Block emails between specific user groups

As an administrator, you might want to restrict emails between users in different organizational units. For example, a school district might want to prevent elementary school students from receiving email from high school students.

You can do this by creating one compliance rule for the sender and one for the recipient. For more information, see Set up rules for content compliance.

Create 2 compliance rules

In the example below, elementary school students will be prevented from receiving mail from high school and middle school students.

Step 1: Create a sending rule

Create a sending rule to apply a header to internal messages that identifies a user type (for example, teacher, elementary student, or high school student).

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceGmailCompliance.
3. On the left, select the organizational unit of the users that you want to apply the sending rule to, such as High School Students.
4. Scroll to the Compliance section, point to the Content compliance setting, and choose an option:
   • Click Configure.
   • If the setting is already configured, click Edit or Add another.
5. Add or update a description for the rule, such as Mark all messages sent by High School Students with high-school header.
6. Under Email messages to affect, verify that only the Internal - sending box is checked.
7. Under Add expressions that describe the content you want to search for in each message, select If ALL of the following match the message from the drop-down menu.
   Note: No actual expressions should be added.
8. Under Headers, check Add custom headers.
9. Click Add.
10. Under Add header, enter user-type for Header key and a name for Header value.
    For example: X-user-type: high-school
11. Click Save.
12. Click Add Setting or Save to save the compliance setting.

Repeat the above steps for additional organizational units that you wish to prevent from sending messages to another organizational unit, such as middle school students.

Step 2: Create a receiving rule

Create a receiving rule for the organizational unit that shouldn’t receive email from some other organizational unit.

1. In the Admin console, go to Menu  AppsGoogle WorkspaceGmailCompliance.
2. On the left, select the organizational unit that you want to apply the receiving rule to, such as Elementary School Students.
3. Scroll to the Compliance section, point to the Content compliance setting, and choose an option:
   • Click Configure.
   • If the setting is already configured, click Edit or Add another.
4. Add or update a description for the rule, such as Prevent elementary school students from receiving email from messages with high-school and middle-school headers.
5. Under Email messages to affect, check Internal - receiving.
6. Under Add expressions that describe the content you want to search for in each message, click Add.
7. Under Expressions, select Advanced content match in the drop-down list.
8. Under Location, select Full headers.
9. Under Match type, select Matches regex.
10. Under Regexp, enter: 
    ^X-user-type: (high-school|middle-school)$
11. Under Regex Description, enter Reject message if it is marked with high-school or middle-school.
12. Click Save.
13. Under If the above expressions match, do the following, select Reject message from the drop-down menu.
14. Under Customize rejection notice, enter a description for the sender to receive so that they understand why the message was returned to sender.
    For example, This message has been rejected because your organization is not allowed to send email to the Elementary School Students organization.
15. Click Add setting.
16. Click Save.

Related information

Best practices for faster rules testing