Which is absolutely not even remotely close to being the same as your custom domain being a Google OAuth provider. The question stands - hard to imagine how it

Which is absolutely not even remotely close to being the same as your custom domain being a Google OAuth provider. The question stands - hard to imagine how it won't require action on users' parts. And even in the context of this thread, having a sending alias doesn't magically make you able to check mail on a domain you don't control... having a forward alias means nothing in this context. Examples: * If anyone were using a paid Tailscale plan with a free GSuite account, they're probably just hosed. I have no idea how they're going to migrate short of Tailscale extending their auth mechanisms. * Anyone "logging in" with a custom domain email might need to click a link to finish logging in. Unless your GSuite admin migrates mail services manually, you're not getting that email.