Use Ansible to Setup Google MX Records

We’ve all done it. After purchasing that shiny new domain name from our favorite registrar (one of mine happens to be namecheap), we go to set it up. Part of that setup likely includes changing the domain’s MX records to point to “your own” mail servers, of which there is a good chance that “your own” actually means Google owned:


Ah, a list familiar to most of us. So up to this point, it’s been a manual process for me (I know… shame on me). But, today, I decided setting up domain MX records manually would end. Ansible to the rescue! Everything is built into the current version:

ansible --version ansible 2.7.9

Thus no external modules are required. The only required module is built in. I’ll show how to do this both from a plain playbook standpoint (since I did it that way first), and then using a role.

The Ansible play is a simple one and consists of only 2 files, cloudflare_google_mx.yml and cloudflare.yml. The main playbook is as simple as this:

$ more playbook/cloudflare_google_mx.yml --- - hosts: localhost vars_files: - "{{ playbook_dir }}/../vars/cloudflare.yml" tasks: - name: Create Google MX Records cloudflare_dns: zone: "{{ zone }}" name: "{{ zone }}" record: "{{ item.server }}" value: "{{ item.server }}" type: MX priority: "{{ item.priority }}" account_email: "{{ email }}" account_api_token: "{{ cloudflare.apikey | replace('\n', '') }}" state: present loop: - { server: ASPMX.L.GOOGLE.COM., priority: 1 } - { server: ALT1.ASPMX.L.GOOGLE.COM., priority: 5 } - { server: ALT2.ASPMX.L.GOOGLE.COM., priority: 5 } - { server: ASPMX2.GOOGLEMAIL.COM., priority: 10 } - { server: ASPMX3.GOOGLEMAIL.COM., priority: 10 }

And the cloudflare.yml file under var_files holds an encrypted version of my cloudflare api key.

$ more vars/cloudflare.yml --- cloudflare: apikey: !vault | $ANSIBLE_VAULT;1.1;AES256 65633238643730616136353238616464313063336131396338633066653231653464333733396330 3166613930386639653332333162383963333164303665380a373539616361633362653363636637 66343331666132356562333262626333396137363739313436343134666235363136336536333263 3035373738623963630a346330386630313530643162303263303738633961303066316539373533 31316632306438323334653332386662643962396637316237306536613766663164326336333861 3264366265333866393830326363383937383830383564386466

If you instead want to install a role, I’ve made one available on Ansible Galaxy (Ansible’s role repository):

After installing the role via:
ansible-galaxy install june07.ansible_cloudflare_google_mx

You could then simply replace the tasks: section in your playbook/cloudflare_google_mx.yml playbook file with roles: instead, like this:

--- - hosts: localhost vars_files: - "{{ playbook_dir }}/../vars/cloudflare.yml" roles: - june07.cloudflare-google-mx

Because of the number ( COUNT THEM… FIVE) of MX records that Google recommends in it’s G Suite Admin documentation, I decided a loop would be useful in providing the neccessary server/priority values to the task I named “Create Google MX Records”, which in turn is simply calling the cloudflare_dns module that Michael Gruener (@mgruener) contributed.

The Ansible command that brings it all together is:

ansible-playbook -e " [email protected]" playbook/cloudflare_google_mx.yml --vault-password-file ./.vault.json

Per the documentation for the module, there are 3 required parameters. The Cloudflare API Key, the zone (, and the account_email ([email protected]). Everything else found under the loop variables will remain the same regardless of which new domain is setup. In the future when I decide to grab that newer, shinier domain name, with grandious plans of what it will serve as a beginning to, setting up Google MX Records will now be that simple.

ansible-playbook -e " [email protected]" playbook/cloudflare_google_mx.yml --vault-password-file ./.vault.json

No more time waste with manually setting these DNS records up manually. Done!

Originally published at on July 8, 2019.