Certify'em and Google Workspace (G Suite)
This article is intended for people who want or plan to use Certify'em in a Workspace (G Suite) domain. It covers important setup information, especially for brand new Workspace domains.
What is Google Workspace (formerly G Suite)?
G Suite is Google's cloud-based productivity suite, comparable to Microsoft's O365. If you're accustomed to using Gmail, Google Calendar, or Google Drive, think of G Suite as the paid equivalents that offer additional controls and capabilities to business, schools and other organizations. Most importantly, you can create and manage a set of users (i.e. employees, teachers, club members) and manage how they share their data. And that data is under the control of your G Suite domain, rather than a disparate set of Gmail accounts owned by different people.
Do I need G Suite to use Certify'em?
No. Certify'em can be used with a simple, free Gmail account. However, users of Gmail are subject to a limit of 100 emails sent/day by Add-ons like Certify'em. This limit is set by Google, and not by Certify'em. This means you'll only be able to send a maximum of 100 certificates per day using a Gmail account. In practice, you'll be limited to less than 100 certificates/day since (1) the quota of 100 emails/day is shared across any and all Add-ons you've installed, and (2) other emails you send with Certify'em (such as emails sent when a user fails an exam) also count toward this limit.
In contrast, G Suite users have an much higher limit of 1,500 emails/day (takes a few months to go into effect for accounts with less than 6 users). This limit, set by Google, is shared across all Add-ons a user has installed.
How do I know if I already have G Suite?
You may already be using G Suite if:
Your school, business, or organization already routinely uses tools like Gmail, Calendar, and/or Google Drive & Docs to conduct business.
You and your fellow colleagues have email addresses that end in the same domain name (i.e. email@example.com and firstname.lastname@example.org).
If you're still not sure, ask the I.T. Admin or Help Desk at your organization if your user account is a G Suite account.
How do I get G Suite?
You can sign-up for G Suite online at gsuite.google.com. Pricing for G Suite starts at $6 per user per month. As part of this process you will also need to purchase a domain name (i.e. mycoolclub.com), or specify one you already own. A domain name is necessary so that Certify'em can send emails.
There are many online videos and guides for setting up a new G Suite account you can follow. Be prepared to spend several hours or more obtaining and setting up your G Suite account.
Will G Suite's higher email limits apply right away?
No. According to Google, for new G Suite domains with less than 6 users the higher limit of 1,500 emails sent/day can take several billing cycles (i.e. months) to kick in. They also don't apply while your G Suite domain is in its free trial. So plan ahead to purchase and setup your G Suite domain several months before you need it. Or if you need the higher quota much sooner, you'll need to purchase 6 licenses for your first month (you can cancel them later if you chose to setup billing on a monthly basis).
My organization uses G Suite, but why am I unable to install/use Certify'em?
It's possible your organization's G Suite admin has blocked access to Add-ons, or certain APIs (like the Google Drive APIs). Inquire with your I.T. admin if they can help enable Certify'em for you.
Does G Suite require any special setup to work with Certify'em?
While Certify'em should work with any G Suite domain without additional configuration, it's highly recommended that you read and follow the instructions outlined below to ensure proper behavior (i.e. avoid rejected/bounced emails).
Account in Good Standing
First, if your G Suite account (domain) was only recently created, know that Google will apply more strict checks on emails sent to catch abuse (i.e. spammers). This is especially true for emails sent automatically using tools such as Certify'em. To reduce this period of time somewhat, ensure your account is no longer in its trial period and is fully paid-up by accessing the Billing section of your G Suite Admin console. Once in the Billing section, next to G Suite, click the "Actions" drop-down menu, and select "Access billing account". Under Your balance, click Pay Early or Make a Payment. Make sure that the payment details are correct, then click Confirm.
Setup SPF Records
Next, setup a common DNS mail record called an "SPF" record to avoid your domain being confused for delivering email spam when sending automated certificate emails. If your domain is thought to be sending spam (vs just large numbers of certificates), it can result in many emails sent by Certify'em getting rejected by recipients.
To see if you already have an SPF record setup for G Suite, visit https://mxtoolbox.com/spf.aspx, type in your domain name (i.e. mycoolclub.com) and click "SPF Record Lookup".
If you see the message "SPF Record Found", and it looks something like "v=spf1 include:_spf.google.com ~all", then you're all set!
If you see the message "No SPF Record Found", or the record listed doesn't look like "v=spf1 include:_spf.google.com ~all", then you'll need to setup an SPF record for G Suite. See below.
To setup an SPF record for G Suite, you will need the ability to modify your domain's DNS records. This requires a login/password to the registry from which you purchased your domain name (i.e. GoDaddy, Google Domains, etc). If you're not the one who purchased the domain, you'll need to ask that person to do this for you (i.e. your organization's I.T. admin).
See this documentation from Google to learn more about SPF records and how to configure them for your domain: https://support.google.com/a/answer/33786
G Suite allows you to optionally whitelist 3rd-party applications you trust. This requires an "OAuth 2 Client ID", which for Certify'em is: 295230426839-v1os3n9ffmt8diinjnb81u7adpd24ud6.apps.googleusercontent.com.
Note that whitelisting is only necessary if your G Suite domain's administrator has chosen to restrict access to G Suite APIs to trusted apps. Else it is not necessary.
Passage of Time
Even once SPF records and Billing are setup correctly, it may take some time (i.e. weeks) before emails stop bouncing. In the interim, you can still share certificates using the "Share via: Google Drive" option in the "Advanced Settings" of Certify'em. This works because the email notifications are sent by Google Drive, and not Certify'em. Note that recipients will need a Google account (i.e. G Suite or @gmail.com) to be able to print or download the certificate. Else they will only be able to view the file and will have to take a screenshot of it.
Contact G Suite Support
If you've done all the above steps, and you're reviewed other common reasons for emails getting rejected/bounced, try contacting G Suite support for additional help via the "Support" icon in your G Suite Admin Console (admin.google.com).