---
title: "Google Workspace integration overview (change request)"
slug: "google-workspace-integration-overview"
description: "The five elements an Opensense Google Workspace integration needs: the Marketplace app, smart host, Content Compliance rules, loopback relay, and DNS."
updated: 2025-10-02T18:50:54.000Z
canonical: "https://help.opensense.com/docs/google-workspace-integration-overview"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.opensense.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace integration overview (change request)

## Overview

This article is a high-level overview of the steps to integrate Opensense with your Google Workspace environment. The integration needs Super Admin privileges, and includes five key elements for proper setup. For how signatures flow through Opensense, see [How does Opensense work with Google Workspace?](https://help.opensense.com/docs/how-does-opensense-work-with-google-workspace)

:::caution[Not a step-by-step guide]
Work with your dedicated Implementation Engineer, or contact [help@opensense.com](mailto:help@opensense.com), to complete the integration.
:::


## Integration components

The integration of Opensense with your Google Workspace environment requires:

1. [Installing the Opensense Google Workspace Marketplace app](#installation-of-the-opensense-google-workspace-marketplace-application)
2. [Setting up the Opensense Google API smart host](#setup-of-the-opensense-google-api-smart-host)
3. [Setting up the Opensense Content Compliance rules](#setup-of-the-opensense-content-compliance-rules)
4. [Setting up the Opensense loopback relay](#setup-of-the-opensense-loopback-relay)
5. [Updating DNS entries](#dns-entries-update)


## Opensense Google Workspace Marketplace app

The app enables:

- **Single sign-on** with Google for Opensense administrators
- Centrally pushing employee email signatures into Gmail, including replacing existing signatures
- **Sourcing user data** for email signatures (name, title, phone, and so on) from Google Directory

For the API scopes the app uses, see [Google Workspace API scopes](https://help.opensense.com/docs/google-workspace-permissions).


## Smart host and loopback relay

<div class="kb-deployment-compare kb-deployment-compare--plain">
  <div class="kb-deployment-compare__viewport" role="region" aria-label="Opensense mail transport" tabindex="0">
    <table>
      <colgroup><col class="kb-deployment-compare__feature-col"></colgroup>
      <thead>
        <tr>
          <th scope="col">Setting</th>
          <th scope="col"><span class="kb-deployment-compare__method">Opensense Google API smart host</span></th>
          <th scope="col"><span class="kb-deployment-compare__method">Opensense loopback relay</span></th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <th scope="row">From</th>
          <td>Google Workspace</td>
          <td>Opensense</td>
        </tr>
        <tr>
          <th scope="row">To</th>
          <td>Opensense</td>
          <td>Google Workspace</td>
        </tr>
        <tr>
          <th scope="row">Transport</th>
          <td>TLS-encrypted smart hosting</td>
          <td>TLS-encrypted SMTP relay</td>
        </tr>
        <tr>
          <th scope="row">Purpose</th>
          <td>Applies centrally managed email signatures to in-scope emails</td>
          <td>Delivers in-scope emails through the normal mail flow, after Opensense applies the signatures</td>
        </tr>
      </tbody>
    </table>
  </div>
</div>


## Content Compliance rules

Rules let you scope the solution to specific users, groups, organizational units, and even specific emails. Only **emails in scope** trigger the Opensense Google API smart host and get Opensense-applied email signatures. A dash means that the rule has no such condition.

<div class="kb-deployment-compare kb-deployment-compare--plain">
  <div class="kb-deployment-compare__viewport" role="region" aria-label="Opensense Content Compliance rules" tabindex="0">
    <table>
      <colgroup><col class="kb-deployment-compare__feature-col"></colgroup>
      <thead>
        <tr>
          <th scope="col">Rule</th>
          <th scope="col"><span class="kb-deployment-compare__method">Opensense Enabled</span></th>
          <th scope="col"><span class="kb-deployment-compare__method">Opensense Stamping</span></th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <th scope="row">Contains the Opensense token <code>[[+]]</code> in the body<span class="kb-deployment-compare__row-note">Applies when</span></th>
          <td><span class="kb-deployment-compare__mark is-yes" title="Yes"><span class="sr-only">Yes</span></span></td>
          <td><span aria-hidden="true">—</span><span class="sr-only">Not listed</span></td>
        </tr>
        <tr>
          <th scope="row">Sent by an in-scope user, group, or organizational unit<span class="kb-deployment-compare__row-note">Applies when</span></th>
          <td><span aria-hidden="true">—</span><span class="sr-only">Not listed</span></td>
          <td><span class="kb-deployment-compare__mark is-yes" title="Yes"><span class="sr-only">Yes</span></span></td>
        </tr>
        <tr>
          <th scope="row">Doesn't contain the header value Opensense applies with a signature<span class="kb-deployment-compare__row-note">Applies when</span></th>
          <td>Yes, to avoid double signatures</td>
          <td>Yes, to avoid double signatures</td>
        </tr>
        <tr>
          <th scope="row">Isn't a Google notification<span class="kb-deployment-compare__row-note">Applies when</span></th>
          <td><span class="kb-deployment-compare__mark is-yes" title="Yes"><span class="sr-only">Yes</span></span></td>
          <td><span class="kb-deployment-compare__mark is-yes" title="Yes"><span class="sr-only">Yes</span></span></td>
        </tr>
        <tr>
          <th scope="row">Effect</th>
          <td>Triggers the Opensense Google API smart host for signature application, and sets a message header</td>
          <td>Applies the Opensense token through Google's disclaimer feature, enforcing Opensense signatures on all emails for in-scope users. Then triggers the smart host, and sets a message header.</td>
        </tr>
      </tbody>
    </table>
  </div>
</div>


## Updating DNS entries

Opensense customers must update the required DNS entries in both external and internal DNS, if applicable. This ensures brand continuity, and improves deliverability. See [Required DNS settings for Opensense](https://help.opensense.com/docs/dns-entries-must-have).


## What's next

- [How does Opensense work with Google Workspace?](https://help.opensense.com/docs/how-does-opensense-work-with-google-workspace): how email flows through Opensense.
- [Google Workspace API scopes](https://help.opensense.com/docs/google-workspace-permissions): what the Marketplace app can access.
- [Required DNS settings for Opensense](https://help.opensense.com/docs/dns-entries-must-have): the DNS entries to add.

For further help, contact Opensense Support at [help@opensense.com](mailto:help@opensense.com).