no-reply@conductorone.com. You can instead send from your own Google Workspace mailbox so recipients see your company’s domain as the sender.
This task requires the Super Admin role in C1 and the Super Admin role in Google Workspace.
Before you begin
Configure SPF, DKIM, and DMARC for your sending domain by following Google’s recommended email authentication settings before proceeding.
- A Workspace super admin account.
- A DNS domain you control (with the records above published).
- Google Cloud Platform access in the same organization as your Workspace.
Step 1: Create a dedicated sender mailbox
The address that C1 sends mail as must be a real, licensed user in Google Workspace — not an alias, group, or forwarding address.1
In admin.google.com, navigate to Directory > Users > Add new user.
2
Create a user with an address like
governance@yourcompany.com or c1-notifications@yourcompany.com.3
Assign a license with Gmail enabled.
4
Sign in as this user once (incognito window) to accept the ToS and complete first-login setup.
5
Optional. In Gmail, go to Settings > Accounts > Send mail as, edit the primary identity, and set Name to the display name you want recipients to see (for example, Governance Team). Gmail may override custom display names from the MIME header with this value.
Step 2: Create a GCP service account
C1 uses a GCP service account to call the Gmail API on behalf of your sender mailbox. Create the service account in the same GCP organization as your Workspace tenant.1
Sign in to the Google Cloud console as a super admin.
2
Create a new project or select an existing one for the C1 email integration.
3
In the navigation menu, go to APIs & Services > Library.
4
Search for Gmail API and click Enable.
5
Navigate to APIs & Services > Credentials.
6
Click Create credentials > Service account.
7
Set a name (for example, C1 Email Sender) and click Create and continue. No project roles are required — click Continue, then Done.
8
In the service account list, click the service account you just created.
9
Open the Keys tab. Click Add key > Create new key, choose JSON format, and click Create. Save the downloaded JSON file securely — you’ll upload it to C1 in Step 4.
10
On the service account’s Details tab, copy the OAuth 2 Client ID (a numeric string like
108123456789012345678). You’ll need it for Step 3.Step 3: Grant domain-wide delegation
Domain-wide delegation allows the service account to impersonate the sender mailbox when calling the Gmail API. You configure this in the Google Admin console, not in GCP.1
In admin.google.com, navigate to Security > Access and data control > API controls.
2
In the Domain-wide delegation section, click Manage domain-wide delegation.
3
Click Add new.
4
In Client ID, paste the OAuth 2 Client ID from Step 2.
5
In OAuth scopes, enter:
6
Click Authorize.
Step 4: Configure the email provider in C1
Enter the sender mailbox and service account credentials from the previous steps in C1 to activate the integration.1
In C1, navigate to Settings > Email provider.
2
Click Edit.
3
Select Customer provided.
4
In Email service, select Google Workspace.
5
Fill in the fields:
- Sender name: The display name recipients see (for example, Governance Team).
- Sender email address: The mailbox you created in Step 1 (for example,
governance@yourcompany.com). - Reply-to address: Usually the same as the sender address.
- Delegated user email: Same as the sender address.
- Service account JSON: Upload the JSON file downloaded in Step 2.
6
Click Save.
Step 5: Verify
Send a test message to confirm C1 can send through your Workspace mailbox and that your email authentication records are passing.1
On the Email provider page, click Send test.
2
Enter your own email address and click Send test.
3
Check your inbox. If the message arrives, view the raw headers (in Gmail: ⋮ → Show original) and confirm SPF: PASS, DKIM: PASS, DMARC: PASS.
4
If the message does not arrive, check the spam folder, mark it as Not spam, and re-test.