Google Workspace

Fromenance is a communication provenance platform that answers forwards sent to verify@yourdomain.com. On Google Workspace, that address is a group or user with a routing rule that changes the envelope recipient to your tenant inbox.

By the end you will have verify@ created, a routing rule that redirects it to <slug>@verify.fromenance.com, DKIM signing confirmed, and the forwarding test marked Working.

Before you start

• Super admin or an admin role with Gmail settings access in the Google Admin console.
• Your tenant inbox address, verify_address in the setup wizard, for example northfield@verify.fromenance.com.
• The domain verified in Fromenance.

1. Create the verify@ address

Either works. A group is simpler to keep unattended.

As a group

1. Admin console, Directory, Groups, Create group.
2. Name Verify, group email verify@yourdomain.com.
3. Access type: Public, and under “Who can post” allow anyone on the internet. External customers must be able to write to it.
4. Do not add members. Mail is routed on before delivery.

As a user

1. Admin console, Directory, Users, Add new user, primary email verify@yourdomain.com.
2. Set a strong password and store it; nobody signs in to it.

2. Create the routing rule

Use a default routing rule so the redirect happens at the domain edge, before the group or mailbox.

1. Admin console, Apps, Google Workspace, Gmail, Routing (or Default routing on older consoles).
2. Under Default routing, click Add another rule (or Configure).
3. Specify envelope recipients: choose Single recipient and enter verify@yourdomain.com.
4. If the envelope recipient matches the above, do the following: choose Modify message.
5. Tick Change envelope recipient and enter your tenant inbox, northfield@verify.fromenance.com, in Replace recipient.
6. Leave Add X-Gm-Original-To header ticked. Leave Also deliver to unticked and do not add other recipients.
7. Do not tick Bypass spam filter for this message unless you see customer forwards blocked by spam filtering; Fromenance handles abuse itself.
8. Options: Perform this action on non-recognized and recognized addresses.
9. Save. Google can take up to an hour to apply routing changes; usually it is a few minutes.

This rule redirects: the customer remains the sender, the original headers are kept, and Google signs the outbound copy with DKIM for your domain.

3. Keep DKIM signing on

1. Admin console, Apps, Google Workspace, Gmail, Authenticate email.
2. Select your domain. Status must read “Authenticating email” with a selector (usually google).
3. If it reads “Not authenticating email”, generate a record, publish the google._domainkey TXT record at your DNS provider, and click Start authentication.

Redirected mail is signed with this key. Without it the trust check fails with auth_failed.

Mail that leaves Google through a third party outbound gateway (Proofpoint, Mimecast, Cisco) is signed by Google before the gateway sees it; make sure the gateway does not stamp a disclaimer or rewrite the body on the way out, or the body hash check fails. If your gateway adds an ARC seal for your domain instead, that also passes.

4. Confirm with the forwarding test

1. In the setup wizard, step 4, click Send test, or call POST /v1/domains/{id}/forwarding-test.
2. Fromenance emails verify@yourdomain.com with a token. Within a minute the status should read Working via dkim yourdomain.com.
3. failed: auth_failed with no signatures means the routing rule is not matching yet or DKIM is off. failed: domain_not_owned names a different signing domain; add it as a domain in Fromenance or fix the DKIM configuration for your primary domain.

Then forward any message from a personal mailbox to verify@yourdomain.com and confirm a Not verified reply arrives.

Notes

• Keep verify@ out of any rule that appends footers or disclaimers; content modification after signing breaks DKIM.
• If you use a content compliance rule that quarantines external mail with attachments, add an exception for verify@. Customers forward .eml attachments.
• Google groups can be set to moderate external messages; make sure message moderation is off for this group.