What does the Google Workspace checker look at?
Google Workspace mail rests on four DNS records: MX records pointing at Google (smtp.google.com, or the older aspmx hosts Google still supports), an SPF record including _spf.google.com, a DKIM key at the default selector google._domainkey, and a google-site-verification token proving the domain was verified with Google.
Reading the result
The top line says whether the most preferred MX host is Google’s. Below it, each of the four records is reported as found or missing, and the faults are listed with what to change. Everything comes from DNS alone, so the tool cannot tell whether a domain pays for Workspace or how its account is configured.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common problems it finds
SPF without Google’s include
Google documents v=spf1 include:_spf.google.com ~all for domains that send only through Workspace. Without the include, mail Workspace sends fails SPF unless another term covers Google’s addresses.
No key at google._domainkey
Google uses the selector google unless you pick another. No key there usually means DKIM was never turned on in the Admin console.
MX records left from an old provider
Mixing Google’s MX hosts with another service’s splits incoming mail between them, and what lands on the old one is rarely read.
Two SPF records
Adding Google’s record next to an existing one makes two, which RFC 7208 turns into permerror for every message. Merge the includes into one record.