Block specific senders based on email address or domain

To help prevent spam and malicious email, add individual email addresses or entire domains to a blocked senders list. This way, you’re automatically rejecting messages from them. 

Understand how settings apply

The Blocked senders setting applies to users depending on their organizational unit. That means you can block messages by address or domain for everyone. Or, for example, you can set different rules for different departments.

However, the Blocked senders setting doesn’t necessarily apply to messages posted in Google Groups for Business. If the blocked sender sends to a group, members of the group might receive the message. It can depend on their group notification or email settings.

Set up a blocked sender list

Open all  |  Close all

Step 1: Add addresses or domains to the blocked senders list
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Appsand thenG Suiteand thenGmailand thenAdvanced settings.

    Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

  3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.

  4. Point to Blocked senders and choose an option:

    • To edit an existing setting, click Edit.

    • For a new setting, click Configure or Add anotherand thenenter a unique description.

  5. Click Use existing or create a new one.

  6. Choose an option:

    • To create a list, under Create new list, enter a name for the listand thenclick Create.

    • To use an existing list as your blocked sender list, under Available lists, click the list name.

  7. Point to the list name, click Editand thenAdd Add.

  8. Enter one or more email addresses or domain names. Separate each entry with a comma or space.

  9. Click Save.

  10. (Optional) To add more email addresses or domains to the list, repeat the above steps.

For more information on how to use address lists, go to Using address lists in Gmail settings.

Step 2: (Optional) Edit the default rejection notice

Under Edit the default rejection notice, enter text for the rejection notice. 

Step 3: (Optional) Add exceptions to your list

You can create an exceptions list for approved senders. Messages from domains or email addresses on this list aren’t blocked unless blocked by other settings. If a message from an approved sender contains a virus or is part of an email attack, Google's virus filters will still prevent it from reaching your users.

Gmail checks the addresses or domain names against the From part of the message header, not the envelope sender (or Return-Path section of the message header). So, the From sender must match an address or domain in the list.

  1. Under Options, check the Bypass this setting for messages received from addresses or domains within these approved sender lists box.

  2. Click Use existing or create a new one.

  3. Choose an option:

    • Click the name of an existing list.

    • Under Create new list, enter a name for the new listand thenclick Create.

  4. Point to the list name, and then click Editand thenAdd Add.

  5. Enter email addresses or domain names. Use a space or a comma to separate multiple entries.

  6. (Optional) To bypass this setting for approved senders that don't have authentication, uncheck the Require sender authentication box.

    Note: Use this option with caution as it can potentially lead to spoofing.

  7. Click Save.

Other settings can still cause the message to be blocked. Also, if a message from an approved sender contains a virus or is part of an email attack, Google's virus filters will still prevent it from reaching your users. 

Related topics

Step 4: Add and save the setting
  1. Click Add Setting or Save.

    The Gmail Advanced settings page will display new settings.

  2. At the bottom of the page, click Save.

It can take up to an hour for changes to take effect. You can track changes in the Admin audit log.

Was this helpful?
How can we improve it?