# How do Gmail routing rules work in Google Workspace?

URL: https://iblockspam.com/blog/gmail-routing-rules-google-workspace
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> How Gmail Routing and Default routing work in Google Workspace: every option and default, which rule wins, mail routes to other servers, and fixes.

## Short answer

Gmail routing rules tell Google Workspace where to deliver mail and how to change it. In the Admin console, Apps > Google Workspace > Gmail > Default routing sets delivery for envelope recipients, and Gmail > Routing adds specialized rules per organizational unit. Rules can add recipients, change the route, add headers, quarantine or reject. Reject rules always win.

Gmail routing rules decide where a Google Workspace message goes after Google accepts it, and what gets changed on the way. Admins use them for shared copies, catch-all mailboxes, split delivery to another server and security tagging. This guide covers both routing pages, every option and default, how Gmail picks a winner when rules overlap, and how to fix a rule that doesn't fire.

For pattern-matching rules on message content, see our [Gmail content compliance rules guide](https://iblockspam.com/blog/google-workspace-content-compliance-rules). This guide sticks to routing.

## What are Gmail routing rules in Google Workspace?

A Gmail routing rule is an admin setting that changes how Google Workspace delivers mail: to whom, to which server, and with which changes. Google describes it as a way to "customize how email is routed, delivered, and stored" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/add-gmail-routing-settings)). Typical examples are delivering mail for unknown addresses to one mailbox, sending a copy of one person's mail to another, or delivering some users' mail to an on-premises server.

Routing works on the **envelope**, the SMTP-level sender and recipient, not just the To: and From: lines a user sees. That matters when you troubleshoot. A Bcc recipient, for example, is an envelope recipient but never appears in a header.

## What is the difference between Routing and Default routing?

Google Workspace has two routing pages. **Default routing** sets organization-wide delivery based on who the mail is addressed to. **Routing** adds narrower rules that can override it ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-default-routing-for-your-organization)).

| | Default routing | Routing |
|---|---|---|
| Admin console path | Apps > Google Workspace > Gmail > **Default routing** | Apps > Google Workspace > Gmail > **Routing** |
| Matches on | Envelope recipient: single address, regex pattern, group membership or all recipients | Message direction (inbound, outbound, internal inbound, internal outbound), account type, address lists, envelope sender or recipient |
| Scope | Whole organization | Top-level or child organizational unit |
| Unknown addresses | Can act on "non-recognized" addresses | Applies only to active users with Gmail on, plus an option for inactive and unrecognized accounts |
| Actions | Modify or reject | Modify, reject or quarantine |
| Priority | Lower than other routing and compliance settings; up to 1,000 rules, ordered with **Reorder** | Higher than Default routing |
| Typical use | Dual delivery, catch-all, rejecting unknown recipients | Copies for one team, rerouting one OU, tagging outbound mail |

Google defines a non-recognized address as one belonging to a suspended user, a user with Gmail turned off, or an address at one of your verified domains with no matching account.

## How do you add a Gmail routing rule?

You need the **Gmail Settings** administrator privilege. Google documents these settings in the Admin console; changes are recorded in the Admin console audit log.

1. In the Google Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Routing**.
2. Leave the top organizational unit selected to apply the rule to everyone, or select a child unit.
3. On the **Routing** tab, click **Configure**, or **Add Another Rule** if rules already exist.
4. Enter a descriptive name. Google says you can't save a setting without one.
5. Under **Select when this action is applied**, tick the message types: **Inbound messages**, **Outbound messages**, **Internal inbound messages**, **Internal outbound messages**.
6. Choose the action: **Modify message**, **Reject message** or **Quarantine message**.
7. Pick the modify options, then select **Show options** for account types, address lists and envelope filters.
8. Click **Save**. Google says changes "can take up to 24 hours but typically happen more quickly."

Google counts a domain as internal if it's a verified Workspace domain, or a subdomain or parent domain of one. For copies, catch-alls and split delivery, Google suggests ticking **Inbound messages**, **Internal outbound messages** or both.

## Which options does a routing rule have, and what are the defaults?

The modify options appear when you choose **Modify message**, and none is applied unless you select it. The table shows what Google says each one does ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/add-gmail-routing-settings)).

| Option | What it does | Default or caveat |
|---|---|---|
| Add X-Gm-Original-To header | Records the original envelope recipient when it changes | Off |
| Add X-Gm-Spam and X-Gm-Phishy headers | Tells a downstream server Gmail's spam and phishing verdict | Not available for Group or inactive account types |
| Add custom headers | Adds your own header, useful for tracing | Off |
| Prepend custom subject | Adds a prefix such as `[Confidential]` | Off |
| Change the route | Sends mail to a server added under **Hosts** | **Normal routing** is the only choice until you add a host |
| Also reroute spam | Routes spam-marked mail too | Off; Google says "blatant spam is dropped at delivery time" |
| Change envelope recipient | Replaces the address, the username or the domain | The original mailbox no longer gets the message |
| Bypass the spam filter for this message | Delivers inbound mail even if Gmail calls it spam | Inbound only; avoid it for security |
| Remove attachments from message | Strips attachments, with optional notice text | Off |
| Add more recipients | Delivers the message to extra addresses too | Off |
| Encryption (onward delivery only) | **Require secure transport (TLS)** | By default Gmail tries TLS and falls back to an unencrypted connection |

You also choose the account types a rule affects: **Active user account**, **Group account**, **All inactive and unrecognized accounts**, and archived accounts with an assigned delegate. Quarantine is only available for active user accounts.

### Address lists and envelope filters

Under **Show options** you can limit a rule with an address list (bypass or only apply for specific addresses or domains), or with envelope filters for specific senders or recipients: a single address, a regex pattern, or group membership. Address lists match the From: address, not Return-Path, and Google turns sender authentication on by default for each entry. Leave it on, or a forged From address inherits the exemption ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains)).

## Which Gmail routing rule wins when two rules match?

Gmail applies every matching routing setting, then settles conflicts. Google's rules are:

- **Reject wins.** Settings with a Reject action are "always assigned the highest priority," and once a message is rejected "no other routing or compliance rules are applied." Gmail adds an SMTP code such as `550 5.7.1` that you can't remove.
- **Conflicts go to the higher-priority rule.** If two settings conflict, Google Workspace "applies the setting with the higher priority and ignores the lower priority, conflicting setting."
- **Default routing is last.** Default routing settings have "a lower priority than other Gmail routing settings, including content and attachment compliance settings." Use **Reorder** to rank them, with 1 as the highest.

A conflict only arises when two rules would change the same thing, such as the route or the envelope recipient. Non-conflicting changes, like two different headers, are both applied. Google's [Working with Gmail admin settings](https://knowledge.workspace.google.com/admin/gmail/advanced/working-with-gmail-admin-settings-in-google-workspace) page also notes that **Change envelope recipient** combined with **Add more recipients** "implements the Bcc feature," while on its own "it forwards the message."

## How do you route mail to another server?

To deliver some mail somewhere other than Gmail, add the server first under **Gmail** > **Hosts** > **Add Route** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/add-mail-servers-for-gmail-email-routing)).

1. Name the route.
2. Choose **Single host** or **Multiple hosts**. For multiple hosts, fill the **Primary** and **Secondary** tables; the **Load %** in each table must total 100.
3. Enter a hostname (Google recommends this over an IP address) and a port: 25, 587, or 1024 to 65535. **Port 465 isn't supported.**
4. Leave the options marked **Recommended**, which are on by default for new routes: **Require mail to be transmitted over a secure transport (TLS) connection**, **Require CA signed certificate** and **Validate certificate hostname**. Tick **Perform MX lookup on host** only if you entered a domain rather than a server.
5. Click **Test TLS connection**, then **Save**.

If the test shows "Could not validate certificate", Google warns that routed messages "will bounce, even though you could save the new mail route." Fix the certificate or the hostname rather than unticking the TLS options. Our guide to [STARTTLS and email encryption in transit](https://iblockspam.com/blog/starttls-email-encryption-in-transit) explains what those checks protect.

Then reference the route in a rule with **Change the route**. When the downstream server runs its own filtering, also tick **Add X-Gm-Spam and X-Gm-Phishy headers** so it can act on Gmail's verdict.

## Which routing rules help email security?

Three rules worth considering, as examples to test on a small unit first:

1. **Reject mail to addresses that don't exist.** In **Default routing**, set **All recipients**, action **Reject message**, and choose **Perform this action only on non-recognized addresses**. Dictionary spam to made-up addresses is refused instead of piling up in a catch-all. Our guide to [catch-all addresses and spam](https://iblockspam.com/blog/catch-all-email-address-spam) explains the trade-off. Check first that no real alias depends on catch-all delivery.
2. **Tag rerouted mail with Gmail's verdict.** On any **Change the route** rule, add the X-Gm-Spam and X-Gm-Phishy headers, plus a custom header naming the rule, for example (illustrative):

   ```
   X-Gm-Original-To: sales@example.com
   X-Routing-Rule: sales-split-delivery
   ```

3. **Never grant spam bypass on a guessable condition.** **Bypass the spam filter for this message** delivers mail Gmail flagged as spam. If you must use it, pair it with an address list that keeps sender authentication on.

Routing also has a quieter risk: rules that copy mail elsewhere. Review **Add more recipients** and **Change envelope recipient** entries during audits, alongside users' own forwarding, which our guide to [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) covers. To stop users forwarding outside the domain at all, see [disabling automatic email forwarding in Google Workspace](https://iblockspam.com/blog/google-workspace-disable-automatic-email-forwarding).

## Why isn't my Gmail routing rule working?

Work through these causes, most likely first:

1. **Not enough time.** Wait up to 24 hours, then send a fresh test.
2. **Wrong organizational unit or account type.** A rule on a child OU doesn't reach users elsewhere. A Routing rule doesn't apply to suspended users or users with Gmail off; use Default routing for those.
3. **Wrong direction.** Mail between two of your users is **internal**, so a rule with only **Inbound messages** ticked won't touch it.
4. **Your own mail isn't authenticated.** Google says routing rules apply to messages from outside Gmail "that your domain authenticates with SPF or DKIM," and if they fail, "Gmail treats the message as external." Check with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DKIM Checker](https://iblockspam.com/tools/dkim-checker). Devices that send as your domain should use the [Google Workspace SMTP relay service](https://iblockspam.com/blog/google-workspace-smtp-relay-service).
5. **A reject or higher-priority rule won.** Look for a reject in any compliance or routing setting.
6. **Matching on the header instead of the envelope.** Envelope filters see the SMTP recipient, not the To: line.

To see what happened, trace the message in [Email Log Search](https://iblockspam.com/blog/google-workspace-email-log-search), then open the delivered copy's headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and look for your custom header.

## Next steps

- List every rule under **Routing** and **Default routing** and note which ones bypass spam or copy mail elsewhere.
- Add a custom header to each rule so you can tell which one fired.
- Confirm your MX records still point where you expect with the [MX Lookup](https://iblockspam.com/tools/mx-lookup).
- If you want filtering before mail reaches Gmail, our [Google Workspace platform page](https://iblockspam.com/platforms/google-workspace) explains how iBlockSpam sits in front of it as an inbound gateway.

See all [spam filter setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### What is the difference between Routing and Default routing in Gmail?

Default routing matches envelope recipients and sets the baseline delivery for your whole organization, such as dual delivery or a catch-all. Routing adds specialized rules per organizational unit, for inbound, outbound or internal mail, and can override Default routing. Google lists Default routing as lower priority than other Gmail routing and compliance settings.

### Why does my Gmail routing rule not apply to a suspended user?

Google says Routing rules apply only to active users with Gmail turned on. Suspended users and users with Gmail turned off are skipped. To control mail for those addresses, use Default routing, which can act on non-recognized addresses, including suspended users and addresses at your domain with no matching account.

### Can a Gmail routing rule send a copy of every message to another mailbox?

Yes. Create a Routing rule for inbound and internal inbound messages, choose Modify message, and use Add more recipients with the other mailbox. Google notes that Change envelope recipient combined with Add more recipients works like Bcc, while Change envelope recipient alone forwards the message instead of delivering it.

### Which ports can a Gmail mail route use?

When you add a mail route under Gmail > Hosts, Google accepts port 25, 587 or any port from 1024 to 65535. Port 465 isn't supported. Enter a hostname rather than an IP address where you can, and use Test TLS connection before saving, because a certificate error makes routed mail bounce.

### How long do Gmail routing changes take to work?

Google says routing changes can take up to 24 hours, though they usually apply sooner. Test on a small organizational unit, add a custom header to the rule so you can see when it fires, and follow the change in the Admin console audit log before rolling it out to everyone.

## Sources

- [Google Workspace Admin Help: Add Gmail routing settings](https://knowledge.workspace.google.com/admin/gmail/advanced/add-gmail-routing-settings)
- [Google Workspace Admin Help: Set up Default routing for your organization](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-default-routing-for-your-organization)
- [Google Workspace Admin Help: Add mail servers for Gmail email routing](https://knowledge.workspace.google.com/admin/gmail/advanced/add-mail-servers-for-gmail-email-routing)
- [Google Workspace Admin Help: Working with Gmail admin settings in Google Workspace](https://knowledge.workspace.google.com/admin/gmail/advanced/working-with-gmail-admin-settings-in-google-workspace)
- [Google Workspace Admin Help: Use address lists to apply settings to specific people or domains](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/gmail-routing-rules-google-workspace (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt