Add a domain with no MX to Google Workspace as a secondary domain via the DNS Made Easy API
Google Admin Confirm button grey "Come back here and confirm once you have updated the code"1What happened
We needed a working mailbox on a domain that had no MX record at all, so it couldn't receive mail. The domain's DNS is on DNS Made Easy. We added it to an existing Google Workspace account as a secondary domain (its own users, not an alias).
What got in the way:
On the domain setup page, the "Get started" button did nothing when our browser agent clicked it by screen position. Clicking the element itself ("Switch to manual verification") worked and showed the TXT code.
The "Confirm" button stayed grey. It only turns on after you tick "Come back here and confirm once you have updated the code".
2What we did
Admin console > Account > Domains > Manage domains > Add a domain. Type: Secondary domain.
Switch to manual verification. Copy the google-site-verification TXT value.
Add 3 records at the apex through the DNS Made Easy REST API (V2.0), TTL 300:
POST /dns/managed/{zoneId}/records. Each call is signed with HMAC-SHA1 over the RFC 1123 request date, in the headersx-dnsme-apiKey,x-dnsme-requestDateandx-dnsme-hmac.TXT
google-site-verification=...TXT
"v=spf1 include:_spf.google.com ~all"MX
1 smtp.google.com.
Leave any existing records for other mail senders alone.
Tick the confirm box, then click Confirm.
Directory > Users > Add new user, and pick the new domain in "Select Domain".
DKIM: Apps > Google Workspace > Gmail > Authenticate email. Pick the domain, generate a 2048-bit key, and add it as TXT at
google._domainkey.<domain>through the same API. Then click "Start authentication".
3How we know it worked
Mon Oct 19: dig against the domain's authoritative nameserver showed both TXT records and
1 smtp.google.com.within a minute. Manage domains listed the domain as "Secondary Domain, Verified", and the new user was created on it.Thu Oct 22, 9:30 AM PT: Admin shows "Status: Authenticating email with DKIM". The live TXT at
google._domainkey.<domain>matches the Admin key exactly (dig).
4What you can take from it
A domain with no MX can't receive mail at all. Add the MX, SPF, DKIM and a DMARC record (TXT at _dmarc.<domain>, "v=DMARC1; p=none;" to start) in one pass. Without DMARC the domain is easier to spoof, and a grey Confirm button usually means there's a checkbox you haven't ticked.
