Gmail security settings for Google Workspace admins

Before you start

These steps are for Google Workspace administrators managing business Gmail, not personal Gmail accounts. You need the Gmail Settings administrator privilege for most of them, and super administrator rights to set up email quarantines and to generate DKIM keys.

• Organisational units: most settings can be applied to the whole organisation or to a department. Start with a pilot group if you are cautious, then apply at the top level.
• Timing: Google says changes can take up to 24 hours, though they usually apply sooner.
• Audit: setting changes are recorded in the Admin audit log, which is worth checking if something changes that you did not expect.
• Edition: the Security Sandbox and Enhanced Safe Browsing need Business Standard or above; our Google Workspace email security hub has the edition table.

Every path below starts from Menu > Apps > Google Workspace > Gmail in the Admin console.

Step 1: Turn on advanced phishing and malware protection

Go to Gmail > Safety. Google groups its advanced protections into three sections, and for each protection you choose an action: keep in the inbox with a warning (the default), move to spam, or quarantine.

Attachments - Protect against encrypted attachments from untrusted senders, which cannot be scanned for malware - Protect against attachments with scripts from untrusted senders - Protect against anomalous attachment types, meaning file types that are uncommon for your domain (you can allowlist ones you genuinely receive)

Links and external images - Identify links behind shortened URLs - Scan linked images for hidden malicious content - Show a warning prompt for any click on links to untrusted domains (not available in IMAP or POP clients) - If staff use third-party IMAP clients, also turn on suspicious link protection for IMAP users

Spoofing and authentication - Protect against domains that look similar to yours - Protect against spoofing of employee names from outside your domain - Protect against inbound mail spoofing your domain that is not authenticated with SPF or DKIM (Google flags this as potential business email compromise) - Protect against any unauthenticated email, which also shows a question mark next to the sender's name - Protect Google Groups from mail spoofing your domain

Tick Apply future recommended settings automatically in each section so new protections Google adds are switched on for you. For most organisations, moving spoofing detections to spam or quarantine is a better choice than the default warning, because a warning still lets someone act on the message. The threats these settings target are covered in email spoofing and BEC attacks.

Step 2: Turn on the Security Sandbox and enhanced scanning

Go to Gmail > Spam, Phishing and Malware. Three settings here add deeper inspection:

1. Security Sandbox: tick Enable virtual execution of attachments in a sandbox environment to scan all attachments, or leave it clear and add Security sandbox rules to scan only matching messages (for example inbound mail with attachments from outside your domain). Supported types include Microsoft executables, Office files and PDFs, including files inside archives. It is off by default, and Google notes that sandbox scanning can delay delivery by up to 3 minutes. Suspicious messages go to spam; a content compliance rule can quarantine them instead.
2. Enhanced pre-delivery message scanning: when Gmail detects suspicious content, it slightly delays delivery to run extra checks.
3. Enhanced malware and phishing protection (Gmail Enhanced Safe Browsing): extra checks for harmful content before delivery. It is off by default and can be applied to everyone, organisational units or groups. Google notes it cannot work for users whose data is protected by client-side encryption.

The Security Sandbox and Enhanced Safe Browsing need Business Standard, Business Plus, Enterprise Standard or Enterprise Plus (the sandbox is also in Frontline Plus). If your edition lacks them, attachment sandboxing is one of the things an integrated cloud email security product can add.

Step 3: Review spam filters, allowlists and quarantine

Gmail's spam scanning cannot be switched off, but the Spam setting on the same page lets you customise it. This is where well-meant exceptions most often weaken security:

• Approved senders lists bypass spam filtering for those addresses or whole domains. Keep them short and limited to trusted senders. If a supplier's mail keeps landing in spam, ask them to fix SPF, DKIM and DMARC rather than allowlisting their whole domain.
• Bypass options hide warnings. Google warns that the options to bypass spam filters *and hide warnings* stop Gmail showing its warning banners for those messages. Avoid them.
• Be more aggressive when filtering spam and Put spam in administrative quarantine are available if your users receive a lot of junk.
• Email allowlist (IP addresses) applies to the whole domain and cannot be limited to one department. Use it sparingly.
• Inbound gateway: if a secure email gateway filters mail before Gmail, add its IP addresses here (not to the allowlist) so Gmail can see the true sender.

For quarantine, a super administrator can create custom quarantines in Manage quarantines and route messages to them from spam, safety or compliance settings. Quarantined messages are deleted permanently after 30 days if nobody acts on them, so decide who reviews them.

Step 4: External warnings and automatic forwarding

Go to Gmail > End User Access.

• Warn for external recipients is on by default. Leave it on: it adds a banner when a thread includes people outside your organisation, which helps catch misdirected replies and reply-chain fraud.
• Automatic forwarding is also on by default, letting users forward all their incoming mail to any address. Attackers who take over an account often use forwarding to keep a copy of everything. Clear Allow users to automatically forward incoming email, or restrict it to internal addresses only, and use an organisational unit for anyone with a genuine need.

If you find forwarding you did not expect, treat it as a possible email account takeover and investigate the account.

Step 5: Enforce TLS with sensitive partners

By default Gmail tries to send every message over TLS, but falls back to an unencrypted connection if the other server does not support it. For partners you exchange personal or confidential data with, go to Gmail > Compliance > Secure transport (TLS) compliance and add a setting:

1. Choose inbound, outbound or both.
2. Add the partner's domains or addresses in an address list.
3. Optionally require a CA-signed certificate and verify the certificate's hostname, and use the built-in test.

Once enforced, outbound mail to those domains bounces rather than travelling unencrypted, and inbound mail from them over a non-TLS connection is rejected. Test with each partner first. To ask other senders to use TLS when they deliver to you, publish an MTA-STS policy. For encrypting message content itself, see sending secure email in Gmail.

Step 6: Set up SPF, DKIM and DMARC

Filtering protects your users; authentication protects everyone else from mail pretending to be you, and it is now required by Gmail and other mailbox providers.

1. DKIM: go to Gmail > Authenticate email, select the domain, click Generate new record, choose a 2048-bit key if your DNS host supports it (the default selector prefix is "google"), add the TXT record at your DNS host, then return and click Start authentication. Google notes the page may show a warning for up to 48 hours while DNS updates. Repeat for each domain. More detail: DKIM.
2. SPF: publish one SPF record per domain that includes Google and every other service that sends as you. See SPF record.
3. DMARC: publish a DMARC record at p=none, review the reports, then tighten to quarantine and reject. Our sister site explains DMARC, and we cover the common scanner warning on "DMARC policy not enabled".

If you send newsletters or invoices from other platforms, check them against the Google bulk sender guidelines.

Step 7: Enforce 2-Step Verification

Most email compromise starts with a stolen password. Under Security > Authentication > 2-step verification, allow and then enforce 2-Step Verification (2SV), starting with administrators and anyone handling finance or personal data. Google is already enforcing 2SV for administrator accounts.

Google describes security keys (hardware keys or a phone's built-in key) as the strongest method and the one that protects against phishing; Google prompts and authenticator apps are good alternatives, and Google discourages text message codes because they can be intercepted. Passkeys are also available where admins allow users to skip passwords.

For identity protection beyond 2SV, our sister site covers identity security.

Gmail security settings checklist

These settings make Gmail considerably harder to abuse, but they do not stop a convincing payment-change request from a real supplier's hijacked mailbox. If that is your concern, look at the API products in our email security platforms comparison.

How we help

Forever Systems can review your Admin console against this checklist, explain the trade-offs of each setting for your organisation, and help you roll changes out by organisational unit so nothing important stops arriving. Where Gmail's own controls are not enough, we can help you trial an API layer alongside them (where the vendor offers a trial) and quote it, with pricing confirmed at quote. Contact us to arrange a review.