Set up routing for your domain or organization

You can set up email routing and delivery options for your organization in the Google Admin console. These options include rejecting, quarantining, or delivering email with modifications. For example, you can route mail to Gmail and an external server or set policies that vary by organizational unit. 

Understand how settings apply

Unless you change the options, the rules apply to all users in an organizational unit. You can disable in a child organization any rules they inherit from a parent organization.. You can also add multiple rules to each organization.

When you set up multiple rules, what happens to a message depends on the conditions you set and which rule has precedence. For details, see How multiple settings affect message behavior.

Before you begin

If you want to send messages to different mail servers:

  1. Create a list of mail hosts, also called routes. 
  2. Add the routes in the Google Admin console. For details, see Add mail routes for advanced Gmail delivery.

Set up routing for your domain or organization

Open all  |  Close all

Step 1: Create or edit the name of the route
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in

  2. From the Admin console Home page, go to Appsand thenG Suiteand thenGmailand thenAdvanced settings.

    Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

  3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.

  4. In the Routing section, point to Routing and choose an option:

    • To set up a new setting, click Configure.

    • If the setting is already configured, click Edit or Add another.

  5. Enter a unique name for the setting.
  6. Go to the next step to configure the setting.

Step 2: Choose email messages to affect
  1. Check the boxes next to the messages you want the policy to apply to:
    • Inbound—Incoming messages 
    • Outbound—Outgoing messages
    • Internal-sending—Internal message with one of the domains or subdomains from your organization listed in the To field
    • Internal-receiving—Internal message with one of the domains or subdomains from your organization listed in the From field

      Note: For split delivery, dual delivery, catch-all addresses, or to route messages to additional recipients, select Inbound, Internal-receiving, or both.

  2. Go to the next step to continue.

How SPF or DKIM authentication affects routing

  • Routing rules also apply to messages originating outside of Gmail that one of your domains authenticates through Sender Policy Framework (SPF) or DomainKeys Identified Mail (DKIM).
  • If you send a message from your domain and the SPF or DKIM authentication check fails, Gmail won’t recognize the sender. It treats the message as external, even if you have other rules in place.
Step 3: Set up an envelope filter

You can choose to affect only specific envelope senders and recipients. You can specify a single recipient, a number of users using a regular expression, or email groups.

To set up an envelope filter:

  1. Check one or both of these options:
    • Only affect specific envelope senders
    • Only affect specific envelope recipients
  2. From the list, choose an option:
    • Single email address—Enter the complete email address for a user.
    • Pattern match—Enter a regular expression to specify a set of senders or recipients in your domain. For example:


      For details, go to Guidelines for using regular expressions.

    • Group membership—Select one or more groups in the list. For envelope senders, this option only applies to sent mail. For envelope recipients, it only applies to received mail. If you haven't, first create the group.
  1. Continue to the next step.
Step 4: Specify what happens to the messages
After you set up your envelope filter, under For the above types of messages, do the following, click the Down arrow  and choose an option:

Reject message

Rejects the message before reaching the recipient. You can enter a message to notify the sender about why the message was rejected. For matching messages, no other routing or compliance rules are applied. 

Note: Gmail automatically adds an SMTP rejection code, such as 550 5.7.1. This is a requirement of the SMTP standard and can't be deleted.

Quarantine message

Sends the message to an admin quarantine where you can review the message before you send or reject it. This option is only available for the Users account type. For details, see Account types to affect.

To notify your users when their sent messages are quarantined, check the Notify sender when mail is quarantined (onward delivery only) box.

Modify message

Add headers, remove attachments, change the envelope recipient, add more recipients, and change the route. For details, see Options for modifying messages.
Use this action to change the primary destination (by default, the Gmail server) and define additional or secondary destinations that you can use for dual delivery or multiple delivery. See below for details on Dual delivery, split delivery, catch-all addresses, and routing messages.

Options for modifying messages

You can modify a message in the following ways:

Add X-Gm-Original-To header

Add a header tag if the recipient is changed. When you do, the downstream server will know the original envelope recipient. An example of the header tag format is X-Gm-Original-To:

Add X-Gm-Spam and X-GM-Phishy headers

Add headers to indicate the spam and phishing status of the message. For example, an administrator at a downstream server can use this information to set up rules that handle spam and phishing differently from clean mail. For details, see Add spam headers setting to all default routing rules.

Add custom headers You can add custom headers to messages that are affected by this setting. For example, you can add a header that matches the description that you entered for the setting. This can help you analyze why a message was routed in a certain way or why a rule was triggered.
Prepend custom subject You can enter a string to add to the beginning of the subject of applicable messages. For example, you could enter Confidential in this field for sensitive emails. If a message triggers the rule and its subject is Monthly report, recipients will see the following subject: [Confidential] Monthly report.
Change route and Also reroute spam
  • Change route—You can change the destination of the message from the default Gmail server to a different mail server, such as Microsoft® Exchange.

    Note: Before you can change the route, you need to add the new route in the Admin console. For details, see Add mail routes for advanced Gmail delivery.

  • Also reroute spam—This option is available if you select Change route. Blatant spam is dropped instantly at delivery time. However, check the Also reroute spam box to route any additional email you mark as spam.

    Leaving the box unchecked has normal messages rerouted, but not spam. G Suite email settings (for example, a list of preauthorized senders) overrides spam settings.

Change envelope recipient

The message bypasses the original recipient’s mailbox and goes to the new recipient.

You can change the envelope recipient in one of the following ways:

  • Replace the recipient’s entire email address—After Replace recipient, enter the full email address, such as
  • Replace the username—To change just the username of the recipient's email address and keep the domain the same, before @existing-domain, enter the username, such as user.
  • Replace the domain—To change just the domain of the recipient's email address and keep the username the same, after existing-username@, enter the domain, such as

An MX lookup on the new recipient's domain determines the destination server. Or, if you’re using the Change route control, the specified route determines the destination server.

If you'd rather Bcc an additional recipient, use the Add more recipients option, described below.

Bypass spam filter for this message

Deliver incoming messages to recipients even if the spam filter identifies them as spam. This option applies to only incoming messages only. You can’t bypass spam filters for outgoing messages.

Note: This option is not available for the Groups account type. For details, see Account types to affect.

Remove attachments from message You can remove any attachments from messages. You can also append text to notify recipients that attachments were removed.
Add more recipients
  1. To set up dual or multiple delivery, check the Add more recipients boxand thenclick Add .
  2. To add individual email addresses, select Basic from the listand thenclick Save
  3. (Optional) To add more addresses, click Add .
  4. (Optional) To choose advanced options for your secondary delivery, select Advanced from the list.

    You can change the envelope recipient, add headers, prepend a custom subject, and remove attachments for secondary deliveries.

When you add recipients, consider that:

  • Each rule has a limit of 100 additional recipients.
  • Settings for the primary delivery also apply to the secondary deliveries.
  • For secondary deliveries, the Do not deliver spam to this recipient and Suppress bounces from this recipient boxes are checked by default.
  • Adding additional recipients creates a message for each added recipient. Advanced Gmail settings apply to each message.
Encryption (onward delivery only)

By default, Gmail tries to deliver messages using Transport Layer Security (TLS). If secure transport isn’t available, the message is delivered over a nonsecure connection.

To require all messages meeting the conditions in the setting to be transmitted through a secure connection, check the Require secure transport (TLS) box. If TLS isn't available on the sending or receiving side, the message won't be sent.

If you have a G Suite Enterprise or Enterprise for Education account, you can also bounce messages or require that messages can only be sent if they are S/MIME encrypted. For details, go to Enhance message security with hosted S/MIME.

Dual delivery, split delivery, catch-all addresses, and routing messages

For an overview on routing settings and the types of delivery, such as dual and split delivery, see Email routing and delivery.

To set up dual delivery, split delivery, a catch-all address, or to route messages to additional recipients:

  1. Under For the above types of messages, do the following, click the Down arrow  and then select Modify message.
  2. Choose an action and follow the steps to set it up:
    Action Setup steps
    Split delivery
    1. Select Change route.
    2. From the list, select the external server.
    3. Scroll down and click Save.
    Dual delivery
    1. Under Also deliver to, select Add more recipients and click Add.
    2. Under Recipients, click the Down arrow and thenAdvanced.
    3. Select Change route and from the list, select the secondary mail route.
    4. Scroll down and click Save.
    Catch-all address
    1. Select Route to user username@[yourprimarydomain].
    2. Enter a catch-all address in the empty field next to @[yourprimarydomain]. For example, enter jsmith.
    3. Click Show options.
    4. Under Account types to affect:
      1. Check the Unrecognized / Catch-all box. 
      2. Uncheck the Users box. 
      3. Uncheck the Groups box.
    5. Click Add setting.
    Route messages to additional recipients
    1. Under Also deliver to, check the Add more recipients box.
    2. Click Add.
    3. Under Recipients, make sure that Basic is selected in the list.
    4. Enter the recipient’s email address and click Save.
    5. Click Add Setting or Save.
  3. Choose an option:
    • To set up additional parameters that limit the application of the setting, go to step 5.
    • To save the setting, go to step 6.
Step 5: (Optional) Set up additional routing options

To set up additional options for a routing policy, such as creating address lists or choosing the account types it will affect, at the bottom, click Show options.

Address lists

You can specify address lists as a criteria for whether to bypass or apply a routing policy. These lists can contain email addresses, domains, or both.

To create an address list:

  1. Under Address lists, check the Use address lists to bypass or control application of this setting box.
  2. From the list, choose how to apply the address list:
    • Apply address list to correspondent—G Suite considers the From field for received mail and the recipients for sent mail. For senders, the authentication requirement is also checked.
    • Apply address list to recipient—G Suite checks if the recipients are present in the address list.
  3. Choose an option:
    • Bypass this setting for specific addresses / domains—Skips the setting if the address list matches, regardless of any other criteria in the setting.
    • Only apply this setting for specific addresses / domains—The address list match becomes a condition for whether the setting is applied. If there are other criteria in the setting, such as match expressions, account types, or envelope filters, they must also match for the setting to be applied.
  4. Click Use existing or create a new one.
  5. Select the name of an existing list or enter a name for a new list and click Create.
  6. Point to the list name and click Edit.
  7. To add addresses and domains to the list, click Add .
  8. Enter a full email address or a domain name. To add multiple addresses, place a comma between each one or enter a space-delimited list.
  9. (Optional) To bypass the setting for approved senders that don't have authentication, uncheck the Require sender authentication box.

    Note: Use this option with caution as it might lead to spoofing. Learn more about sender authentication.

  10. Click Save.
  11. (Optional) To include additional email addresses or domains in the list, repeat steps 5–8.
  12. Proceed to Account types to affect.

Account types to affect

Depending on the message action you chose and the type of organizational unit you’re configuring, some account types might not be available.

Select one or more account types that the setting applies to: 

  • Users (default)—The setting applies to provisioned G Suite users. For sending and outbound mail, the setting is triggered when your users send email. For receiving and inbound mail, the setting is triggered when your users receive email.
  • Groups—The setting applies to groups set up in your organization. For sending and outbound mail, the setting is triggered when your groups forward email or summaries to members. For receiving and inbound mail, the setting is triggered when your groups receive email.
  • Unrecognized/Catch-all—The setting is triggered when your organization receives email that doesn’t match one of your provisioned G Suite users. This selection only applies to received and inbound email.

Note: The Groups and Unrecognized/Catch-all account types don’t apply to these controls:

  • Add X-Gm-Spam and X-Gm-Phishy headers
  • Bypass spam filter for this message
  • Also reroute spam

When you're finished, go to Add and save the setting.

Step 6: Add and save the setting
  1. Click Add setting or Save.

    New settings appear on the Gmail Advanced settings page.

  2. At the bottom, click Save.

Send messages with S/MIME encryption

This feature is only available with G Suite Enterprise and G Suite Enterprise for Education.

You can improve message security with S/MIME. For example, set up a rule that requires S/MIME encryption for outgoing messages. Set this rule up with the Encryption option, described in step 4 above.

For details, see Enhance message security with hosted S/MIME.

Was this helpful?
How can we improve it?