On this page

Fixing DANE in SiteGround for Google Workspace

Why you can't fix this

DANE works by publishing a TLSA record on your mail server's own hostname, signed via DNSSEC. See Setting Up DANE for Email for the general mechanism.

Two separate blockers apply here:

  1. Google Workspace itself doesn't support inbound DANE. Your MX records point to Google's infrastructure, which lives in google.com's zone, not yours.
  2. SiteGround doesn't support DNSSEC at all — a hard prerequisite for DANE — so even a self-hosted mail setup couldn't do this while SiteGround manages the zone.

What to do instead

Google's documented mechanism for enforcing inbound transport security is MTA-STS, not DANE. Set this up via Menu → Apps → Google Workspace → Gmail → Advanced → MTA-STS in the Google Admin console — it requires only a TXT record and an HTTPS-hosted policy file, both of which SiteGround's DNS Zone Editor can host.

Common pitfalls

  • Trying to work around this by moving DNS to Cloudflare — that solves SiteGround's DNSSEC gap, but Google Workspace's lack of DANE support is the deeper blocker and would remain either way.