Google Workspace Explained: Gmail, the Admin Console, and Custom Domains
How Google Workspace is structured: the Admin console and admin roles, users, groups and organizational units, custom domains with MX, SPF, DKIM and DMARC, the editions Google offers, security and billing.
Google Workspace is Google’s subscription suite for business email and collaboration: Gmail on your own domain, Drive, Docs, Sheets, Slides, Meet, Calendar and Chat, all administered from one console. It was called G Suite until 2020, and older listings still use that name. This guide explains how a Workspace organisation is structured: the Admin console, users and organizational units, custom domains and DNS, the editions Google offers, and the security, billing and sending-policy points that matter before you rely on it for company mail.
The Admin console and admin roles
Everything in Workspace is managed from the Admin console. Its main sections are Users, Groups, Organizational units, Devices, Apps, Security, Reporting, Billing and Account (which holds domains and company settings). The first account created for a new organisation is a super admin, which can do anything, including deleting the organisation. Google provides prebuilt delegated roles (Groups Admin, User Management Admin, Help Desk Admin and others) and lets you build custom roles, so day-to-day administration should not run under a super admin login.
Keep at least two super admin accounts, protect both with hardware security keys or another strong second factor, and use them only for tasks that require that level. This is Google’s own recommendation and it also matters for recovery: a lost sole super admin is a slow, document-heavy support process.
Users, groups and organizational units
A user is a licensed mailbox and identity, such as jane@example.com. Users are created one at a time, uploaded from a CSV, or synchronised from an on-premises directory with Google Cloud Directory Sync. Each user consumes one licence of an edition, and licences are assigned automatically or manually depending on account settings.
Organizational units (OUs) are a tree that starts at the top-level organisation. Every user sits in exactly one OU, and settings applied to an OU inherit downward unless overridden. That is how you turn a service off for contractors, enforce stricter security for finance, or give one department a different Gmail signature policy. Groups are separate from OUs: a group is an email address that fans out to members (a mailing list or collaborative inbox), and it can also be used as a target for settings and access rules. A user can belong to many groups but only one OU.
- User
- One licensed identity and mailbox
- Organizational unit
- Tree node for applying settings; one per user
- Group
- Mailing list or access target; many per user
- Super admin
- Full control of the organisation; use sparingly
Custom domains and DNS
A Workspace organisation has one primary domain and can add secondary domains (with their own users) and domain aliases (extra addresses for the same users). You prove ownership of each domain by publishing a TXT record Google gives you, or through a CNAME or an HTML file for some registrars.
Mail flows to Gmail once you publish Google’s MX records at your DNS host. Google’s current guidance uses a single MX record pointing at its mail servers; older setups with five records still work. For outbound reputation you then publish SPF (including Google’s sending servers), generate a DKIM key in the Admin console under Gmail authentication and publish it as a TXT record, and add a DMARC policy. Google’s bulk-sender rules for mail arriving at Gmail require all three for high-volume senders, and the same records improve delivery to every other provider. The library article on SPF, DKIM and DMARC setup covers the exact records.
Editions as Google describes them
Google sells Workspace in editions. The Business family, Business Starter, Business Standard and Business Plus, is aimed at organisations up to a fixed user cap that Google states on its pricing page (300 users at the time of writing), with storage per user, Meet capacity, recording and Vault retention increasing as you go up. The Enterprise editions remove the user cap and add advanced security, data regions, and compliance tooling. Essentials editions provide Drive, Meet and Docs without Gmail for teams that keep email elsewhere. Google also offers Education, Frontline and Nonprofits editions with their own eligibility rules. Current features and prices are on Google’s plans page.
Google Workspace for Nonprofits is granted through the Google for Nonprofits program after Google verifies eligibility; discounted Business and Enterprise editions are also available to verified nonprofits. Eligibility is decided by Google, not by any reseller or marketplace.
The CloudAccountHub product page lists two variants, Gsuite Workspace Inbox Supported and Gsuite Workspace Non Profit 300. Each label describes the listing exactly as written and nothing beyond it; edition entitlements and nonprofit status are always defined by Google’s own terms.
| Edition family | Who it targets | Notable difference |
|---|---|---|
| Business Starter / Standard / Plus | Small and mid-size organisations under Google’s user cap | Storage, Meet features and Vault availability rise with tier |
| Enterprise | Larger or regulated organisations | No user cap; advanced security and data regions |
| Essentials | Teams that keep email elsewhere | No Gmail |
| Education / Frontline / Nonprofits | Eligible institutions and roles | Eligibility verified by Google |
Security, billing and acceptable use
Security settings live per OU. The important ones are 2-Step Verification enforcement (with an enrolment grace period), allowed second factors, password policy, session length, and third-party app access controls that decide which OAuth apps can read Gmail or Drive data. The Alert center surfaces suspicious logins and phishing campaigns, and the Reporting section keeps admin, login, Drive and Gmail audit logs that you should review when taking over an organisation. Business Plus and Enterprise add Vault for retention and eDiscovery.
Billing runs per user per month. A Flexible plan bills for the licences in use each month and lets you add or remove users freely; an Annual plan commits to a licence count for a year at a lower monthly rate. Payment details, invoices and the subscription itself are under Billing in the Admin console. Only a super admin or a billing admin can change plans or cancel.
Google’s Workspace terms and acceptable use policy apply to every organisation. Mail sent from Workspace must comply with anti-spam law in your jurisdiction, such as CAN-SPAM, CASL or GDPR, and Google suspends accounts that generate spam complaints or violate its policies. If you need to send at volume, use a dedicated sending service and keep Workspace for the humans.
Where to go next
- See the listed variants on the Google Workspace account product page.
- Follow the step-by-step guide in Setting up business email with Google Workspace.
- Publish the right DNS records with SPF, DKIM and DMARC setup.
- Understand where Workspace sits relative to infrastructure in IaaS vs PaaS vs SaaS.
- Browse every guide in the Cloud Library.