How do Gmail routing rules work in Google Workspace?

Gmail routing rules decide where a Google Workspace message goes after Google accepts it, and what gets changed on the way. Admins use them for shared copies, catch-all mailboxes, split delivery to another server and security tagging. This guide covers both routing pages, every option and default, how Gmail picks a winner when rules overlap, and how to fix a rule that doesn't fire.

For pattern-matching rules on message content, see our Gmail content compliance rules guide. This guide sticks to routing.

What are Gmail routing rules in Google Workspace?

A Gmail routing rule is an admin setting that changes how Google Workspace delivers mail: to whom, to which server, and with which changes. Google describes it as a way to "customize how email is routed, delivered, and stored" (Google Workspace Admin Help). Typical examples are delivering mail for unknown addresses to one mailbox, sending a copy of one person's mail to another, or delivering some users' mail to an on-premises server.

Routing works on the envelope, the SMTP-level sender and recipient, not just the To: and From: lines a user sees. That matters when you troubleshoot. A Bcc recipient, for example, is an envelope recipient but never appears in a header.

What is the difference between Routing and Default routing?

Google Workspace has two routing pages. Default routing sets organization-wide delivery based on who the mail is addressed to. Routing adds narrower rules that can override it (Google Workspace Admin Help).

Google defines a non-recognized address as one belonging to a suspended user, a user with Gmail turned off, or an address at one of your verified domains with no matching account.

How do you add a Gmail routing rule?

You need the Gmail Settings administrator privilege. Google documents these settings in the Admin console; changes are recorded in the Admin console audit log.

1. In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Routing.
2. Leave the top organizational unit selected to apply the rule to everyone, or select a child unit.
3. On the Routing tab, click Configure, or Add Another Rule if rules already exist.
4. Enter a descriptive name. Google says you can't save a setting without one.
5. Under Select when this action is applied, tick the message types: Inbound messages, Outbound messages, Internal inbound messages, Internal outbound messages.
6. Choose the action: Modify message, Reject message or Quarantine message.
7. Pick the modify options, then select Show options for account types, address lists and envelope filters.
8. Click Save. Google says changes "can take up to 24 hours but typically happen more quickly."

Google counts a domain as internal if it's a verified Workspace domain, or a subdomain or parent domain of one. For copies, catch-alls and split delivery, Google suggests ticking Inbound messages, Internal outbound messages or both.

Which options does a routing rule have, and what are the defaults?

The modify options appear when you choose Modify message, and none is applied unless you select it. The table shows what Google says each one does (Google Workspace Admin Help).

You also choose the account types a rule affects: Active user account, Group account, All inactive and unrecognized accounts, and archived accounts with an assigned delegate. Quarantine is only available for active user accounts.

Address lists and envelope filters

Under Show options you can limit a rule with an address list (bypass or only apply for specific addresses or domains), or with envelope filters for specific senders or recipients: a single address, a regex pattern, or group membership. Address lists match the From: address, not Return-Path, and Google turns sender authentication on by default for each entry. Leave it on, or a forged From address inherits the exemption (Google Workspace Admin Help).

Which Gmail routing rule wins when two rules match?

Gmail applies every matching routing setting, then settles conflicts. Google's rules are:

• Reject wins. Settings with a Reject action are "always assigned the highest priority," and once a message is rejected "no other routing or compliance rules are applied." Gmail adds an SMTP code such as 550 5.7.1 that you can't remove.
• Conflicts go to the higher-priority rule. If two settings conflict, Google Workspace "applies the setting with the higher priority and ignores the lower priority, conflicting setting."
• Default routing is last. Default routing settings have "a lower priority than other Gmail routing settings, including content and attachment compliance settings." Use Reorder to rank them, with 1 as the highest.

A conflict only arises when two rules would change the same thing, such as the route or the envelope recipient. Non-conflicting changes, like two different headers, are both applied. Google's Working with Gmail admin settings page also notes that Change envelope recipient combined with Add more recipients "implements the Bcc feature," while on its own "it forwards the message."

How do you route mail to another server?

To deliver some mail somewhere other than Gmail, add the server first under Gmail > Hosts > Add Route (Google Workspace Admin Help).

1. Name the route.
2. Choose Single host or Multiple hosts. For multiple hosts, fill the Primary and Secondary tables; the Load % in each table must total 100.
3. Enter a hostname (Google recommends this over an IP address) and a port: 25, 587, or 1024 to 65535. Port 465 isn't supported.
4. Leave the options marked Recommended, which are on by default for new routes: Require mail to be transmitted over a secure transport (TLS) connection, Require CA signed certificate and Validate certificate hostname. Tick Perform MX lookup on host only if you entered a domain rather than a server.
5. Click Test TLS connection, then Save.

If the test shows "Could not validate certificate", Google warns that routed messages "will bounce, even though you could save the new mail route." Fix the certificate or the hostname rather than unticking the TLS options. Our guide to STARTTLS and email encryption in transit explains what those checks protect.

Then reference the route in a rule with Change the route. When the downstream server runs its own filtering, also tick Add X-Gm-Spam and X-Gm-Phishy headers so it can act on Gmail's verdict.

Which routing rules help email security?

Three rules worth considering, as examples to test on a small unit first:

1. Reject mail to addresses that don't exist. In Default routing, set All recipients, action Reject message, and choose Perform this action only on non-recognized addresses. Dictionary spam to made-up addresses is refused instead of piling up in a catch-all. Our guide to catch-all addresses and spam explains the trade-off. Check first that no real alias depends on catch-all delivery.

2. Tag rerouted mail with Gmail's verdict. On any Change the route rule, add the X-Gm-Spam and X-Gm-Phishy headers, plus a custom header naming the rule, for example (illustrative):

   X-Gm-Original-To: sales@example.com
   X-Routing-Rule: sales-split-delivery
   

3. Never grant spam bypass on a guessable condition. Bypass the spam filter for this message delivers mail Gmail flagged as spam. If you must use it, pair it with an address list that keeps sender authentication on.

Routing also has a quieter risk: rules that copy mail elsewhere. Review Add more recipients and Change envelope recipient entries during audits, alongside users' own forwarding, which our guide to malicious inbox rules and auto-forwarding covers. To stop users forwarding outside the domain at all, see disabling automatic email forwarding in Google Workspace.

Why isn't my Gmail routing rule working?

Work through these causes, most likely first:

1. Not enough time. Wait up to 24 hours, then send a fresh test.
2. Wrong organizational unit or account type. A rule on a child OU doesn't reach users elsewhere. A Routing rule doesn't apply to suspended users or users with Gmail off; use Default routing for those.
3. Wrong direction. Mail between two of your users is internal, so a rule with only Inbound messages ticked won't touch it.
4. Your own mail isn't authenticated. Google says routing rules apply to messages from outside Gmail "that your domain authenticates with SPF or DKIM," and if they fail, "Gmail treats the message as external." Check with the SPF Checker and DKIM Checker. Devices that send as your domain should use the Google Workspace SMTP relay service.
5. A reject or higher-priority rule won. Look for a reject in any compliance or routing setting.
6. Matching on the header instead of the envelope. Envelope filters see the SMTP recipient, not the To: line.

To see what happened, trace the message in Email Log Search, then open the delivered copy's headers in the Email Header Analyzer and look for your custom header.

Next steps

• List every rule under Routing and Default routing and note which ones bypass spam or copy mail elsewhere.
• Add a custom header to each rule so you can tell which one fired.
• Confirm your MX records still point where you expect with the MX Lookup.
• If you want filtering before mail reaches Gmail, our Google Workspace platform page explains how iBlockSpam sits in front of it as an inbound gateway.

See all spam filter setup guides.