# How do you set up advanced phishing and malware protection in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Setup guides
Author: iBlockSpam Team

> What each Gmail Safety setting in Google Workspace does, how warning, spam and quarantine actions affect users, and which editions get Security Sandbox.

## Short answer

In the Admin console, go to Apps > Google Workspace > Gmail > Safety. Turn on the Attachments, Links and external images, and Spoofing and authentication protections, tick Apply future recommended settings automatically, and choose an action for each: warning, move to spam or quarantine. Security Sandbox and Enhanced Safe Browsing, on Spam, Phishing and Malware, need specific editions.

Gmail filters every Google Workspace mailbox, but its strongest anti-phishing checks are opt-in. They sit on the **Safety** page of the Admin console, and most organizations have never opened it. This guide goes setting by setting: what each one catches, what each action does to the user, and which add-on protections depend on your edition.

For the rest of Gmail's spam controls, including approved senders, blocked senders and admin quarantine setup, see our companion guide to [Gmail spam settings in Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace). This guide doesn't repeat them.

## Where are the advanced phishing settings?

In the Google Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Safety**. You need the Gmail Settings administrator privilege. Google groups the protections into three sections ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)):

- **Attachments:** "Protection against suspicious attachments and scripts from untrusted senders."
- **Links and external images:** short URLs, linked images and warnings on clicks to untrusted domains.
- **Spoofing and authentication:** lookalike domains, employee names, your own domain and unauthenticated mail.

Two settings that people expect to find here live elsewhere. **Security Sandbox** and **Enhanced malware and phishing protection** (Enhanced Safe Browsing) are on **Gmail** > **Spam, Phishing and Malware**.

Every setting can be applied per organizational unit. Google says that by default Gmail "displays warnings, and moves untrustworthy emails to the spam folder," and that these settings help you "identify additional unwanted or harmful emails."

## What does each action do to the user?

Most Safety settings offer three actions. Google describes the user's experience of each:

| Action | Where the message goes | What the user sees |
| --- | --- | --- |
| **Keep email in inbox and show warning** (default) | Inbox | A warning banner; they can still open the message and attachments |
| **Move email to spam** | Spam folder | No banner; they can review it and mark it Not spam |
| **Quarantine** | Admin quarantine | Nothing at all until an admin selects Allow |

Three rules from Google's documentation change how you should choose:

1. **Banners only work in Gmail on the web.** "Warning banners (yellow box) appear only in Gmail web. Third-party apps do not display a warning banner." If your users read mail in Outlook, Apple Mail or another IMAP client, a warning action is close to no action. What each banner means is covered in [Gmail warning banners explained](https://iblockspam.com/blog/gmail-warning-banners-explained).
2. **Quarantine beats allowlists.** "Allowlist settings don't override the Quarantine option."
3. **Some spam options hide every banner.** If you use **Bypass spam filters and hide warnings** for selected senders or for all senders, "Gmail never displays warning banners" for those messages.

The quarantine you pick applies only to incoming mail. Before choosing it, make sure someone reviews the quarantine; [what is email quarantine](https://iblockspam.com/blog/what-is-email-quarantine) explains the trade-off.

## What do the attachment settings catch?

Google says it "scans all messages to protect against malware, whether or not attachment security settings are turned on." These settings add specific actions for risky file types from "senders with no prior Gmail history or with a low sender reputation."

| Setting | What it targets | Notes |
| --- | --- | --- |
| Protect against encrypted attachments from untrusted senders | Password-protected files that "can't be scanned for malware" | Expect some false positives from small suppliers who encrypt invoices |
| Protect against attachment with scripts from untrusted senders | Documents that contain malicious scripts | Like the setting above, applies to untrusted senders |
| Protect against anomalous attachment types in emails | "attachment file types that are uncommon for your domain" | Has an allowlist for rare types you genuinely receive, entered without a period, such as `arj, iqy, par` |

Use the anomalous-types allowlist sparingly. Every extension you add is one that attackers can use against you. Our list of [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) explains which file types are most abused.

## What do the link and image settings do?

| Setting | Effect |
| --- | --- |
| Identify links behind shortened URLs | Allows "discovery of harmful links hidden behind shortened URLs" |
| Scan linked images | Scans "images referenced by links to find hidden malicious content" |
| Show warning prompt for any click on links to untrusted domains | Warns on every click to an untrusted domain, not only in suspicious messages. Google notes it's "Not available for IMAP/POP email client" |

There are no per-setting actions here. They're on or off.

### IMAP link protection

If people use IMAP clients, the click warning above doesn't reach them. Google offers a separate option for that: on the **Safety** page, find **IMAP view time protections** and check **Enable IMAP link protection**. Google says it "checks links when the recipient clicks a message link, but before they're redirected to the link," and lists support for iOS Mail, Mac Mail, Microsoft Outlook and common Android clients ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/sync/protect-users-from-suspicious-links-in-imap-email-clients)).

### The image proxy

Gmail loads images through Google's proxy servers, which Google says "protects your users and domain against image-based security vulnerabilities." If internal images break, you can exempt specific internal URLs under **Gmail** > **End User Access** > **Image URL proxy allowlist**. Google's advice is to consult your security team first and says disabling the proxy "is not recommended" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-image-url-proxy-allowlist)).

## What do the spoofing and authentication settings catch?

These are the settings that matter most for business email compromise.

| Setting | What Google says it protects against |
| --- | --- |
| Domain spoofing based on similar domain names | Messages "from domains that appear visually similar to your company's domains or domain aliases" |
| Spoofing of employee names | Mail where "the sender's name is a name in your Google Workspace directory, but the email isn't from your company domain" |
| Inbound emails spoofing your domain | "Business Email Compromise (BEC) messages not authenticated with either SPF or DKIM, pretending to be from your domain" |
| Any unauthenticated emails | Messages not authenticated "(by any domain) with either SPF or DKIM (or both)" |
| Groups from inbound emails spoofing your domain | The same domain-spoofing check for Google Groups, for all groups or private groups only |

Google adds that unauthenticated emails "display a question mark next to the sender's name."

Two points are easy to miss:

- **"Spoofing your domain" depends on your own authentication.** If your own SaaS tools send as your domain without SPF or DKIM for it, this setting will flag them. Fix those senders before choosing quarantine. Our [SPF, DKIM and DMARC comparison](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) explains what each needs.
- **Employee-name spoofing catches the display name trick** that authentication can't stop, because the attacker's own domain often passes SPF and DKIM. See [display name spoofing](https://iblockspam.com/blog/display-name-spoofing) and [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## What does "Apply future recommended settings automatically" do?

Each section has this checkbox. Google says that "When we add new, recommended security settings" for that section, "those settings are turned on by default." It's the simplest way to keep up as Google adds protections.

The trade-off is control. A new setting can switch on without anyone reviewing its action. If you run a strict change process, leave it unticked and check the Safety page each quarter instead. For most small organizations, ticking it is the better default.

## Does your edition include Security Sandbox and Enhanced Safe Browsing?

These two protections are edition-dependent and off by default. At the time of writing (October 2026), Google lists:

| Feature | Editions Google lists | Where to turn it on |
| --- | --- | --- |
| [Security Sandbox](https://knowledge.workspace.google.com/admin/gmail/advanced/gmail-security-sandbox-overview) | Frontline Plus; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus | **Spam, Phishing and Malware** > **Security Sandbox** |
| [Gmail Enhanced Safe Browsing](https://knowledge.workspace.google.com/admin/gmail/advanced/turn-gmail-enhanced-safe-browsing-on-or-off) | Business Standard and Business Plus; Enterprise Standard and Enterprise Plus | **Spam, Phishing and Malware** > **Enhanced malware and phishing protection** |

### Security Sandbox

Security Sandbox opens attachments "in a secure, isolated environment" and watches for things like "attempts to modify system files, connections to suspicious servers, or malware downloads." It covers Microsoft executables, Office files and PDFs, including files inside zip or rar archives. Google says scanning "can delay message delivery by up to 3 minutes."

You can scan everything with **Enable virtual execution of attachments in a sandbox environment**, or leave that unchecked and write **Security sandbox rules** for specific senders, content or message types. When the checkbox is on, every attachment is scanned regardless of rules. Messages it flags go to the recipient's Spam folder; Google says you can quarantine them instead with a content compliance rule using the spam metadata attribute ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-to-detect-harmful-attachments)).

### Enhanced Safe Browsing for Gmail

With this on, "Gmail takes additional steps to check messages for harmful content before delivering messages to recipients." Users see the setting but can't change it. Google notes that if client-side encryption is on, that data "isn't available to Gmail Enhanced Safe Browsing."

## How should you roll these settings out?

1. **Fix your own authentication first.** Make sure every service that sends as your domain passes SPF or DKIM, using the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DKIM Checker](https://iblockspam.com/tools/dkim-checker).
2. **Create a pilot organizational unit** with IT staff and a few volunteers.
3. **Turn on all three Safety sections** for the pilot, with future recommended settings ticked.
4. **Choose actions.** Quarantine or spam for domain spoofing, employee-name spoofing and Groups spoofing. Warning for unauthenticated mail at first. Spam rather than warning wherever pilot users read mail outside Gmail on the web.
5. **Turn on Security Sandbox and Enhanced Safe Browsing** if your edition includes them.
6. **Wait and review.** Google says changes "can take up to 24 hours but typically happen more quickly." Review the quarantine and users' Spam folders after a week.
7. **Roll out** to the top-level organizational unit, keeping any exceptions in their own unit.

## What changes if a gateway filters mail before Gmail?

If your MX points to a filtering service in front of Gmail, configure the **Inbound gateway** setting with its IPs and **Automatically detect external IP**, so Gmail's checks see the real sender, not the gateway ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)). Without it, authentication-based settings judge the gateway's IP. The Safety settings still apply behind a gateway, so the gateway and Gmail act as two layers. Our [inbound gateway setup guide](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup) covers the steps.

## Next steps

1. Open **Gmail** > **Safety** today and note which settings are off and which actions are on default warnings.
2. Pilot the settings above on one organizational unit for a week.
3. Check your domain's SPF and DMARC with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), since "spoofing your domain" protection relies on them.
4. Inspect any flagged message with **Show original** and our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
5. If you're weighing an MX-level filter such as iBlockSpam in front of Gmail, read [Google Workspace built-in filtering vs a gateway](https://iblockspam.com/compare/google-workspace-built-in-vs-gateway).

See all [spam filter setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Is Gmail's advanced phishing and malware protection on by default?

Gmail scans every message for malware and moves untrustworthy mail to spam by default. The extra Safety settings are separate options you turn on in the Admin console, per organizational unit. When a setting is on and you don't choose an action, Google applies the default action, which keeps the message in the inbox with a warning.

### Do I need a particular Google Workspace edition to scan attachments in a sandbox?

At the time of writing (October 2026), Google lists Security Sandbox for Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus. Gmail Enhanced Safe Browsing is listed for Business Standard, Business Plus, Enterprise Standard and Enterprise Plus. Check Google's edition comparison for your plan.

### Do approved senders bypass Gmail's advanced phishing settings?

No. Google says these advanced security features work independently of other spam settings, so they still apply even if you've listed a domain as a safe sender. Allowlist settings also don't override the Quarantine action. Two spam options that hide warnings do suppress the warning banners, though.

### Should I choose quarantine or move to spam for spoofing?

Quarantine if someone in your team will review the admin quarantine regularly, because users never see quarantined messages. Move to spam if you want users to be able to find false positives themselves. For mail spoofing your own domain or your employees' names, either is better than the default warning.

### Do Gmail warning banners show in Outlook or Apple Mail?

No. Google says warning banners appear only in Gmail on the web, and third-party apps don't display them. For users on IMAP clients, choose spam or quarantine actions rather than warnings, and turn on IMAP link protection so links are checked when clicked.

## Sources

- [Google Workspace Admin Help: Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)
- [Google Workspace Admin Help: Gmail Security Sandbox overview](https://knowledge.workspace.google.com/admin/gmail/advanced/gmail-security-sandbox-overview)
- [Google Workspace Admin Help: Set up rules to detect harmful attachments](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-to-detect-harmful-attachments)
- [Google Workspace Admin Help: Turn Gmail Enhanced Safe Browsing on or off](https://knowledge.workspace.google.com/admin/gmail/advanced/turn-gmail-enhanced-safe-browsing-on-or-off)
- [Google Workspace Admin Help: Protect users from suspicious links in IMAP email clients](https://knowledge.workspace.google.com/admin/sync/protect-users-from-suspicious-links-in-imap-email-clients)
- [Google Workspace Admin Help: Set up an image URL proxy allowlist](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-image-url-proxy-allowlist)
- [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt