Cloudflare Docs
Area 1 Email Security
Area 1 Email Security
Visit Area 1 Email Security on GitHub
Set theme to dark (⇧+D)

Deploy and configure Google Workspace with Area 1 as MX Record

A schematic showing where Area 1 security is in the life cycle of an email received

In this tutorial, you will learn how to configure Google Workspace with Area 1 as MX record. This tutorial is broken down into several steps.

​​ Requirements

​​ Prerequisites

To ensure changes made in this tutorial take effect quickly, update the Time to Live (TTL) value of the existing MX records on your domains to five minutes. Do this on all the domains you will be deploying.

Changing the TTL value instructs DNS servers on how long to cache this value before requesting an update from the responsible name server. You need to change the TTL value before changing your MX records to Cloudflare Area 1. This will ensure that changes take effect quickly and can also be reverted quickly if needed. If your DNS manager does not allow for a TTL of five minutes, set it to the lowest possible setting.

To check your existing TTL, open a terminal window and run the following command against your domain:

$ dig mx <YOUR_DOMAIN>
; <<>> DiG 9.10.6 <<>> mx <YOUR_DOMAIN>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39938
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;domain. IN MX
;; ANSWER SECTION:
<YOUR_DOMAIN>. 300 IN MX 5 mailstream-central.mxrecord.mx.
<YOUR_DOMAIN>. 300 IN MX 10 mailstream-east.mxrecord.io.
<YOUR_DOMAIN>. 300 IN MX 10 mailstream-west.mxrecord.io.

In the above example, TTL is shown in seconds as 300 (or five minutes).

If you are using Cloudflare for DNS, you can leave the TTL setting as Auto.

Below is a list with instructions on how to edit MX records for some popular services:

​​ 1. Add Area 1 IP addresses to the Inbound gateway configuration

When Area 1 is deployed as the MX record for Google Workspace, the Inbound gateway needs to be configured such that Google Workspace is aware that it is no longer the MX record for the domain. This is a critical step as it will allow Google Workspace to accept messages from Area 1.

  1. Go to the Google Administrative Console.

  2. Go to Apps > Google Workspace > Gmail.

    Access Gmail

  3. Select Spam, Phishing, and Malware and scroll to Inbound Gateway configuration.

    Access the spam, phishing and malware setting

  4. Enable Inbound Gateway, and configure it with the following details:

    Enable inbound gateway

    • In Gateway IPs, select the Add link, and add the IPs mentioned in Egress IPs.
    • Select Automatically detect external IP (recommended).
    • Select Require TLS for connections from the email gateways listed above.

    Inbound gateway settings

  1. Select the Save button at the bottom of the dialog box to save the configuration once the details have been entered. Once saved, the administrator console will show the Inbound Gateway as enabled.

    Inbound gateway on

​​ 2. Quarantine malicious detections

This optional step is highly recommended to prevent users from being exposed to malicious messages.

When messages are identified as malicious, Area 1 will insert the X-header X-Area1Security-Disposition into the message with the corresponding disposition. Based on the value of the X-Area1Security-Disposition, a content compliance filter can be configured to send malicious detections to an administrative quarantine. This section will outline the steps required to:

  • Create an Area 1 Malicious quarantine.
  • Create the content compliance filter to send malicious messages to quarantine.

​​ Create Area 1 Malicious Quarantine

If you would like to send Area 1 malicious detection to a separate quarantine other than the default quarantine, you will need to create a new quarantine.

  1. In Google’s administrative console, select the Manage quarantines panel.

    Select the manage quarantines panel

  2. Select ADD QUARANTINE to configure the new quarantine. This will bring up a pop-up for the configuration details.

    Select the add quarantine button

  3. In the quarantine configuration pop-up, enter the following:

    • Name: Area 1 Malicious.
    • Description: Area 1 Malicious.
    • For the Inbound denial consequence, select Drop Message.
    • For the Outbound denial consequence, select Drop Message.

    Configure the quarantine settings

When you are finished entering these details, select SAVE.

  1. To access the newly create quarantine, select GO TO ADMIN QUARANTINE or access the quarantine directly by pointing your browser to https://email-quarantine.google.com/adminreview.

    Access the quarantine created

    Once in the Admin quarantine console, you can access the Area 1 Malicious quarantine by selecting Quarantine:ALL > Area 1 Malicious in the filter section. Quarantined messages can be released as needed by an administrator.

    Access Area 1

​​ Create a content compliance filter to send malicious messages to quarantine

  1. In Google’s administrative console, select Compliance to configure the content compliance filter.

    Access the compliance configuration

  2. Go to the Content compliance area and select CONFIGURE to open the configuration dialog pop-up.

    Select the configure button

  3. In the Content compliance filter configuration, enter the following:

    • Name: Quarantine Area 1 Malicious.
    • In 1. Email message to affect, select Inbound.
    • In 2. Add expression that describe the content you want to search for in each message:
      • Select Add to add the condition.
        • In the Simple content match dropdown, select Advanced content match.
        • In Location, select Full headers.
        • In Match type, select Contains text.
        • In Content, enter X-Area1Security-Disposition: MALICIOUS.
      • Select SAVE to save the condition.
    • In 3. If the above expression match, do the following, select the Action dropdown. Then choose Quarantine message and the Area 1 Malicious quarantine that was created in the previous step.

    Configure the compliance filter

    After you enter this information, select SAVE.

  4. Once saved, the console will update with the newly configured content compliance filter.

    After configuration, the console shows the content compliance filter

    If you would like to quarantine the other dispositions, repeat the above steps and use the following strings for the other dispositions:

    • X-Area1Security-Disposition: MALICIOUS
    • X-Area1Security-Disposition: SUSPICIOUS
    • X-Area1Security-Disposition: SPOOF
    • X-Area1Security-Disposition: UCE

    If desired, you can create a separate quarantine for each of the dispositions.

​​ 3. Update your domain MX records

Instructions to update your MX records will depend on the DNS provider you are using. You need to replace the existing Google MX records with the Area 1 hosts.

These are the typical default MX records when using Google Workspace:

MX PriorityHost
1aspmx.l.google.com
5alt1.aspmx.l.google.com
5alt2.aspmx.l.google.com
10alt3.aspmx.l.google.com
10alt4.aspmx.l.google.com

To update your MX records with Area 1, use the following:

MX PriorityHost
5mailstream-central.mxrecord.mx
10mailstream-east.mxrecord.io
10mailstream-west.mxrecord.io

When configuring the Area 1 MX records, it is important to configure hosts with the correct MX priority. This will allow mail flows to the preferred hosts and fail over as needed.

If you are located in Europe or GDPR applies to the domain, use the following MX records. This will prioritize email flow through Germany and fail over to the United States.

MX PriorityHost
5mailstream-eu1.mxrecord.io
10mailstream-central.mxrecord.mx
20mailstream-east.mxrecord.io
20mailstream-west.mxrecord.io

Once the MX records have been updated with the new MX records, delete your old MX records and leave only the ones above. DNS updates may take up to 36 hours to fully propagate around the Internet. Some of the faster DNS providers will start to update records within minutes.

DNS changes will reach the major DNS servers in about an hour or follow the TTL value as described in the Prerequisites section.

​​ 4. Secure your email flow

After 36 hours, the MX record DNS update will have sufficiently propagated across the Internet. It is now safe to secure your email flow. This will ensure that Google only accepts messages that are first received by Area 1. This step is highly recommended to prevent threat actors from using cached MX entries to bypass Area 1 by injecting messages directly into Gmail.

  1. Access the Google Administrative Console, then select Apps > Google Workspace > Gmail.

  2. Select Spam, Phishing, and Malware.

  3. Go to Inbound Gateway configuration and select Configure.

  4. Enable Reject all mail not from gateway IPs and select Save.

  5. Select Save once more to commit and activate the configuration change in the Gmail advanced configuration console.

​​ 5. Send Area 1 spam to user spam folder (optional)

Unlike the configuration in step 2 where the message can be sent to an administrative quarantine, this optional step can be configured to send messages that are identified as spam by Area 1 to the user’s spam folder.

  1. Access Google’s Administrative Console, then select Apps > Google Workspace > Gmail.

  2. Select Spam, Phishing, and Malware.

  3. Go to Inbound Gateway configuration and select Configure.

  4. In the Message Tagging section, select Message is considered spam if the following header regexp matches.

  5. In the Regexp section, enter the string X-Area1Security-Disposition: UCE.

  6. Select SAVE to save the updated configuration.