Most Google Workspace tenants run Gmail on its default protections, while the settings that stop spoofing, weaponised attachments, silent forwarding and risky routing stay switched off or half configured. Gmail's admin controls are spread across several Admin console pages: Safety, Spam, Phishing and Malware, Compliance, End User Access and Routing. Each one changes how mail is filtered, held or delivered, and several of them can quietly weaken protection when set carelessly. This guide walks Workspace administrators through the security-relevant Gmail settings, with exact setting names, the actions to choose, the order to roll them out and how to check they work. It goes deeper than the Gmail section of the Google Workspace Security Guide and assumes you already understand SPF, DKIM and DMARC.
This is an independent guide from NHI Mgmt Group, based on Google's public Workspace admin documentation as of November 2026. It is not sponsored or reviewed by Google. Product features change, so confirm settings against Google's current documentation.
Key takeaways
- Advanced safety settings need turning on. Google's documentation says the advanced phishing and malware options are not on by default, so attachment, link and spoofing protections must be enabled and given an action.
- Pick quarantine for high-confidence threats. The default action keeps the message in the inbox with a warning; spoofing of your own domain and encrypted or scripted attachments from untrusted senders deserve spam or admin quarantine.
- Routing settings can switch protection off. An inbound gateway changes how Gmail evaluates SPF and DMARC, and per-user outbound gateways send mail around your domain's own outbound controls.
- Content compliance rules are powerful in both directions. The same rule engine that blocks sensitive data can also bypass the spam filter or add hidden recipients, so treat rule changes as privileged changes.
- Automatic forwarding is on by default. Restrict it to internal addresses or turn it off, then review forwarding with Email Log Search and audit events.
Where the settings live and who can change them
Nearly every setting in this guide sits under Menu > Apps > Google Workspace > Gmail in the Google Admin console and needs the Gmail Settings administrator privilege. Quarantine set-up is the exception: Google's documentation states that only a super administrator can create quarantines. Settings apply per organisational unit (OU), and most can also be set on configuration groups. Google notes that changes can take up to 24 hours to take effect, though usually sooner, so plan pilots with that lag in mind.
| Admin console page | Security-relevant settings | What it controls |
|---|---|---|
| Safety | Attachments; Links and external images; Spoofing and authentication | Advanced phishing and malware protection and the action taken on matches |
| Spam, Phishing and Malware | Enhanced pre-delivery message scanning; Security Sandbox and Security Sandbox rules; spam lists | Extra scanning before delivery and detonation of attachments |
| Compliance | Content compliance; Secure transport (TLS) compliance; attachment and objectionable content rules | Rule-based actions on message content, metadata and transport |
| End User Access | Automatic forwarding; Allow per-user outbound gateways; POP and IMAP access | What users themselves can do with their mailbox |
| Routing (Email routing and delivery) | Default routing; Routing; Inbound gateway; Outbound gateway; hosts | Where mail is accepted from and delivered to |
| Manage quarantines | Default and custom quarantines; notifications | Where held messages go and who reviews them |
Limit the Gmail Settings privilege to a small custom admin role. A Gmail admin can change routing and compliance rules that redirect or copy any user's mail, so that role is effectively privileged access to every mailbox. See the Google Workspace Security Checklist for the wider admin role baseline.
Safety: attachments, links and spoofing
The Safety page holds the advanced phishing and malware protection settings. Each section has an Apply future recommended settings automatically checkbox. Turn it on in each section unless you have a change control reason not to: it keeps your baseline aligned with Google's recommendations without a manual review cycle.
Attachments
- Protect against encrypted attachments from untrusted senders: password-protected archives are a common way to carry malware past scanning, because the scanner cannot open them.
- Protect against attachment with scripts from untrusted senders: covers documents and files carrying scripts.
- Protect against anomalous attachment types in emails: flags file types that are unusual for your domain. Use Allowlist the following uncommon filetypes only for business-justified types, and record the owner of each entry.
Links and external images
- Identify links behind shortened URLs and Scan linked images: switch both on; neither has an action to choose.
- Show warning prompt for any click on links to untrusted domains: switch on. Google notes it does not apply to IMAP or POP clients, which is one more reason to restrict those protocols.
Spoofing and authentication
- Protect against domain spoofing based on similar domain names: look-alike domains used in invoice fraud and credential phishing.
- Protect against spoofing of employee names: display-name impersonation of executives and finance staff from external addresses.
- Protect against inbound emails spoofing your domain: external mail claiming to come from your own domain.
- Protect against any unauthenticated emails: mail that fails authentication from any domain.
- Protect Groups from inbound emails spoofing your domain: can be applied to private groups or all groups. Group addresses such as finance@ and payroll@ are frequent targets.
Choosing the action
Google offers three actions for the attachment and spoofing options: Keep email in inbox and show warning (Default), Move email to spam, and Quarantine. Quarantine applies only to incoming messages, and users see nothing about quarantined mail.
| Setting | Suggested starting action | Reason |
|---|---|---|
| Inbound emails spoofing your domain | Quarantine | Legitimate senders using your domain should be authorised in SPF and DKIM; anything else is high confidence |
| Encrypted attachments from untrusted senders | Quarantine | Unscannable content from unknown senders; admins can release genuine files |
| Attachments with scripts from untrusted senders | Quarantine or spam | Script-bearing documents are a classic malware carrier |
| Similar domain names | Move to spam | Some false positives from genuine partner domains; users can still find mail in spam |
| Spoofing of employee names | Warning, then spam after review | Personal email from staff can match; start with warnings and measure |
| Any unauthenticated emails | Warning, then spam after review | Badly configured small senders still exist; raise the action once false positives are understood |
| Anomalous attachment types | Warning or spam | Depends on the file types your business receives |
These are starting points, not Google defaults. Small organisations that cannot staff a quarantine review should prefer Move email to spam, because an unreviewed quarantine silently loses mail after its retention period.
Pre-delivery scanning and the Security Sandbox
- Enhanced pre-delivery message scanning: under Spam, Phishing and Malware. Google describes it as briefly holding messages that look suspicious to run extra checks; only flagged messages are delayed. Turn it on at the top-level OU.
- Security Sandbox: runs attachments in a virtual environment to find malware that signature scanning misses. It covers Microsoft executables, Microsoft Office files and PDFs, including files inside zip and rar archives. Google states it is off by default and can delay delivery by up to 3 minutes.
- Scan everything or use rules: the checkbox Enable virtual execution of attachments in a sandbox environment scans every attachment. Alternatively, clear it and write Security Sandbox rules that target external inbound, internal inbound or both, using simple, advanced, metadata or predefined content match expressions.
- Availability: Google lists the Security Sandbox for Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus editions.
Messages the sandbox flags go to the recipient's spam folder. Google's documentation explains that you can quarantine them instead with a content compliance rule that matches the spam metadata attribute, which is the better choice for high-value OUs such as finance and executives.
Routing and gateways
Routing is where well-meant changes most often undermine the protections above. Review every entry on the routing pages and record an owner and business reason for each.
Inbound gateway
If a third-party secure email gateway sits in front of Gmail, the Inbound gateway setting tells Gmail which IP addresses deliver your mail. Its options include:
- Gateway IPs: the public addresses or ranges of every gateway the mail passes through.
- Automatically detect external IP: Gmail reads the Received headers to find the first public IP not on the gateway list and uses it for SPF evaluation. Without it, SPF is evaluated against your own gateway.
- Reject all mail not from gateway IPs: stops attackers delivering directly to Google's MX and skipping your gateway. Turn it on once the gateway is the only path.
- Require TLS for connections from the gateway.
- Message is considered spam if the following header regexp matches: lets Gmail honour the gateway's spam verdict header, with Disable Gmail spam evaluation on mail from this gateway; only use header value as an option that makes the gateway's verdict the main decision.
Google's documentation warns that Gmail does not enforce the sender's DMARC policy for messages arriving from the inbound gateway. Your gateway must therefore enforce DMARC itself. Avoid disabling Gmail's own spam evaluation unless you have tested the gateway's detection and accept that Gmail's filtering no longer applies. See Securing the email security gateway itself.
Outbound paths
- Allow per-user outbound gateways: under End User Access, disabled by default. When enabled, users can send through an external SMTP server for alternate From addresses, and Google notes that this mail is not handled by Workspace mail servers or your domain's outbound gateway. Keep it off unless a documented use exists.
- Outbound gateway and SMTP relay: restrict SMTP relay to known IP addresses and require authentication and TLS where your relay design allows, so a device on your network cannot send as any user.
- Routing rules and address maps: default routing, split delivery, dual delivery and address maps can copy mail to other servers or users. List every rule that adds a destination and confirm it is still needed; an unexplained dual delivery rule is a data leak.
Compliance rules
Content compliance (Gmail > Compliance) applies rules to inbound, outbound, internal outbound and internal inbound messages. A rule has up to 10 expressions, matched on ANY or ALL, using simple content match, advanced content match, metadata match or predefined content match. The action is Reject the message, Quarantine the message or deliver with modifications.
| Modify option | Security use | Abuse or mistake to watch for |
|---|---|---|
| Prepend custom subject; Add custom headers | Tag external or sensitive mail for users and downstream tools | Subject tags users learn to ignore |
| Add X-Gm-Spam and X-GM-Phishy headers | Pass Gmail's verdict to a downstream system | Not supported for Groups and catch-all accounts |
| Change route; Change envelope recipient | Send matching mail to a review mailbox or archive | Rerouting or recipient changes that move mail outside the organisation |
| Bypass spam filter for this message | Rarely justified; partner alerts with known false positives | Broad match conditions that let phishing straight into inboxes |
| Remove attachments from message | Strip blocked file types | Silent loss of business files without notifying the sender |
| Add more recipients | Copy specific mail to a compliance mailbox | A hidden copy to an external address is mailbox exfiltration |
| Encryption (onward delivery only): Require secure transport (TLS) | Force TLS for sensitive outbound mail | Bounces if the recipient cannot do TLS |
Google states that once a message is rejected, no other routing or compliance rules are applied, and that Bypass spam filter for this message applies only to incoming mail. Write bypass conditions as narrowly as possible and never base them on the From header alone, which attackers control.
TLS for partners
Secure transport (TLS) compliance enforces TLS for listed domains and addresses. Outbound mail that cannot be sent over TLS bounces with a non-delivery report; inbound mail over non-TLS connections is rejected and the sender is notified, not your users. The setting also offers stricter options to require a certificate signed by a certificate authority and to check the hostname. Use it for banks, law firms and other partners exchanging sensitive data. For domain-wide transport policy, publish MTA-STS as described in the SMTP Security, STARTTLS and MTA-STS Guide.
Attachment control
Use attachment compliance or content compliance to reject or quarantine file types your business never needs to receive from outside, such as executables and script files. Combine this with the Safety settings above rather than relying on one layer.
End user access: forwarding, POP and IMAP
- Automatic forwarding: the setting Allow users to automatically forward incoming email is on by default. Choose internal addresses only, or turn it off for sensitive OUs. Mailbox forwarding to an outside address is one of the first things an attacker sets up after taking over an account (ATT&CK T1114.003 Email Forwarding Rule). Provide admin-managed alternatives such as delegation or address maps for real needs. See How to Audit Mailbox Forwarding and Inbox Rules.
- POP and IMAP access: legacy protocols bypass the link warning prompt and some session controls. Turn them off by OU and allow them only for named mail clients that need them. See the Google Workspace Less Secure Apps Retirement guide.
- Per-user outbound gateways: covered under routing above; keep disabled.
Quarantine operations
Quarantine is only as good as its review process. Google provides a default quarantine and lets super administrators create custom quarantines, for example a restricted quarantine reviewed only by a named group. Options include Send the default reject message to the sender and Notify periodically when messages are quarantined for admins. Recipients are never notified. Quarantined messages are permanently deleted after 30 days if nobody acts on them.
- Create separate quarantines for spoofing, malware and data protection rules so reviewers know why a message was held.
- Turn on periodic admin notification and give the review a named owner and a daily or twice-daily slot.
- Restrict release rights: releasing a spoofed payment request is how quarantine turns into a delivery mechanism.
- Track release rates per quarantine; a high release rate means the rule is too broad.
Implementation plan
- Inventory first: export current Safety, compliance and routing settings for every OU, list every routing rule, gateway, allowlist and spam bypass entry, and confirm SPF, DKIM and DMARC for all sending domains (see the DMARC, SPF and DKIM Guide).
- Pilot OU: create a pilot OU with IT and security staff. Enable all Safety options with the warning action, enhanced pre-delivery scanning and the Security Sandbox. Run for two weeks and record false positives from Email Log Search.
- Raise actions: move own-domain spoofing and encrypted or scripted attachments to quarantine, then extend to finance, executives and HR OUs before everyone else.
- Close user-level gaps: restrict automatic forwarding, turn off POP and IMAP where not needed, confirm per-user outbound gateways are disabled.
- Clean routing and compliance: remove unused routing rules and spam bypasses; on gateway tenants enable Reject all mail not from gateway IPs after confirming all mail flows through the gateway.
- Test: send controlled test messages from an external test domain: a spoof of your own domain, a password-protected archive and a look-alike domain. Confirm each lands where the policy says.
- Roll back safely: settings are per OU, so revert by moving affected users back to the previous OU or setting the action back to warning. Expect up to 24 hours for changes to apply either way, and announce changes to the service desk before each stage.
Detection and measurement
Use Email Log Search for message tracing and the Admin console audit logs for configuration changes. Alert on any change to routing, inbound gateway, content compliance rules, spam bypass lists and the Safety settings, because each can open a path for attacker mail or mail exfiltration. Export Gmail and admin audit events to your SIEM; the Google Workspace Audit Log Detection Guide covers the log sources and detections.
- Coverage: percentage of users in OUs with all Safety options enabled and a non-default action for own-domain spoofing.
- Quarantine health: median time to review quarantined messages and release rate per quarantine.
- Forwarding exposure: number of mailboxes forwarding externally, trending to zero or to an approved list.
- Bypass debt: count of spam bypass, allowlist and Bypass spam filter rules, each with an owner and review date.
- Authentication posture: share of your sending domains at DMARC p=reject.
- User reports: phishing reports per thousand users and the share confirmed malicious.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A | ATT&CK addressed |
|---|---|---|---|---|---|
| Safety settings, sandbox, pre-delivery scanning | SI-3, SI-8 | DE.CM-09 | 9.7 | A.8.7 | T1566.001, T1566.002 |
| Spoofing protection and DMARC | SI-8 | DE.CM-09 | 9.5 | A.5.14 | T1566, T1534 |
| Attachment type blocking | SI-3 | PR.PS-05 | 9.6 | A.8.7 | T1566.001 |
| TLS compliance | SC-8 | PR.DS-02 | 3.10 | A.5.14 | None mapped |
| Forwarding and routing restrictions | SC-7, AC-3 | PR.AA-05 | 3.3 | A.5.14 | T1114.003, T1564.008 |
| Change monitoring of mail settings | AU-6 | DE.CM-03 | 8.11 | A.8.15 | T1114.003 |
Common failure patterns
- Safety settings enabled with the default action everywhere: users get a warning banner on a spoof of the chief executive and click through anyway. Raise the action for high-confidence categories.
- Inbound gateway without Reject all mail not from gateway IPs: attackers deliver straight to Google's MX records, skipping the gateway, and Gmail does not apply the sender's DMARC policy to gateway traffic.
- A broad spam bypass rule: a content compliance rule that bypasses the spam filter for a partner's domain matched on the From header becomes a free pass for anyone spoofing that partner.
- Forgotten dual delivery or recipient rules: a migration-era rule that still copies mail to an old server or an external address. This is the routing equivalent of a forwarding rule and is easy to miss in reviews. See the Business Email Compromise Response Playbook for how such rules feature in account takeover response.
- Quarantine nobody reads: genuine mail is lost after 30 days and the business pressures admins to weaken the rule.
- Settings applied to the wrong OU: a child OU overrides the parent and executives or shared mailboxes sit outside the protected baseline. Check effective settings per OU after each change.
Practitioner checklist
- Restrict the Gmail Settings privilege to a small custom admin role and alert on its use.
- Enable every Attachments, Links and Spoofing option on the Safety page and tick Apply future recommended settings automatically.
- Quarantine inbound mail spoofing your domain and encrypted or scripted attachments from untrusted senders.
- Turn on enhanced pre-delivery message scanning and the Security Sandbox where your edition includes it.
- Restrict automatic forwarding to internal addresses or turn it off; disable POP and IMAP where not needed.
- Keep per-user outbound gateways disabled and restrict SMTP relay to known sources.
- On gateway tenants, set Automatically detect external IP and Reject all mail not from gateway IPs, and enforce DMARC at the gateway.
- Review every routing rule, compliance rule and spam bypass entry quarterly, with a named owner for each.
- Set up custom quarantines with admin notifications and a daily review owner.
- Forward Gmail and admin audit events to the SIEM and alert on routing and compliance rule changes.
Standards and references
- Google Workspace Admin Help: Advanced phishing and malware protection
- Google Workspace Admin Help: Set up rules to detect harmful attachments (Security Sandbox)
- Google Workspace Admin Help: Set up rules for advanced email content filtering
- Google Workspace Admin Help: Set up an inbound mail gateway
- Google Workspace Admin Help: Allow per-user outbound gateways
- Google Workspace Admin Help: Let users automatically forward their own Gmail emails
- Google Workspace Admin Help: Send email over a secure TLS connection
- Google Workspace Admin Help: Set up email quarantine
Related NHI Mgmt Group resources: Google Workspace Security Guide · DMARC, SPF and DKIM Guide · Google Workspace Audit Log Detection Guide · Google Workspace Compromise Playbook · Email Security Guide