Setup guides

How do you configure Gmail spam and phishing settings in Google Workspace?

By iBlockSpam Team How we check our guides Updated Oct 9, 2026 9 min read 8 sources

Short answer

Gmail always scans for spam, but admins can tune it under Apps > Google Workspace > Gmail. Turn on the Safety settings for attachments, links and spoofing, choose spam or quarantine actions, keep approved senders lists small with sender authentication required, and send suspect mail to admin quarantine for review. Users train the filter with Report spam and Not spam.

On this page 9 sections

Gmail filters spam for every Google Workspace account out of the box, and most organizations never open the settings that control it. That's a missed opportunity, because some of the most useful protections, such as spoofing checks on your own domain and employee names, can be tightened in a few minutes.

This guide walks through each setting in the Admin console, what it does, and where it can backfire.

Where are the Gmail spam settings in the Admin console?

Google splits the controls across three pages, all under Menu > Apps > Google Workspace > Gmail:

Page	What's there
Safety	Attachments, Links and external images, Spoofing and authentication
Spam, Phishing and Malware	Spam, Blocked senders, Email allowlist, Inbound gateway
Manage quarantines	Quarantine setup and the link to the quarantine dashboard

You need the Gmail Settings administrator privilege for these pages, and Google says you "must be signed in as a super administrator to set up an email quarantine" (Google Workspace Admin Help). Settings apply per organizational unit, so select the right one on the left first. Google says changes "can take up to 24 hours but typically happen more quickly" (Google Workspace Admin Help).

Which Gmail safety settings should you turn on?

The Safety page holds Google's advanced phishing and malware protection. By default, Gmail "displays warnings, and moves untrustworthy emails to the spam folder." These settings catch more (Google Workspace Admin Help).

Attachments

Protect against encrypted attachments from untrusted senders
Protect against attachment with scripts from untrusted senders
Protect against anomalous attachment types in emails, with an allowlist for uncommon file types you genuinely receive

Links and external images

Identify links behind shortened URLs
Scan linked images
Show warning prompt for any click on links to untrusted domains

Spoofing and authentication

Protect against domain spoofing based on similar domain names
Protect against spoofing of employee names
Protect against inbound emails spoofing your domain
Protect against any unauthenticated emails
Protect Groups from inbound emails spoofing your domain

Each spoofing and attachment setting has three actions: Keep email in inbox and show warning (the default), Move email to spam, or Quarantine. In each section you can also tick Apply future recommended settings automatically.

How we'd set them

Turn on every option in all three sections.
Tick Apply future recommended settings automatically in each section.
For inbound emails spoofing your domain and spoofing of employee names, choose Move email to spam or Quarantine rather than a warning. These are the classic business email compromise patterns.
Leave any unauthenticated emails on the warning action at first. Some legitimate small senders still don't authenticate, and the warning banner is a useful nudge.
Review the effect after a week and tighten actions where users ignore warnings.

Two caveats from Google: warning banners appear only in Gmail on the web, and third-party apps don't show them (what each Gmail warning means). And when you choose Quarantine for a safety setting, "Allowlist settings don't override the Quarantine option."

How do you customize Gmail spam filtering?

Gmail always scans for spam, and Google says "You can't turn off Gmail's spam scanning." What you can change is how it behaves, under Spam, Phishing and Malware > Spam > Configure (Google Workspace Admin Help):

Option	What it does	Our view
Be more aggressive when filtering spam	More mail is marked as spam	Useful for heavily targeted teams
Put spam in administrative quarantine	Spam goes to quarantine instead of users' Spam folders	Good if you want central review
Bypass spam filters for internal senders	Internal mail skips spam filters	Usually fine
Bypass spam filters for messages from senders or domains in selected lists	Approved senders skip spam filters	Use small lists with authentication on
Bypass spam filters and hide warnings for messages from senders or domains in selected lists	As above, and no warning banners	Avoid
Bypass spam filters and hide warnings for all messages from internal and external senders	All incoming mail skips spam filters, with no warnings	Google doesn't recommend it

Some of these options apply to the whole organizational unit and override other spam settings that have them turned off, so check every rule in the Spam table when you troubleshoot.

How do approved senders lists work, and how do you keep them safe?

An approved senders list is an address list used by the Spam setting. You build address lists under Gmail > Routing > Manage address lists (Google Workspace Admin Help).

Three details matter:

Gmail matches the From address, not the Return-Path. The From address is exactly what a spoofer controls.
Require sender authentication is on by default for new entries, and Google says "We recommend you always leave the sender authentication option on." With it on, a sender matches the list only if the message is authenticated, so a forged From address doesn't qualify. Google checks for an SPF pass with a matching Return-Path, or a valid DKIM signature for the From domain.
Domains cover everyone at that domain, including any compromised account. Prefer individual addresses.

Even approved senders don't get a free pass on everything. Gmail still blocks messages from them that contain a virus or are part of a larger attack, and shows a banner saying the message "wasn't sent to Spam because of your organization's settings." Google's advice for senders who keep landing in spam is to ask them to set up DMARC. Our guide to whitelisting a sender safely compares this with Microsoft 365.

The IP allowlist

The Email allowlist setting lets you list sending IP addresses that Gmail won't mark as spam. It applies to your whole domain, not to organizational units, and an IP that's also in your inbound gateway setting can't be added to the allowlist (Google Workspace Admin Help). Use it rarely, and never for shared sending platforms.

Blocked senders

Spam, Phishing and Malware > Blocked senders rejects mail from addresses or domains you list, with an optional custom rejection notice. Blocked senders are in addition to Gmail's normal protection.

How does admin quarantine work in Google Workspace?

Email quarantine is part of the Google Workspace Moderation Tool. Your account comes with a default quarantine, and super admins can add custom ones (Google Workspace Admin Help).

To set up and use it:

Sign in as a super administrator, go to Gmail > Manage quarantines and select Add Quarantine for a custom quarantine. Give it a name, optionally a reviewers group, and choose the inbound denial consequence: Drop message or Send the default reject message.
Optionally tick Notify periodically when messages are quarantined. Google sends these to super admins only, at most once an hour.
Point a setting at it, such as Put spam in administrative quarantine or a Safety setting with the Quarantine action.
Review messages in the dashboard: Manage quarantines > Go to Quarantine, or admin.google.com/ac/moderation (Google Workspace Admin Help).
Expand a message and select Show Original to read its full headers before deciding.
Select Allow to deliver or Deny to block. You can't undo either action.

Know the limits. Recipients are never told their mail was quarantined. Messages are deleted 30 days after sending if nobody acts. Messages sent to Groups can't be quarantined. And a message you release from spam quarantine "is checked against Gmail spam filters again," so it may land in the user's Spam folder. That makes Gmail's quarantine a tool for admins, not a self-service inbox for users.

What changes if mail arrives through an inbound gateway?

If your MX records point to a filtering service in front of Gmail, add its public IPs to Spam, Phishing and Malware > Inbound gateway (Google Workspace Admin Help).

Turn on Automatically detect external IP so Gmail finds the real sending IP in the Received: headers for SPF and spam checks.
Turn on Reject all mail not from gateway IPs once MX has moved, so nobody bypasses the gateway.
Google states that Gmail "does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway." Your gateway should enforce DMARC instead.
Message tagging lets Gmail treat gateway spam headers as spam. Think twice before ticking Disable Gmail spam evaluation on mail from this gateway; only use header value, which removes Gmail's own judgment.

Our inbound gateway setup guide covers the steps in full.

How can you see why Gmail put a message in spam?

Gmail shows a warning at the top of each message in Spam explaining why it was filed there (Gmail Help). For the details, open the message, select More > Show original and copy the headers into our Email Header Analyzer. Google's own troubleshooting advice is that headers "contain the results for SPF, DKIM, and DMARC" (Google Workspace Admin Help).

Look for:

SPF, DKIM or DMARC failures for the From domain.
A DKIM signature for a different domain than the From address, which means DMARC can't align.
A gateway IP where you'd expect the real sender, if the inbound gateway isn't set up.

What can users do about spam in Gmail?

Google recommends users manage their own spam in Gmail on the web or the mobile apps:

Report spam on unwanted mail. Gmail gets better at catching similar messages.
Not spam on good mail in the Spam folder. Future mail from that sender won't go to Spam.
Add trusted senders to Google Contacts, or create a filter for them.
Report anything that looks like an impersonation as phishing, not just spam.

Users can't change your admin settings, so if wanted mail keeps landing in Spam for many people, that's your cue to investigate.

Next steps

Open Gmail > Safety and turn on all three sections with future recommended settings.
Audit every rule in the Spam setting, and confirm sender authentication is on for every approved senders entry.
Decide whether you want admin quarantine for spam, and who reviews it.
Check your own domain's SPF and DMARC with our SPF Checker and DMARC Checker, and see our Google Workspace SPF record page.
If you're weighing a gateway in front of Gmail, read Google Workspace built-in filtering vs a gateway and our Google Workspace setup page.

See all spam filter setup guides.

Frequently asked questions

Can you turn off Gmail spam filtering in Google Workspace?

No. Google says Gmail scans all messages for spam and you can't turn that off. You can only customize it, for example with approved senders lists, internal sender bypass or admin quarantine. The option to bypass spam filters for all senders exists, but Google doesn't recommend it.

Where are the Gmail safety settings in the Google Admin console?

Go to Menu > Apps > Google Workspace > Gmail > Safety. The page has sections for Attachments, Links and external images, and Spoofing and authentication. Spam settings, Blocked senders, the Email allowlist and the Inbound gateway setting are under Gmail > Spam, Phishing and Malware.

Do approved senders skip Gmail's phishing and malware checks?

No. Google says the advanced phishing and malware settings still apply even if you've listed a domain as a safe sender, and allowlists don't override a Quarantine action. Messages with viruses or that are part of a larger attack are still blocked for approved senders.

How long do Gmail admin setting changes take to apply?

Google says changes to Gmail settings in the Admin console can take up to 24 hours, though they typically apply more quickly. Test with a fresh message after the change, and check the Admin console audit log to confirm who changed what and when.

What can Google Workspace users do about spam themselves?

Users can select Report spam on unwanted mail and Not spam on mail wrongly filtered. Both train Gmail's filtering for similar messages. Adding a sender to Google Contacts or creating a filter also helps keep their mail out of Spam. Users should report anything suspicious as phishing.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading