Rotate the relay credential

Rotation issues a new SMTP AUTH password for the route Google Workspace uses to hand mail to PXCMail; both the old and new credential work for 24 hours, so you update Google at your own pace and nothing queues.

Before you start

Admin or Owner role in the PXCMail console.
Google Workspace super-admin access, or the IT provider who manages it, available during the same window.
If you suspect the credential leaked, skip the 24-hour overlap: rotate, update Google immediately, then revoke the old credential and report the incident.

Steps

Console → Domains & connection → Google Workspace → Rotate credential. The console shows the new password once; copy it. The old one keeps working for 24 hours.
In the Google Admin console: Apps → Google Workspace → Gmail → Routing → the outbound route for PXCMail → edit the SMTP AUTH password → Save. Google can take a few minutes to apply the change.
Send a test message from a Google mailbox to an outside address. Console → Domains & connection shows the last message time and which credential it used.
Once the test arrives, click Revoke old credential. If you do nothing, the old credential expires on its own at 24 hours.
Note the next due date. The console raises an alert when rotation is due; Owners and Admins receive it by email.

Verify

Domains & connection shows “credential rotated” with today’s date and the next due date 180 days out. The audit log holds two entries, credential.rotated and credential.revoked, with the actor and time.

Troubleshooting

Mail from Google is queuing after the update. Cause: the password was pasted with a trailing space or into the wrong route. Fix: re-open the route in Google, paste again, and confirm the route host is smtp-out.pxcmail.com on port 587.
Mail stopped a day after rotation. Cause: Google was never updated and the old credential expired at 24 hours. Fix: rotate again, update Google with the new password straight away, then send a test.
The console still shows the old credential in use. Cause: Google has not applied the change yet, or messages were already in its queue. Fix: wait a few minutes, send a fresh test, and check the last message line again.
Rotate credential is not shown for Microsoft 365. Cause: Microsoft 365 authenticates the connector with a certificate and your tenant, so there is no password to rotate. Fix: nothing to do; see connect Microsoft 365.

Example

Lakeside Family Dental, a 12-person office on Google Workspace, gets the 180-day reminder on a Tuesday. The office manager rotates the credential at 8:05 am and sends the new password to Coastal IT Partners, the MSP that manages the practice’s Google Admin console, through a secure message. Coastal updates the outbound route at 8:40 am and sends a test referral to a test address. The console shows the test using the new credential, the manager clicks Revoke old credential at 8:50 am, and the whole exercise is in the audit log with both names.

FAQ

Does rotation interrupt mail?

No. Both credentials are valid for 24 hours. Mail only stops if Google is never updated and the old credential expires.

Can I rotate more often than every 180 days?

Yes, as often as you like. The 180-day reminder is a floor, not a schedule.

Who can see the new password?

Only the person who clicks Rotate credential, and only once. PXCMail staff cannot read it; if it is lost, rotate again.

What about inbound MX routing?

Inbound routing does not use this credential. Nothing changes for mail arriving at your domain.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).