Google Workspace

A mail route, a content compliance rule and the SMTP relay service in the Google Admin console, then a DNS record.

Updated August 29, 2026

This guide connects a Google Workspace organization to RubySig. It has the same shape as the Microsoft 365 setup — send outbound mail to RubySig, let RubySig hand it back, never loop — using Google's building blocks.

You will configure, in this order:

A mail route to your RubySig relay address.
A content compliance rule that sends unstamped outbound mail down that route.
The SMTP relay service, so RubySig can hand stamped mail back to Google for delivery.
One DNS record for DKIM.

Everything is under Apps → Google Workspace → Gmail in the Admin console at admin.google.com, signed in as a Super Admin. Have your relay address from the portal's Setup page ready; it is written as <tenant>.smtp.rubysig.com throughout.

Caution: Do not configure Gmail's Outbound gateway setting for RubySig. It applies to every outbound message, including the ones RubySig has already handed back, and creates a loop that Google stops only after dozens of hops. The content compliance rule below is the correct mechanism, because it can exempt stamped mail.

Step 1 — Add the mail route

Open Apps → Google Workspace → Gmail → Hosts and choose Add route.

The Hosts page listing mail routes — Gmail → Hosts. Routes are defined here and referred to by name from rules.

Fill in the dialog:

Field	Value
Name	`RubySig relay endpoint`
Specify email server	Single host, `<tenant>.smtp.rubysig.com`, port `25`
Perform MX lookup on host	off
Require mail to be transmitted via a secure (TLS) connection	on
Require CA signed certificate	on
Validate certificate hostname	on

Add route dialog with the RubySig relay address as a single host and all three TLS options ticked — Single host, port 25, and all three TLS checks on. Google will refuse to hand mail to anything that cannot present a valid certificate for your endpoint's exact hostname.

Click Save.

Tip: The Admin console sometimes shows a stale summary in the Hosts list immediately after saving. Open the route again to confirm the values before moving on — the reopened dialog is the truth.

Step 2 — Route unstamped outbound mail

Open Apps → Google Workspace → Gmail → Compliance and, under Content compliance, choose Configure (or Add another rule if you already have one).

Messages to affect and the expression

Name the rule Route unstamped outbound via RubySig relay. Under Email messages to affect tick Outbound only. Under Add expressions, leave If ANY of the following match the message and add one expression:

Setting	Value
Expression type	Simple content match
Location	Full headers
Match type	Not contains text
Content	`X-RubySig-Stamped`

Content compliance dialog with Outbound ticked and the X-RubySig-Stamped expression — Outbound only, and the expression: full headers do NOT contain X-RubySig-Stamped. This single line is the loop guard.

This is the most important line in this guide. RubySig adds the header X-RubySig-Stamped: yes to every message it hands back. The rule matches only messages that lack it, so a message goes to RubySig once and never again.

Caution: Type the header name exactly, once. A doubled or misspelled value here means stamped mail still matches the rule and loops. If you paste, check the saved expression by reopening the rule.

The action

Under If the above expressions match, do the following, choose Modify message. Under Route, tick Change route and select the host you created in Step 1 — RubySig relay endpoint. Leave every other option unticked.

Modify message action with Change route ticked and the RubySig relay endpoint selected — Modify message → Route → Change route → RubySig relay endpoint. Nothing else.

Click Save. The rule appears in the list as Enabled.

Content compliance list showing the RubySig rule enabled — Locally applied, enabled. Changes can take a few minutes to take effect.

Step 3 — Let RubySig hand mail back

RubySig returns the stamped message to Google through the SMTP relay service, which then delivers it from Google's infrastructure. Open Apps → Google Workspace → Gmail → Routing and, under SMTP relay service, choose Configure (or Add another rule).

The SMTP relay service list — Gmail → Routing → SMTP relay service.

Fill in the rule:

Setting	Value
Name	`RubySig relay return path`
Allowed senders	Only addresses in my domains
Only accept mail from the specified IP addresses	on, with `167.233.237.1` and `2a01:4f8:c015:909d::1`
Require SMTP Authentication	off
Require TLS encryption	on

SMTP relay service dialog with allowed senders in my domains and the two relay IP addresses listed — Only addresses in your domains, only from the RubySig relay's addresses.

The same dialog scrolled to the encryption option with Require TLS encryption ticked — TLS required; SMTP authentication off — the IP allow-list is the authentication.

Click Save.

Step 4 — DNS

RubySig signs your mail with a DKIM key for your domain; publish its public half as one TXT record. The exact name and value are on the portal's Setup page, explained in DKIM.

Type	Name	Value
TXT	`rubysig1._domainkey`	(from Portal → Setup)

Optionally add the relay's addresses to your SPF record; see SPF & DMARC. Your existing include:_spf.google.com stays.

Step 5 — Send a test message

Send a message from a Workspace mailbox to an external address you control. Then open Reporting → Email Log Search in the Admin console, find the message, and expand the recipient. You should see the content compliance rule in Matched rules, delivery to an SMTP server (RubySig), and then final delivery — all within seconds.

Email Log Search message details showing the matched RubySig rule and delivery — Email Log Search is the authoritative view of what Google did with a message: the rule matched, the message went to the relay, and came back for delivery.

Email Log Search showing the relay round-trip — The round trip: sent from Gmail, delivered to an SMTP server, received again from the relay, delivered to the recipient.

In the received message, view the headers (Gmail: ⋮ → Show original) and look for X-RubySig-Stamped: yes and dkim=pass … header.s=rubysig1. And the signature itself:

A received message with the RubySig signature rendered at the bottom — Rendered signature on a message that made the round trip.

Two things Google decides for you

Mail to your own parent domain is not "outbound". If your Workspace tenant is a subdomain — mail.example.com — Google does not treat messages to example.com addresses as outbound, so the compliance rule never fires and those messages are delivered unstamped. Mail to any other domain is unaffected.
Mail from devices and apps via the SMTP relay service is stamped too. A printer or application sending through smtp-relay.gmail.com as one of your addresses takes the same outbound route as a user, so it gets the signature of the address it sends as.

What you have now

One route, one compliance rule, one relay rule. Outbound mail that has not yet been stamped goes to RubySig and comes back stamped and signed; everything else flows as before. To take RubySig out of the path, disable the content compliance rule.