as a bounce with guidance.

What if PXCMail is unreachable?

Google queues and retries the route; nothing is lost. Status is public at /trust/status/.

Can we filter inbound mail too?

Yes, by changing MX and adding an inbound gateway; see Inbound filtering.

Is there a Gmail add-in?

Not yet; add-ins are on the roadmap (ROADMAP). Policy runs on the server, so nothing is installed in Gmail.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).