When migrating your email from Google Suite to Office 365, or simply having mail flow coexistence between the two systems, I am usually asked the same question: Which email domains can I use as forwarding addresses in Google, to forward email to Office 365?
The answer is not very straightforward, and first and foremost it’s important to understand that in Google, per user email forwarding can be done in two ways:
- The User-level routing option in the Google Admin console
- The forward mail to another account option each user has on his mailbox settings
For more information you can check the Google Suite Forwarding options article.
Now lets cover both options and what domains can be used.
Forwarding domain options: User Level Routing
Basically, with this option, the administrator can select whatever domain he wants to be the forwarding address. A very common scenario is to choose the onmicrosoft.com address, as the example below.
Above you can see the forwarding in the Google Admin portal, to the address firstname.lastname@example.org. The SMTP envelope will remain intact and no copy will be saved in the Google mailbox.
And the user primary SMTP address on Google.
The list of SMTP addresses in Office 365, for User10.
And the email sent to User10@myexchlab.com, that was forwarded to Office 365.
Finally a quick look at the email headers. Some considerations on that:
- you can see that the email is initially received by Google, coming from Office 365 (the sender is from a completely independent 365 tenant)
- You can then see that the email is forwarded to User10 in my Office 365 test tenant. You will see it’s received in 365, coming from Google.
- Finally a quick note on the SPF failure. It’s a soft fail and one that you can’t control. What it basically says is that Google is not a permitted sender for the senders domain.
The summary of this method is that it has no limitations, but, the catch is, stamping forwarding addresses in the Google admin console is not something that you can automate, to make it scale, i.e there’s no good method (to the best of my knowledge) to stamp addresses in 1000+ users, which is a huge manual task.
Forwarding domain options: Forward email to another account via mailbox settings
The second option can be done by the end user, but can also be automated. With this option you’re a bit more limited in terms of what domain names you can use for forwarding. Why? Let me show you.
Above you can see a forwarding set, in the tab “Forwarding and POP/IMAP” of the mailbox settings. To set the forwarding all I needed to do was add a forwarding address and select the “Forward a copy…” option. But my forwarding above is done to the O365.myexchlab.com domain, which is a sub-domain of a domain that my Google tenant owns. What does that mean exactly? That Google knows for a fact that if I own the domain myexchlab.com I also own the forwarding domain O365.myexchlab.com, and therefore does not ask me for any validation.
Makes sense? Now lets see when I try to forward to a domain that is not on Google, nor it’s a sub-domain of one that it is.
As you can see Google is going to send a confirmation code to the destination address, in order for you to prove ownership.
And the address won’t be available until you confirm it.
Now what’s the biggest problem with this? It doesn’t scale. Which means that with this method you will need to use the sub-domain method. Automation tools to add those addresses, like the GAM tool or the BitTitan SDK, won’t work in such scenario with those forwarding email domains.
This is by far my preferred method. The only drawback with this, in my opinion, is that administrators have no visibility to the forwarding configurations, via the UI. But they can export them via the GAM tool.
If you are planning to configure mail flow coexistence between Google and Office 365, I’d recommend that you create a sub-domain in Office 365 (i.e O365.mydomain.com – mydomain.com must be valid in Google), don’t forget to add all DNS records such as MX and SPF, and use that sub-domain in your forwarding addresses.
If you want to automate the configuration (and you should), you can either use the GAM tool, or even much better, use the BitTitan Management Console, part of the BitTitan SDK that comes with an option to manage forwarding addresses on Google, and you won’t have to bother learning how to use the GAM tool, that believe me it’s not easy.
I will soon be writing a blog post on how to use the GAM tool to get a list of forwarding addresses from Google.
As always if you have questions let me know.