Email repository firewall requirement

Email repositories must only allow Google's Workspace AND unverified forwarding IP address ranges in your firewall rules and/or mail server configurations as they originate the SMTP connections to your host(s).

Google maintains the updated list of ranges at https://support.google.com/a/answer/60764, which we have replicated below

Google Workspace IP address ranges

To get the IP addresses of Google Workspace mail servers:

Use DNS lookup commands (nslookup, dig, host) to retrieve the SPF records for the domain _spf.google.com:

nslookup -q=TXT _spf.google.com 8.8.8.8

The results contain the current ranges of Google mail sending servers.

IP address ranges for unverified forwarding

Alternate configuration 

If you use hostnames instead of IP addresses in your firewall routing settings, use this hostname mask when routing unauthenticated messages:

*.unverified-forwarding.1e100.net

To identify untrusted forwarding servers, use this hostname mask in your firewall settings. Use the wildcard (*) for subdomains. Subdomains can include multiple, nested subdomains.