Notification

Duet AI is now Gemini for Google Workspace. Learn more

Working with Gmail Admin settings in Google Workspace

Spam, compliance, and routing settings

As an admin, you can configure advanced Gmail settings for your organization. For example, you can: 

  • Set up sophisticated filters and allowlist IP addresses where you expect to receive legitimate mail.
  • Specify where inbound messages are delivered.
  • Route messages to a catch-all address or another server, or for archiving, filtering, and monitoring.
  • Allow users to send outbound messages with a different from address.

You can create conditional settings as well. For example, you can reject messages or attachments that exceed 20 MB. Or reroute messages that contain certain words, or that are sent from a certain address.

Who settings apply to

Some settings always apply to everyone, for example changing the address where your users access Gmail. Other settings can be applied to specific groups of users. Apply a setting to a group of users by adding the users to an organizational unit.

Learn more about the organization structure and how to tailor settings for groups of users.

Best practices for faster rules testing

When creating advanced settings and rules, you usually have to change and test them several times to make sure they work as expected. To minimize the time needed to test settings and rules, follow our recommendations in Best practices for faster rules testing.

How to do it

Expand section  |  Collapse all

Change a setting
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console home page, go to one of these pages:

    • Appsand thenGoogle Workspaceand thenGmailand thenCompliance

    • Appsand thenGoogle Workspaceand thenGmailand thenRouting

    • Appsand thenGoogle WorkspaceGmailand thenSpam, phishing and malware

  3. (Optional) On the left, select an organization.

  4. Configure any settings.

  5. At the bottom, click Save.

Changes can take up to 24 hours but typically happen more quickly. Learn more

Controls for settings

These controls are available for settings:

  • Configure—Use this control if you haven't configured the setting yet.
  • View—Use this control to check the configuration of an inherited setting. To change an inherited setting’s configuration, click Add Another.
  • Edit—Use this control to change to the setting’s configuration. Available for locally applied settings only.
  • Disable or Enable—Use this control to turn a setting on or off. Turning off a setting doesn't impact the options you configured. For example, you can temporarily turn off a setting if the results aren't as expected. You can then change the setting and turn it back on. You can also make a copy of a setting, turn it off it, change it, and then compare the different results. Available for inherited and locally applied settings.
  • Delete—Use this control to turn off the setting and delete its configuration. To turn it back on, click Configure. For example, you might want to clear your blocked senders list and start over. Available for locally applied settings only.
  • Add Another—Use this control to add more options for a setting. For example, you could add a rule to trigger an action when a certain condition is met. Available for inherited and locally applied settings.                    
Conditional actions

Some settings let you configure conditional actions. These settings include:

  • Add more recipients—The message is also delivered to these recipients.
  • Add X-Gm-Original-To header, Add X-Gm-Spam header and X-Gm-Phishy header, and Add custom headers—Add custom message headers, which can be helpful. For example, if your mail is routed to a downstream server, you can configure that server to process messages based on the headers. This is typically used to route spam-tagged messages to spam.
  • Bypass spam filter for this message—Messages that match the conditions of the setting and are identified as spam are delivered to the intended recipient.
  • Change envelope recipient—Change where the message is delivered. When used with Add more recipients, it implements the Bcc feature. If not, it forwards the message.
  • Change route—Change where the message is routed. For example, users with third-party email accounts can have their messages routed to an on-premise mail server.
  • Prepend custom subject—Change the Subject: header to include prefix text.
  • Reject message—The message isn't delivered.
  • Remove attachments from message—Attachments are removed before the message is delivered to the intended recipient.
  • Require secure transport for onward delivery—Outbound messages require secure delivery.

Learn about each setting

Expand section  |  Collapse all

Setup settings

These settings apply to all organizations and can only be configured and edited at the top-level organization.

  • Web address—Change the URL for your users' Gmail sign-in page.
  • MX records—View your MX records and use the Gmail setup wizard.
  • User email uploads—Allow users to import mail and contacts from other webmail or POP3 accounts.
  • Uninstall service—Turn off Gmail for your organization. For more information, go to Turn Gmail on and off for your users.
End user access settings

 These settings are located at Appsand thenGoogle Workspaceand thenGmailand thenEnd User Access. 

Spam settings
  • Email whitelist—Create a list of IP addresses that send legitimate mail. Mail sent from these IP addresses should not be marked as spam. Can only be configured at the top-level organization and applies to all organizations.
  • Inbound gatewaySpecify the IP addresses of your mail servers that are forwarding email to Gmail. Can only be configured at the top-level organization and applies to all organizations.
  • SpamCreate a list of approved email addresses or domains that send legitimate mail. You can also route spam messages to an administrative quarantine.
  • Blocked sendersBlock senders based on email address or domain.
Compliance settings
  • Email and chat auto-deletion—Manage the amount of email that's stored for each user. Applies only to the top-level organization.
  • Append footer—Use footer text on messages for legal compliance or other requirements.
  • Content compliance—Specify how messages are managed based on predefined words, phrases, text patterns, or numerical patterns.
  • Comprehensive mail storage—Ensure that all messages are stored in users' Gmail mailboxes. This includes messages sent or received by non-Gmail mailboxes and SMTP relay. Configure this setting when you're using Vault with a non-Gmail mailbox. You can also use this setting to capture all sent messages, including calendar invites and sharing notifications.
  • Restrict deliveryRestrict the email addresses or domains that users can exchange mail with.
  • Objectionable content—Specify how messages are managed based on word lists that you create.
  • Attachment compliance—Specify how messages with attachments are managed.
  • Secure transport (TLS) compliance—Require mail to be transmitted via a secure connection for specific domains and email addresses.
Routing settings

Before you configure any controls, read our guidelines and best practices for email routing and delivery. Learn more about your routing options below.

How multiple settings affect message behavior

Expand section  |  Collapse all

You can create configurations with multiple settings. This can impact message behavior and how the settings are applied.

Settings can sometimes cause a conflict with delivery. For example, should a message be rejected or delivered twice? What happens depends on the conditions you set and which setting has precedence.

General behavior

When you create multiple configurations or settings, there's usually no impact on how a message behaves. Gmail simply applies all settings to the message. One setting usually doesn’t take precedence over another.

For example, there's no conflict if:

  • You create an Append footer setting and a Content compliance setting. Gmail applies both actions to the message.

  • You set up two configurations with the Add more recipients consequence. Gmail adds all recipients.

However, there are exceptions to how messages behave when different settings have multiple consequences. This can cause settings to conflict.

Setting behavior guidelines

Conflicting consequences

When two consequences conflict, Gmail applies only one of the consequences. Non-conflicting consequences are always applied.

An example:

  • A content compliance setting applies a change route consequence that reroutes messages to host1.com and adds a X-gm-spam: header.
  • An objectionable content setting applies a change route consequence that reroutes messages to host2.com and also prepends a custom subject.

In this example, the change route consequences are conflicting because Gmail can only select one route. So only one change route is selected, and the other non-conflicting consequences are applied: X-gm-spam: header and custom subject.

In general, all settings are evaluated independently of each other. The settings consequences are compiled, and then any conflicts are resolved. The consequence of one setting can’t be used to trigger another setting.

Multiple reroutes or change in recipient

A conflict occurs when two settings attempt to change the primary route, or change the primary envelope recipient. When there's a conflict, Gmail determines which action to apply using this criteria:

  • Specificity—The more specific settings takes precedence. For example, locally applied settings take precedence over inherited ones. All organization-specific settings take precedence over default routing.
  • Creation date—For settings of the same specificity, older settings take precedence over newer ones. 

Reject message

If any triggered rule causes a rejection, the message is rejected and no other rules are applied. When multiple settings trigger rejections with different rejection responses, then only one response is used.

Senders lists

Any setting can specify a list of approved senders to bypass the actions if there’s a match. Senders lists can be shared between settings. For example, the Spam setting lets you create an approved sender list to bypass the spam folder. This same approved sender list can be used to bypass a Content compliance setting.

SMTP relay

The SMTP relay setting specifies which email and IP addresses can use the Google SMTP Relay service. It also specifies if SMTP authentication is required. If multiple SMTP relay settings are configured, the SMTP relay service:

  • Accepts the message if any of the settings permit it.
  • Refuses the message if none of the settings permit it.
Precedence exceptions

There are a few cases where Gmail gives precedence to one setting over another. In this case, Gmail applies both settings, but one is applied first.

The ordering precedence depends on where the setting is in the organizational unit structure. Actions in a child organization take precedence over parent organization actions.

Add footer

If two settings have different add footer actions, both footers are added. The ordering of the footers depends on the location of the setting in the organization structure. Settings in a child organization take precedence over parent organization settings.

Prepend subject

If two settings result in different prepend custom subject actions, both prefixes are added. The ordering of the prepended subjects depends on the location of the setting in the organization structure. Settings in a child organization take precedence over parent organization settings.

Order of evaluation and consequence

Gmail evaluates messages and determines consequences in the following order:

  1. Gmail evaluates the message against all policies independently and compiles any matching consequences into a consequence list.

  2. Gmail evaluates the consequence list. If there are any reject consequences, Gmail rejects the message and ignores the other consequences.

  3. If the message isn't rejected, Gmail checks the consequence list for any conflicts. Matching conflicts are compiled in a conflicts list. Conflicts only arise if:

    • Multiple consequences would change the primary route. There's a change route consequence that’s not a subconsequence of an Add more recipients setting.

    • Multiple consequences would change the primary envelope recipient. There's a change envelope recipient consequence that’s not a subconsequence of an Add more recipients setting.

  4. Gmail evaluates the conflicts list to determine which of the conflicting consequences to apply. Settings are applied using this criteria:

    • Specificity—Locally applied settings take precedence over inherited ones. Organization-specific settings take precedence over the default route.

    • Creation date—Older settings take precedence over newer ones.  Any setting that appears higher on the settings page has a higher priority when there's a conflict.  This ordering only applies to rules within a settings section, for example within Routing. There's no strictly defined ordering of conflicting rules between different sections.

      Note: We don't recommend relying on rule creation date as the way to resolve conflicts between rules.  Ideally, rules should be created to stand on their own without relying on a specific ordering.

  5. Gmail applies the consequences to the message, and applies any non-conflicting consequences from all settings.

Related topics

 


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

 

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
4577140369734170279
true
Search Help Center
true
true
true
true
true
73010
false
false