This is the Google Workspace–side mail flow setup, equivalent to Configuring Mail Flow Rules and Connectors on the Microsoft 365 product; without it, Gmail never actually routes mail to ExSign for stamping, regardless of how correctly the ExSign side is configured. All of this happens in the Google Admin Console (admin.google.com), not in ExSign itself. 

Before You Begin 

Complete Registering a Google OAuth Application for ExSign first; this page assumes that's done. 

Open Gmail Settings 

Go to admin.google.com and navigate to Apps >> Google Workspace >> Gmail. 

Add a Mail Route (Smart Host) 

1. Go to Hosts, then click Add Route. 
2. Configure:
   • Name: ExSign Smart Host 
   • Host Type: Single Host 
   • Port: 25 
3. Enable Require mail to be transmitted via a secure TLS connection. 
4. Click Save.

This Smart Host is the same value you'll later enter as the Outbound Connector on Google Connectors Settings.

Configure the SMTP Relay Service  

1. Go to Gmail >> Routing >> SMTP Relay Service. 
2. Click Add Another Rule. 
3. Click Configure:
   • Rule Name: SMTP Relay Service Rule 
   • Allowed IP Addresses: Add your ExSign server's IP(s), these are the same addresses you'll enter as the Inbound Connector's IP Addresses on Google Connectors Settings.
   • Encryption: TLS required 
4. Click Save.

Configure a Content Compliance Rule 

This is what actually identifies which outgoing mail gets routed to ExSign for stamping. 

1. Go to Gmail >> Compliance >> Content Compliance, then click Add Rule. 
2. Configure:
   • Rule Name: ExSign Content Compliance Rule 
   • Scope: Outbound, and Internal Sending 
   • Condition: Apply the rule only if ALL conditions match 
3. Add three expressions: 
   
   

   Expression	Location	Match Type	Content
   1	Envelope Sender	NOT contains text	google.com
   2	Full Headers	NOT contains text	calendar-notification@google.com
   3	Full Headers	NOT contains text	X-ExSignProcessed

   
   These three exclusions keep Google's own system-generated mail (calendar notifications, etc.) and anything ExSign has already stamped from being routed through again, the same anti-double-stamping mechanism already confirmed for Microsoft 365's mail flow rules (which use the equivalent x-exsignprocessed header), just a different casing convention here. 
   
   
4. Under Action Settings, if the conditions match:  
   • Enable Change Route, and select the ExSign Smart Host you created in Step 2
   • Enable Require secure transport (TLS)
5. Under Apply to Groups, select only the groups whose email should actually be routed through ExSign. 
   
   
   Apply this to specific groups, not your entire domain. Rolling this out organization-wide before testing risks disrupting mail flow for everyone at once.
6. Click Save to apply all the configuration above. 

Before You Consider this Done 

• Test with a small group before expanding to the full organization. 
• Confirm TLS is genuinely enforced, both the Smart Host and the SMTP relay rule require it. 
• If mail isn't reaching ExSign as expected, check the content compliance rule's three expressions first, a mismatch here is the most likely point of failure.