ConfigShield

Your tenant's configuration, scanned and scored.

ConfigShield scans your Google Workspace tenant configuration — 2-step verification, the DKIM, SPF and DMARC records, admin roles, groups, inactive accounts — gives it a 0-100 score, and lists each gap as a finding with the evidence pack behind it.

What it does

ConfigShield reads your tenant's configuration as it actually is, not as the last person to touch it remembers it. The scan covers 2-step verification enforcement, your domain's email-authentication DNS records (DKIM, SPF and DMARC), the admin roles you have handed out, your groups, and accounts that no longer show activity. It scores the tenant 0-100 and lists each gap as a finding, and every finding carries an evidence pack — the details the finding rests on — so you can see the proof before you change anything.

Who it's for

Admins who inherited a Workspace and need to know what state it is in before changing it. Anyone asked some version of "how secure is our tenant, really?" who currently answers by opening console screens one at a time. Teams that want the misconfigurations written down, finding by finding with evidence attached, instead of kept in one person's head.

Does Google Workspace require DMARC?

No. A Workspace domain sends and receives mail fine without a DMARC record; Google does not stop a domain for lacking one. What Google does do is push sending domains toward the records receivers check: its Email sender guidelines ask for SPF and DKIM on domains that send mail, and a DMARC policy once volume is high — the thresholds live in Google's current guidelines and have been raised before. The reason to publish DMARC anyway has nothing to do with Google's rules: it is the record that tells the rest of the world what to do with mail claiming to be from your domain that fails those checks. It is a DNS change at your domain host, not a Workspace setting.

Does Google Workspace require 2-step verification?

Not by default. Out of the box, Google does not force every user onto 2-Step Verification; it hands the enforcement to you. The Admin console's 2SV settings let you require verification for the whole organization or parts of it, give new users an enrollment window, and exempt specific accounts — which is also how enforcement quietly thins out, because exceptions accumulate. What your edition offers and where the controls sit today are worth checking in Google's current documentation. Whether every human account is covered, on the other hand, is not a question about the feature. It is a question about your tenant's actual state.

What is DKIM activation?

DKIM is the signature on your outgoing mail. Google signs each message with a key; receivers look up the matching public record in your domain's DNS to confirm the mail really came from you and was not altered on the way. Activating DKIM for Workspace means Google's tooling generates the key, you publish the corresponding record at your domain host, and your domain's mail starts carrying a signature receivers can check in your name. It matters most as the partner of the other two records: SPF says which servers may send for you, DKIM says this message is intact and ours, and DMARC tells receivers what to do when either check fails. Google's steps for generating and activating the key are in its current Gmail admin documentation; the details have changed before, so follow those rather than an old checklist.

How secure is your tenant, really?

No single screen answers that. The honest native method is Google's own security checklist for admins, walked by hand: authentication settings on one screen, the mail-authentication records in your DNS, admin role assignments, group settings, the account list. It works — and after a reorganization or a busy quarter, most tenants no longer match anyone's memory of it. A Google Workspace security audit is, at bottom, the list that walk produces: what is misconfigured, each item with the setting it rests on. What to fix first stays your call, though the settings Google treats as foundational — 2-step verification and the mail records — are usually where the list starts.

ConfigShield exists to make that list cheap to get. The scan reads the tenant configuration — 2SV enforcement, the DKIM, SPF and DMARC records, admin roles, groups, inactive accounts — scores it 0-100, and lists each gap as a finding with an evidence pack, so you can see what each finding rests on before acting on it. The score says where you stand; the findings say what to look at; neither replaces your judgement about what to fix first.

How it works

1. Run the scan. ConfigShield reads your tenant's configuration: 2-step verification enforcement, the DKIM, SPF and DMARC records in your domain's DNS, admin roles, groups, and accounts that no longer show activity.
2. Read the score. The scan gives your tenant a score from 0 to 100 — where the configuration stands, in one number you can put in front of the team.
3. Work the findings. Each gap is listed as a finding with an evidence pack: the details it rests on, so you can confirm it before changing anything.
4. Fix in Google's tools. The fixes — 2SV enforcement, DNS records, admin roles, closing old accounts — are made in the Admin console and at your domain host, by you. ConfigShield reads; it does not write.

What it doesn't do (yet)

ConfigShield reads and reports; it does not enforce. Turning on 2SV, publishing DNS records, reassigning roles and closing accounts are your changes, made in Google's tools. No scan schedule is promised: a score describes the configuration as it was scanned, and configurations move the week after anyone looks. The evidence pack shows what a finding rests on; the security page shows what Geeplo does not claim — no SOC 2 or ISO certification, stated openly rather than implied.

What access it needs

The scopes page names one scope against ConfigShield: the group settings read, used to read group settings during configuration scans. Your DKIM, SPF and DMARC records live in public DNS, where reading them needs no permission from Google. Every scope Geeplo's service account holds, which module uses it and why, and how to remove the access entirely in Domain-wide delegation, are on the scopes page.

Related modules

ShareGuard (files shared outside the company — the other half of the picture), Group Management (the groups this scan reads), DataScout (third-party apps and the scopes they hold), the offboarding guide (access cleanup is the second step of the leaver runbook), and the modules hub for the rest. The DataScout, Teams, Requests, Approval Gate and Assets Revalidation pages are not up yet.