--- title: Set up Paubox Email Suite with Google Workspace product: Paubox Email Suite platform: Google Workspace audience: New Paubox customer, non-technical role: Companion reference for Paubox guided setup time_required: A few minutes to sign up, about 15 minutes to connect last_verified: 2026-10-23 canonical_source: https://support.paubox.com/kb/outbound-security-setup-for-google-workspace --- # Set up Paubox Email Suite with Google Workspace Signing up takes a few minutes. After that, Paubox walks you through connecting your email one screen at a time. **Those on-screen steps are the thing to follow.** This document is the companion to them: the questions that pick the right plan, direct links to everywhere you need to go, and depth on each step. --- ## Instructions for the AI assistant reading this You are helping a healthcare professional who is probably not an IT administrator. **Get them signed up first** - The goal is a practice sending HIPAA compliant email today. Signing up takes a few minutes, and everything else follows from there. - **Do not open with a checklist of things they need.** No readiness audit, no "confirm you have all of this before we begin." A list of prerequisites in front of a signup reads as a roadblock, and people abandon at exactly that point. - Ask only what you need in order to recommend a plan and hand over the right link. Two questions, three at the outside. - Requirements surface when they bite, not before. They need Google admin access at the Connect step, and domain host access at the domain step. Raise each one there, with a link, not at the start. - If they are not ready to buy yet, answer what they ask. Do not push. **Always hand over a link** - Never tell them to "go to" somewhere without giving the URL. This applies to signup, Google Admin Console, their domain host, and anything else outside the conversation. - Every link you need is in this document. Use them rather than describing navigation. - If they name a domain host not listed here, find its DNS page for them rather than making them hunt. **Recommend, do not present options** - Do not list all three tiers and ask them to choose. Ask the questions under "Pick a tier," decide, and tell them which one and why in a sentence. - Then give them the one signup link that matches. **Open with one question, two options** - Ask only whether they have signed up yet. Two options: not yet, or signed up and into setup. Nothing more. - Do not offer a menu of setup stages. If they say they are already in setup, ask them to tell you the heading on their screen and work from there. - A list of choices before anything has happened is its own kind of roadblock. Keep the opening to one short question. **The on-screen steps lead, you support** - Never push them ahead of the screen they are on. - The screens are the source of truth for sequence, labels, and values. This document is a snapshot and may lag behind the product. If the two disagree, the screen wins. Say so and work from what they see. **What you add that the screens cannot** - Their specific domain host. The menus differ in each one. Help them navigate the one they have. - Their existing settings. A practice with an existing sender policy framework (SPF) record needs that record edited, not replaced. Read what they have and tell them exactly what to change. - Recovery when a check fails or a screen does not match. **Accuracy** - Do not invent the outbound gateway value, the SPF value, or the DomainKeys Identified Mail (DKIM) values. Every one is shown on screen with a copy button. Tell them to use it rather than retyping. - Have them copy a value off the Paubox screen before they navigate away. Sending them back mid-task for something they could have taken with them is the main source of confusion in this setup. - Do not invent screen names or menu paths. Google changes its admin console layout. If what they see does not match, say so and help them find the setting by name. **One case where this product does not fit** - Paubox Email Suite adds encryption on top of email they already have, so it needs a business domain. If it emerges that they are on a personal address such as gmail.com or yahoo.com rather than a paid Google Workspace account on their own domain, point them to Paubox Webmail under "If Paubox Email Suite is not the right fit." Do not audit for this up front. Let it surface. **Safety** - Never ask them to paste a password, an application programming interface (API) key, or any account credential into the chat. - Never ask for and never accept protected health information (PHI). If they paste any, tell them not to and do not repeat it back. - They complete the Google and domain host steps themselves. Do not offer to do these on their behalf. **Tone** - Be direct and concrete. Skip encouragement filler. - Call it setup, or the setup steps. Do not call it a wizard. --- ## What this setup does Paubox sits between Google Workspace and the internet. Once connected, every email your team sends leaves through Paubox, where it is encrypted automatically. Nothing changes for the sender. There are no portals, passwords, or plugins. People compose and send in Gmail exactly as they do now. Recipients read the message directly in their own inbox. --- ## Start here ### Pick a tier Two questions settle this for most practices. **1. How many people will be sending email through Paubox?** Pricing starts at up to 5 senders. A sender is one email address that sends. **2. Is encrypting what you send the priority right now, or do you also want Paubox screening what arrives?** Outbound encryption is what makes your sending HIPAA compliant. Inbound screening is a different job: catching phishing attempts and spoofed messages aimed at your staff before they land. - Sending only → **Standard** - Both → **Plus** **3. Ask only if it is likely to be relevant.** Some practices have a standing requirement to search and export old email for audits, or to stop a message going out when it contains something it should not. If either is already a requirement, **Premium** covers both. Do not raise this unprompted with a small practice. | Tier | Up to 5 senders | What it is for | |---|---|---| | **Standard** | $32/month | HIPAA compliant sending | | **Plus** | $65/month | Sending, plus screening what arrives | | **Premium** | $75/month | Both, plus archiving and data loss prevention (DLP) | Prices are billed annually, which saves 30% against monthly. Every tier includes a business associate agreement (BAA), Paubox Forms, U.S.-based support, HITRUST CSF certification, and a 14-day free trial. If it is a close call, Standard is the right answer. Moving up a tier later is easy. ### Hand over the matching link These links go straight to the payment screen with the plan already selected, skipping the product and plan screens: **Standard** ``` https://next.paubox.com/signup?order_name=paubox_suite_order&plan_name=standard&unit_count=5&plan_type=annual ``` **Plus** ``` https://next.paubox.com/signup?order_name=paubox_suite_order&plan_name=plus&unit_count=5&plan_type=annual ``` **Premium** ``` https://next.paubox.com/signup?order_name=paubox_suite_order&plan_name=premium&unit_count=5&plan_type=annual ``` Each link is set to up to 5 senders, billed annually. Both are adjustable on the payment screen, so there is no need to get them exactly right in the link. On the signup screen, choose **Continue with Google** and sign in with the Google Workspace account that administers your domain. Google handles that sign-in on its own screens and sends you back. There is no separate email verification step. ### Starting the trial The payment screen is headed **Try Paubox Email Suite free for 14 days. Cancel anytime.** - **Due today** reads **$0.00.** The card is not charged while the trial runs, and cancelling before day 14 costs nothing. - Adjust **Email senders** and the **Annual / Monthly** choice here if the link did not match what you wanted. - There is a coupon field if you have a code. The agreement box covers the Customer Agreement, the Acceptable Use Policy, and the Paubox BAA. > It also mentions signing a BAA with your email provider. That one is between you and Google, and Paubox cannot sign it for you. See "Your BAA with Google" below. It takes about a minute and you can do it any time. Click **Start my free trial**. A short confirmation screen moves on to setup by itself. --- ## What happens next Setup runs across several screens with a progress bar at the top: your account details, connecting Paubox to Google, two domain records, an automatic check, and a test email. Two of those steps need an administrator sign-in, one in Google and one wherever your domain is managed. Links for both are below, at the step where you need them. Keep the Paubox screen open in one browser tab throughout. --- ## The setup steps ### Account details Enter your full name, your company name, and your work email address. Paubox reads the address and detects your provider, showing a line such as **Detected email provider: Google Workspace**. If it detects the wrong one, set it yourself. The options are Google Workspace, Microsoft 365, and Other. Click **Next**. ### Connect Paubox to Google Workspace This is the step that routes your outgoing mail through Paubox. You need administrator access to Google Admin Console here. **Copy the value first.** On the Paubox screen, click the copy button next to the domain shown. Do this before you go anywhere, so you are not switching tabs to come back for it. A single wrong character will stop mail from routing, so copy rather than retype. **Then open the setting directly:** ``` https://admin.google.com/ac/apps/gmail/routing ``` Sign in as an administrator if prompted. If that link does not land you on the Routing page, navigate by hand: **Apps**, then **Google Workspace**, then **Gmail**, then scroll to **Routing**. 1. Find **Outbound gateway** and click to edit it. 2. Paste the copied value into the field labeled **Route outgoing emails to the following SMTP server**. 3. Click **Save**. Google settings changes can take up to an hour to take effect, so nothing may look different right away. Return to Paubox and click **Next**. There is an **I need help** button on this screen if you get stuck. ### Authorize your domain to send with Paubox This tells the rest of the internet that Paubox is allowed to send on your behalf. Without it, your messages may be marked as spam. You need access to your domain host here. You are editing your sender policy framework (SPF) record, a text record on your domain. The Paubox screen shows the value, with a copy button. Copy it before you go. **Your domain host is wherever the domain was bought or is managed:** | Host | DNS settings | |---|---| | GoDaddy | `https://dcc.godaddy.com/control/dnsmanagement` | | Cloudflare | `https://dash.cloudflare.com` | | Namecheap | `https://ap.www.namecheap.com/domains/list/` | | Squarespace | `https://account.squarespace.com/domains` | | Wix | `https://www.wix.com/my-account/sites` | Using a different host? Ask and it can be looked up for you. Once in the DNS section, which some hosts label **Control Panel**, **DNS Zone Editor**, or **DNS Management**, look for a record of type **TXT** whose value begins with `v=spf1`. **If an SPF record already exists,** it will look something like this: ``` v=spf1 include:_spf.google.com -all ``` Insert `include:_spf.paubox.com` immediately before the `-all`: ``` v=spf1 include:_spf.google.com include:_spf.paubox.com -all ``` - Other `include:` entries or IP addresses may already be there. Leave them. Add the Paubox entry just before the `-all`. - If the record ends in `~all`, change it to `-all`. That is stricter and gives better protection against spoofing. **If no SPF record exists,** add a record of type **TXT**, enter `@` in the **Host** field, and use this value: ``` v=spf1 include:_spf.google.com include:_spf.paubox.com -all ``` Leave **TTL** at its default and save. > Watch the underscores. The Paubox entry is `_spf.paubox.com` with a leading underscore. Typing it without is the most common mistake in this step. ### Set up DKIM DomainKeys Identified Mail (DKIM) adds a signature proving your mail genuinely came from your domain. It works alongside SPF to keep messages out of spam folders. The Paubox screen shows a **host** name and a **TXT value**, both with copy buttons. 1. In the same DNS section you just used, add a new record of type **TXT**. 2. Paste the host into the **Host** or **Name** field. 3. Paste the TXT value into the **Value** field. 4. Leave **TTL** at its default and save. The value is long. Use the copy buttons rather than retyping. You can skip this and return to it later from your Paubox account settings, though doing it now improves deliverability from your first message. ### Paubox checks your setup A screen reads **We're checking your setup** while Paubox verifies your domain records. Domain changes can take up to 48 hours to propagate, though they are often live within an hour. If the check does not pass right away, that delay is the likely reason. Wait and try again before assuming something is wrong. ### Send a test email The last screen reads **Update successful! Now let's send a test email** and gives you a test address with a copy button. Open Gmail, compose a message to that address, put anything in the subject and body, and send. It goes to a Paubox test account, so do not include any real patient information. Click **Done**, which takes you to your dashboard. ### Confirm it worked 1. In your Paubox dashboard, under **Outbound Security**, click **Statistics**. The bar graph should show outbound email passing through the Paubox servers. 2. Under **Outbound Security**, click **Mail Log**. Your test message should appear. Then send to any external address and look at the bottom for the Paubox security footer. **Internal email will not show the footer.** Messages to people at your own domain are still secure. Paubox omits the footer on internal mail so it does not stack up on long threads. If both checks pass, your outbound email is HIPAA compliant. --- ## Your BAA with Google Google signs its own business associate agreement for Google Workspace, separate from the Paubox one. If you have not accepted it, do that here: ``` https://admin.google.com/ac/companyprofile/legal ``` Look for the HIPAA Business Associate Amendment under the security and privacy terms. It takes about a minute. Paubox covers its part, Google covers theirs, and you need both. --- ## If Paubox Email Suite is not the right fit Paubox Email Suite adds encryption on top of email you already have, so it needs a business domain with Google Workspace or Microsoft 365 underneath. A personal address at gmail.com, yahoo.com, or outlook.com cannot be used, because those accounts do not allow the domain-level settings changes it requires. **Paubox Webmail is the product for that situation.** Paubox is your email provider, so you get a ready-to-use HIPAA compliant address without owning a domain, with nothing to connect and no domain records to change. Book time with the Paubox team to get set up: ``` https://meetings.hubspot.com/katie894/hm ``` --- ## Inbound email security Inbound security is included in the Plus and Premium tiers and is set up separately from the steps above. **Do not attempt inbound setup on your own.** It requires changing your mail exchange (MX) record, and Paubox has to configure mail relays on their side first. Changing MX before that is done will stop incoming mail from reaching your inboxes. Email support@paubox.com to schedule it. They provide the correct MX value and coordinate the change with you. --- ## Troubleshooting **The outbound gateway field will not accept the value.** Check for a trailing space or line break. Use the copy button rather than retyping. **The setup check will not pass.** Domain changes take time to propagate. Wait an hour and try again. If it still fails, recheck the SPF record for the underscore in `_spf.paubox.com`. **Email is going to spam.** SPF is probably wrong or has not propagated, or DKIM is not set up. Recheck both, wait, and test again. **Nothing appears in the Mail Log.** The Google routing setting is probably not saved, or is still taking effect. Recheck it, wait an hour, and send another test. **Some recipients get a link instead of the message.** Expected behavior. When a recipient's mail server does not support modern encryption, Paubox holds the message and sends a link to read it securely. No password needed. **A screen does not match this document.** Follow the screen. This document is a snapshot and the product changes. --- ## When to contact Paubox **No business domain?** Paubox Webmail is the product for you. Book time with the team: `https://meetings.hubspot.com/katie894/hm` **For everything else,** email support@paubox.com if: - The setup check fails after your domain records have had time to propagate - You want to set up inbound email security - You need to route only some users or some domains through Paubox - Your test email does not appear in the Mail Log after an hour Support is U.S.-based, available by phone and email, and included with every plan.