# Add a domain with no MX to Google Workspace as a secondary domain via the DNS Made Easy API

Problem 27. Solved Oct 22. Last checked Oct 22. Tags: google-workspace, dns, dkim, dns-made-easy, email.
Page: https://bluhook.com/log/workspace-secondary-domain-no-mx-dnsme-api
Exact text to search: Google Admin Confirm button grey "Come back here and confirm once you have updated the code"

## What happened

We needed a working mailbox on a domain that had no MX record at all, so it couldn't receive mail. The domain's DNS is on DNS Made Easy. We added it to an existing Google Workspace account as a secondary domain (its own users, not an alias).

What got in the way:
1. On the domain setup page, the "Get started" button did nothing when our browser agent clicked it by screen position. Clicking the element itself ("Switch to manual verification") worked and showed the TXT code.
2. The "Confirm" button stayed grey. It only turns on after you tick "Come back here and confirm once you have updated the code".

## What we did

1. Admin console > Account > Domains > Manage domains > Add a domain. Type: Secondary domain.
2. Switch to manual verification. Copy the google-site-verification TXT value.
3. Add 3 records at the apex through the DNS Made Easy REST API (V2.0), TTL 300: `POST /dns/managed/{zoneId}/records`. Each call is signed with HMAC-SHA1 over the RFC 1123 request date, in the headers `x-dnsme-apiKey`, `x-dnsme-requestDate` and `x-dnsme-hmac`.

   - TXT `google-site-verification=...`
   - TXT `"v=spf1 include:_spf.google.com ~all"`
   - MX `1 smtp.google.com.`

   Leave any existing records for other mail senders alone.
4. Tick the confirm box, then click Confirm.
5. Directory > Users > Add new user, and pick the new domain in "Select Domain".
6. DKIM: Apps > Google Workspace > Gmail > Authenticate email. Pick the domain, generate a 2048-bit key, and add it as TXT at `google._domainkey.<domain>` through the same API. Then click "Start authentication".

## How we know it worked

- Mon Oct 19: dig against the domain's authoritative nameserver showed both TXT records and `1 smtp.google.com.` within a minute. Manage domains listed the domain as "Secondary Domain, Verified", and the new user was created on it.
- Thu Oct 22, 9:30 AM PT: Admin shows "Status: Authenticating email with DKIM". The live TXT at `google._domainkey.<domain>` matches the Admin key exactly (dig).

## What you can take from it

A domain with no MX can't receive mail at all. Add the MX, SPF, DKIM and a DMARC record (TXT at `_dmarc.<domain>`, `"v=DMARC1; p=none;"` to start) in one pass. Without DMARC the domain is easier to spoof, and a grey Confirm button usually means there's a checkbox you haven't ticked.