A verified Workspace domain cannot receive external mail because DNS still routes inbound messages to the former provider. Which approach best fits?

1. Configure and enable DKIM for the sending domain.
2. Configure DMARC after validating SPF and DKIM alignment.
3. Configure an appropriate SPF record.
4. Configure the correct current Gmail MX records and validate propagation.