Google Workspace Setup and Migration in Kenya: A Step-by-Step Guide

Nobody dreads the new email. Everybody dreads the move.

Years of messages sitting in a cPanel mailbox or an old Outlook account. A team that cannot afford a day without email. DNS records nobody has touched since the website went live, and nobody quite remembers who has the login.

Here is the good news. Done in the right order, a move to Google Workspace is mostly waiting for DNS. Done in the wrong order, mail bounces for a day and a week of invoices goes missing. This guide is the right order.

What You Need Before You Start

• Access to your domain's DNS. That is wherever your nameservers point: your registrar, your hosting cPanel, or a DNS provider such as Cloudflare. Find the login before day one, not halfway through.
• A list of every address in use. Every person, plus the shared ones like info@ and sales@. Decide now which are real people and which are shared inboxes.
• Access to the old mailboxes, either each password or admin access, so the mail can be copied.
• A few quiet days. Google says new MX records can take up to 72 hours to be recognised. Do not start the switch the day before a tender deadline.
• A way to pay. Google bills in US dollars by card. Through us, you pay in Kenya shillings by M-Pesa or bank transfer.

Step 1: Choose a Plan

Prices are Google's own, per user per month, excluding VAT.

Most small businesses start on Business Starter and move up when they need to. You can mix plans later as the team grows. The Google Workspace pricing guide covers the Enterprise plans too.

Step 2: Sign Up and Verify Your Domain

Sign up at workspace.google.com, or through a partner, using the domain you already own. You do not need a new one. A .co.ke, a .ke or a .com all work.

Google then asks you to prove the domain is yours. It gives you a TXT record to add to your DNS. Add it exactly as given, wait for Google to see it, and click verify. From then on you manage everything in the Admin console at admin.google.com.

Step 3: Create Your Users

Add one user for every person, with the same address they use today, so nobody's email changes.

Shared addresses are different. An info@ that four people read should not be a fifth paid user with a password everybody knows. Make it a group, or an alias on the right person's account. Aliases and groups do not need a licence of their own.

Step 4: Copy Your Old Email Across

This is the step that decides whether anything gets lost, so it comes before the switch, not after.

Google's data migration tool, in the Admin console, can pull mail from Microsoft 365 and Exchange, and from any mailbox that supports IMAP, which includes cPanel webmail. For Microsoft 365, contacts and calendars can come across too. You point it at the old server, give it access, and it copies each mailbox into the matching Workspace account.

Large mailboxes take time, so start this early. The old system keeps receiving mail while it runs, and the team keeps working as normal.

Step 5: Switch Your MX Records

MX records tell the world where to deliver email for your domain. Switching them is the moment new mail starts arriving in Gmail.

Google's current instruction is a single MX record:

Type:      MX
Host:      @
Value:     smtp.google.com
Priority:  1

Delete every old MX record at the same time. Accounts created before 2023 may see older records starting with ASPMX, and Google still supports those if mail already works. Then activate Gmail in the Admin console. Google's own walkthrough is on its MX records page.

Remember the 72 hours. During that window some senders reach Google and some still reach the old server. That is normal, and step 7 deals with it.

Step 6: Add SPF, DKIM and DMARC

These three records are the difference between email on your domain and email on your domain that nobody else can fake. Most setups skip them. Do not.

SPF: who is allowed to send as you

Type:   TXT
Host:   @
Value:  v=spf1 include:_spf.google.com ~all

A domain can have only one SPF record. If your website or another service also sends mail as your domain, merge its include into this same record rather than adding a second one.

DKIM: a signature on every message

In the Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email. Generate a key, publish it as a TXT record at google._domainkey, then return and click Start authentication.

DMARC: what to do with fakes

Type:   TXT
Host:   _dmarc
Value:  v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.co.ke

Start with p=none, which only reports. Once the reports show your real mail passing, tighten it to quarantine, then reject. Our guide to how DNS works explains what each of these records is doing.

Step 7: Catch the Stragglers and Lock It Down

• Run a final migration pass a few days after the MX switch, to copy anything that landed on the old server during the changeover.
• Set up phones. Add each account to the Gmail app, and remove the old account so nobody replies from the wrong place.
• Turn on 2-Step Verification for every user, and enforce it from the Admin console.
• Keep the old mailboxes for a few weeks before cancelling them. Cheap insurance against the one folder somebody forgot.
• Show the team around. Shared drives, Meet, and where their old mail went. Ten minutes now saves a month of "where is my email?"

The Gotchas Behind Most Problems

Contact form emails stop arriving

This is the one that catches almost everyone who keeps their website on cPanel hosting. The server still thinks it handles mail for your domain, so emails your own website sends to you, like contact form enquiries, are delivered to the old local mailbox and never reach Gmail. In cPanel, open Email Routing and set it to Remote Mail Exchanger.

Two SPF records

Adding Google's SPF record next to an old one does not add permission. It breaks SPF for both. There must be exactly one record starting with v=spf1.

Old MX records left behind

Leave one old MX record in place and some of your mail keeps going to the old server, for months, silently. Delete them all in step 5.

Changing nameservers instead of records

You only need to change records. Moving your whole DNS to a new provider at the same time can take the website down too. One change at a time.

What It Costs, and Having It Done for You

The licence is Google's price, per user per month, from USD 7 on Business Starter's annual plan. Buying through us costs the same as buying from Google, and you pay in Kenya shillings by M-Pesa or bank transfer, with no international card needed.

The setup work is included: SPF, DKIM and DMARC configured and tested, mailbox migration from Microsoft 365, Outlook, cPanel webmail or an old G Suite account, 2-Step Verification, and training for your team. After that you have one local team to call when an account is locked or an email bounces. Details are on our Google Workspace page.

Frequently Asked Questions

How long does Google Workspace setup take?

Creating the account and users takes minutes. The waiting is DNS: Google says new MX records can take up to 72 hours to be recognised. Copying old mail depends on how much there is, so start the migration early and switch MX once most of it has moved.

Will I lose emails when I move to Google Workspace?

Not if you work in the right order. Copy existing mail across while the old system is still live, switch the MX records, then run a final pass to catch anything that arrived at the old server during the switch. Keep the old mailboxes for a few weeks before you cancel them.

Can I move my email to Google Workspace and keep my website hosting?

Yes. Email and website use different DNS records, MX for mail and A or CNAME for the site, so you can move one without touching the other. If your website stays on cPanel hosting, set its email routing to remote, or messages from your own contact forms will never reach Gmail.

Do I need a new domain for Google Workspace?

No. You use the domain you already have, whether that is a .co.ke, a .ke or a .com. Google asks you to prove you own it by adding a TXT record.

Can I pay for Google Workspace in Kenya shillings?

Through us, yes. Billing is in Kenya shillings by M-Pesa or bank transfer at Google's standard price, with no markup, and no international card needed.

What are SPF, DKIM and DMARC?

Three DNS records that prove your email is really from you. SPF lists which servers may send mail for your domain, DKIM signs every message, and DMARC tells receiving inboxes what to do with mail that fails those checks and reports abuse to you.