What actually breaks in a Google Workspace migration (and how to check it first)

Most Workspace projects that go badly do not fail at the migration tool. They fail because mail routing, domain authentication, and identity were treated as a last-minute checklist. Below is the sequence we run with IT leads in Dubai, the UK, and Africa before anyone's mailbox is moved.

Point MX at Google the way Google documents it now

Google's current Workspace MX record is smtp.google.com, with priority 1. Older guides still list aspmx.l.google.com and the ASPMX2/ASPMX3 backups. Those still work, but new tenants should follow the current Admin Help article. Lower the TTL on the existing MX records at least 24 to 48 hours before the window so a rollback does not wait out a 12-hour cache.

• Publish SPF as include:_spf.google.com (and keep any third-party senders you still use).
• Turn on DKIM in the Admin console and use a 2048-bit key. Google still accepts 1024-bit; 2048 is the default Google recommends.
• Set a DMARC policy you can live with on day one. p=none is fine for monitoring. Do not jump to p=reject until you have seen a week of reports.

Identity before mailboxes

Decide the source of truth: Google Cloud Directory, Microsoft Entra ID, or another LDAP/HR system. If you sync from Entra, test a non-production OU first. Confirm primary email, aliases, groups, and shared drives before the first wave. Break-glass super admin accounts should sit outside the sync path so a directory outage does not lock you out of the Admin console.

Coexistence, not a big-bang hope

If Exchange or another mail system stays live for a week or more, dual delivery or forwarding has to be designed. Unauthenticated forwarding is a common way to fail SPF and land in spam. Split the users into waves by department, not by whoever volunteers. Large mailboxes, delegates, and resource calendars belong in a dedicated wave with extra soak time.

Write the rollback on paper

Keep the previous MX values, TTLs, and the person who can change DNS in one note. If Google is not receiving mail after cutover, you should be able to revert in minutes, not in a Slack hunt. End users need a one-page FAQ: new web address, mobile profile steps, and where to get help. That document prevents half of the day-one tickets.