- Organization
- Payment
- Agreement
- Connect
- First message
Connect lakesidedental.com.
Seven DNS records and one relay setting. We re-check every 5 minutes; most changes show green within an hour.
GoDaddy: DNS → Manage zones → Add record. CNAME values must not end with a dot; GoDaddy sometimes appends your domain to CNAME values (see DKIM check). TTL 1 hour.
Cloudflare: set the three DKIM CNAMEs and MAIL FROM records to DNS only (grey cloud); proxied records break mail. Propagation is usually under 5 minutes.
Squarespace (ex-Google Domains): Settings → Domains → DNS → Custom records. Enter host names without your domain (e.g. pxc1._domainkey).
Namecheap: Advanced DNS → Add new record → “CNAME Record”; TTL Automatic. If you use Namecheap email forwarding, MX changes will disable it.
Network Solutions: changes can take up to 24 hours; use “Advanced DNS” for host names with underscores.
Send the records to whoever manages DNS with “Email to IT”, or book a 15-minute call and we do it with you on screen.
Overview
SPF record found, but PXCMail is not in it
Likely cause: your SPF only lists Google (or Microsoft). Mail sent through the PXCMail gateway fails SPF at strict receivers until include:_spf.pxcmail.com is added. Mail still flows because DKIM passes.
- Found
v=spf1 include:_spf.google.com ~all- Expected
v=spf1 include:_spf.google.com include:_spf.pxcmail.com ~all
Guided fix · 3 steps
- Open the TXT record at @ (root)
Edit the existing SPF record — do not create a second one.
- Insert include:_spf.pxcmail.com before ~all
Keep every include you already have; only add ours.
v=spf1 include:_spf.google.com include:_spf.pxcmail.com ~all
- Wait up to 1 hour, then check
We check from 4 public resolvers; the badge turns green automatically.
SPF has too many DNS lookups (12 of 10 allowed)
Cause: SPF allows at most 10 DNS lookups; yours includes Google, Mailchimp, your EHR vendor and two legacy senders. Receivers return PermError and may treat your mail as unauthenticated.
- Found
v=spf1 include:_spf.google.com include:servers.mcsv.net include:spf.ehrvendor.com include:spf.protection.outlook.com include:_spf.salesforce.com ~all- Expected
v=spf1 include:_spf.pxcmail.com include:_spf.google.com include:servers.mcsv.net ~all
Guided fix · 3 steps
- Decide what still sends mail directly
Anything now routed through PXCMail only needs
_spf.pxcmail.com. Newsletters sent by Mailchimp keep their include. - Remove unused includes
Legacy Outlook and Salesforce includes are from a previous provider.
v=spf1 include:_spf.pxcmail.com include:_spf.google.com include:servers.mcsv.net ~all
- Check again
Lookups must be ≤ 10; we count them for you.
Two SPF records found — receivers treat this as an error
Cause: a second TXT record starting with v=spf1 was added instead of editing the existing one. More than one SPF record fails SPF everywhere (PermError).
- Found
v=spf1 include:_spf.google.com ~all
v=spf1 include:_spf.pxcmail.com ~all- Expected
v=spf1 include:_spf.google.com include:_spf.pxcmail.com ~all
Guided fix · 3 steps
- Delete one of the two TXT records
Keep the one that lists Google.
- Add our include to the remaining record
v=spf1 include:_spf.google.com include:_spf.pxcmail.com ~all
- Check again
DKIM pxc2 points to the wrong name
Cause: your registrar appended your domain to the CNAME value (common at GoDaddy and Network Solutions).
- Found
pxc2.dkim.pxcmail.com.lakesidedental.com- Expected
pxc2.dkim.pxcmail.com
Guided fix · 3 steps
- Open the CNAME pxc2._domainkey
Host:
pxc2._domainkey(without your domain). - Set the value exactly
Some registrars need a trailing dot to stop appending your domain:
pxc2.dkim.pxcmail.com.pxc2._domainkey CNAME pxc2.dkim.pxcmail.com.
- Check again
Until it resolves, recipients see “via pxcmail.com”.
Your DMARC policy is already p=reject — connect carefully
Cause: a DMARC record with p=reject exists from a previous setup. Until SPF and DKIM for PXCMail verify, receivers will reject mail sent through the gateway. We paused the relay switch for you.
- Found
v=DMARC1; p=reject; rua=mailto:[email protected]- Expected
Keep p=reject; finish DKIM first (or p=none for 7 days)
Guided fix · 3 steps
- Finish DKIM first (pxc2/pxc3 above)
Do not move mail to the gateway until DKIM is green.
- Optionally relax DMARC to p=none for 7 days
Only if you must switch today; we restore p=reject after alignment is confirmed.
_dmarc TXT v=DMARC1; p=none; rua=mailto:[email protected]
- Switch the relay and watch alignment for 24 h
Dashboard shows SPF/DKIM alignment per message.
Inbound mail still goes to Google — Hosted mailboxes will stay empty
Cause: you chose Hosted, but MX records point to aspmx.l.google.com. New mail keeps arriving in Gmail until MX changes; migration copies old mail either way.
- Found
aspmx.l.google.com (priority 1)- Expected
mx1.pxcmail.com (10), mx2.pxcmail.com (20)
Guided fix · 3 steps
- Finish mailbox migration first
Console → Migration shows 12/12 mailboxes synced before cutover.
- Change MX at low traffic (evening)
Replace all Google MX entries; TTL 1 hour.
@ MX 10 mx1.pxcmail.com @ MX 20 mx2.pxcmail.com
- Keep Gmail reachable for 7 days
Nothing is lost: Google keeps old mail; we run a final delta sync.
Your zone fails DNSSEC validation — many servers see no records at all
Cause: DNSSEC is on at the registrar but the DS record no longer matches the keys at your DNS host (often after moving DNS to Cloudflare or Squarespace). Validating resolvers (Google, Cloudflare, Quad9) return SERVFAIL for the whole domain, so SPF/DKIM/MX look missing and some mail bounces.
- Found
SERVFAIL at 8.8.8.8, 1.1.1.1, 9.9.9.9 · OK at non-validating resolver- Expected
All resolvers answer
Guided fix · 3 steps
- Confirm at the registrar
DNSSEC / DS record settings — note the key tag.
- Remove the stale DS or publish the correct one
Cloudflare → DNS → DNSSEC shows the DS to publish. Removing DS turns DNSSEC off (safe short-term).
- Check again from 4 resolvers
Up to 24 h for the DS TTL.
No mail has reached PXCMail from Google Workspace yet
Likely cause (90%): the outbound gateway is not set in Google Admin, or only for one organizational unit. Google is still delivering directly, bypassing encryption and archiving.
- Found
Last message from relay: never- Expected
Messages arriving at smtp-out.pxcmail.com:587
Guided fix · 4 steps
- Google Admin → Apps → Google Workspace → Gmail → Routing
Scroll to “Outbound gateway”.
- Enter smtp-out.pxcmail.com, port 587, “Require TLS”
Save at the top-level organization, not a sub-OU.
Outbound gateway: smtp-out.pxcmail.com:587 · TLS required
- Add the SMTP relay credential
Routing → Add another rule → Outbound gateway authentication: username
lakesidedental.com, password from “Reveal once”. Propagation up to 1 hour. - Send a test message
We show it here within a minute.
Microsoft 365 connector not found
Likely cause: the outbound connector (Office 365 → Partner organization) was not created, or without the “route all mail” rule. Microsoft keeps delivering directly.
- Found
Connector: none · Transport rule: none- Expected
Connector “PXCMail outbound” + rule “Route via PXCMail”
Guided fix · 4 steps
- Exchange admin center → Mail flow → Connectors → Add
From: Office 365 · To: Partner organization · Name: PXCMail outbound.
- Route to smtp-out.pxcmail.com, TLS required
Smart host; certificate subject
*.pxcmail.com. Validate with a test address.New-OutboundConnector -Name "PXCMail outbound" -ConnectorType Partner -UseMXRecord $false -SmartHosts smtp-out.pxcmail.com -TlsSettings CertificateValidation -IsTransportRuleScoped $true
- Create the transport rule
Mail flow → Rules → “Route via PXCMail”: all messages sent outside the organization → use connector.
- Send a test message
Relay authentication failing since 09:12 — 48 messages queued at Google
Cause: the relay credential was rotated at 09:10 (by J. Park) and Google Admin still has the old password. Google retries for up to 24 hours; nothing is lost yet.
- Found
535 5.7.8 Authentication credentials invalid (last 09:41)- Expected
235 Authentication successful
Guided fix · 3 steps
- Reveal the new credential
Domains → Relay → Reveal once (shown to you only).
- Update Google Admin → Gmail → Routing → Outbound gateway authentication
Paste the new password; save.
- Watch the queue drain
Google retries within 15 minutes.
Only 3 of 12 users are routing through PXCMail
Cause: the outbound gateway rule in Google Admin applies to the “Front desk” organizational unit only. Clinical and billing users still send directly.
- Found
Routing users: frontdesk@, m.chen@, s.kim@- Expected
All 12 users
Guided fix · 3 steps
- Google Admin → Gmail → Routing
Check the organizational unit selected on the left.
- Apply the outbound gateway at the top level
Sub-OU overrides should say “Inherited”.
- Check again after an hour
We list users seen through the relay.
1 · DNS records for lakesidedental.com
| Type | Host | Value | Purpose | Status |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com include:_spf.pxcmail.com ~all | SPF | Verified |
| CNAME | pxc1._domainkey | pxc1.dkim.pxcmail.com | DKIM | Verified |
| CNAME | pxc2._domainkey | pxc2.dkim.pxcmail.com | DKIM | Pending (added 4 min ago) |
| CNAME | pxc3._domainkey | pxc3.dkim.pxcmail.com | DKIM | Pending |
| MX | 10 feedback.pxcmail.com | MAIL FROM | Verified | |
| TXT | v=spf1 include:_spf.pxcmail.com ~all | MAIL FROM SPF | Verified | |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] | DMARC (start at none) | Optional |
2 · Route outbound mail through PXCMail
- Gmail → Hosts → Add route
NamePXCMail Gateway, hostsmtp-out.pxcmail.com, port 587, require TLS + CA-signed certificate. - Gmail → Routing → Outbound → Add
Route: PXCMail Gateway. SMTP AUTH usernamelakesidedental.com, password: - Status
Waiting for first message from Google
- Exchange admin → Connectors → Add
To partner organization, hostsmtp-out.pxcmail.com, always TLS. - Mail flow → Rules
Sender inside, recipient outside → redirect to connector. Tenant ID:7c1b…e2
Hosted: point MX to 10 mx1.pxcmail.com, 20 mx2.pxcmail.com on the cutover call after migration. Migration guide →
Need a hand?
Most practices do this with us on a 15-minute call. Or send the records to whoever manages your DNS.
Continue
You can continue while DKIM propagates; sending starts as soon as the relay is verified.
Send a test messagePrototype states: ok · spf-missing · spf-lookups · spf-dup · dkim-wrong · dmarc-reject · mx-elsewhere · dnssec · relay-google · relay-m365 · relay-auth · relay-partial · ticket