How do you block a sender or domain for everyone in Google Workspace?

When the same scammer, harassing sender or junk domain keeps reaching your users, a Google Workspace admin can block it for everyone at once. The Blocked senders setting rejects mail from addresses or domains you list, and it sits on top of Gmail's normal spam and malware filtering. This guide covers the exact steps, how Gmail decides a message matches, the gaps an attacker can slip through, and when another tool does the job better.

If you need the opposite, see our guide to Google Workspace approved senders. For Microsoft 365, read how to block a sender or domain in Microsoft 365. Menu names were checked against Google's Admin Help at the time of writing (November 2026).

What does the Blocked senders setting do?

The Blocked senders setting makes Gmail automatically reject messages from the email addresses or domains you list, across your organization. Google says it helps "prevent spam and malicious email by blocking email addresses or entire domains," and that "your blocks are in addition to the regular virus and spam protection provided to your organization through Gmail" (Google Workspace Admin Help).

A rejected message never reaches anyone's inbox or Spam folder. The sender receives a rejection notice, which you can customize. That makes the setting a good fit for senders you never want to hear from, and a poor fit for anything you might later need to review.

Google calls the general concept an email denylist: "a list of email addresses you block from sending mail to your organization or domain" (Allowlists, denylists, and approved senders).

How do you block a sender or domain in Google Workspace, step by step?

You block a sender by adding a Blocked senders rule under Spam, Phishing and Malware and putting the address or domain in a blocked list. You need the Gmail Settings administrator privilege.

1. In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Spam, Phishing and Malware.
2. Google's steps don't mention organizational units. To be sure the block covers everyone, select the top-level organization on the left.
3. Scroll to Blocked senders. Click Configure for your first rule, Edit to change one, or Add another rule.
4. Enter a name or description, such as Block - invoice fraud domains, Nov 2026.
5. Under Block senders, click Use existing list and pick a list, or click Create or edit list > Add Blocked list. Add the addresses or domains, click Save, then return to the original tab.
6. Optional: under Edit the default rejection notice, enter your own text. Blocked senders see it when their message is rejected.
7. Optional: tick Bypass this setting for messages received from addresses or domains within these approved senders lists and choose a list of exceptions.
8. Click Save.

Google says changes "can take up to 24 hours but typically happen more quickly," and they're tracked in the Admin console audit log. For many entries, Google suggests putting them in an address list and uploading it. Bulk add addresses accepts comma-separated entries.

A short, factual rejection notice works well. For example:

Your message was rejected by the recipient organization's email policy.
If you believe this is an error, contact the person you were writing to by phone.

Avoid anything that confirms which mailbox exists or reveals internal contacts.

What can you put in a blocked senders list?

You can add full email addresses and domains. Google's address list rules apply, because a Blocked senders list is "a type of address list that's only available in the Blocked senders setting" (address lists help).

Google's recommended limits are 2,000 address lists and 100,000 addresses per list for approved and blocked senders, with all Gmail settings combined kept under 5 MB (Gmail settings size limits).

How does Gmail decide a message matches the blocked list?

Gmail compares the From: address in the message, not the envelope sender. Google says that for incoming mail "Gmail checks if the From: sender address matches any addresses or domains in the address lists" and "doesn't use the Return-Path: address for address list matching."

Before comparing, Gmail removes periods and plus signs from the username, strips subdomains and lowercases everything. Blocking fraud.example therefore also blocks billing@pay.fraud.example. Blocking j.smith@fraud.example also blocks jsmith+1@fraud.example.

Address list entries also carry a Require sender authentication option, which Google turns on by default. With it on, Google says "a sender matches an address list only if their message is authenticated." Google documents this for address lists in general rather than for blocking specifically, so check the option on each blocked entry. A real attacker domain usually authenticates its own mail, so the block should still apply, but Google doesn't document this case explicitly. If you need to stop forged mail that merely claims a domain, the right tool is DMARC enforcement and Gmail's spoofing and authentication protection, not a blocked list.

Why do blocked emails still get through?

Blocked mail usually gets through for one of these reasons:

1. The attacker changed address. Phishing crews rotate domains and free mailbox accounts constantly. A block on yesterday's domain does nothing against today's. That's the biggest limit of any sender block.
2. It came through a Google Group. Google warns that "messages from blocked senders or domains might still reach users in Google Groups," depending on each user's group notification or email settings.
3. An exemption matched. The rule's approved senders bypass list includes the address or its domain.
4. The From address differs from what you blocked. The display name looks the same, but the address is new. Compare the actual address in the headers with our Email Header Analyzer.
5. The rule isn't live yet, or you saved it on a child organizational unit that doesn't include the recipient.
6. The sender's address is a lookalike. rnicrosoft.example isn't microsoft.example. Our lookalike domain phishing guide and the Lookalike Domain Generator help you find the variants worth blocking ahead of time.

How do you block by IP address, subject or other criteria?

Use a content compliance rule when you need to block on anything other than the From address. Gmail's content compliance setting (under Apps > Google Workspace > Gmail > Compliance) can match on a Source IP range, the Envelope sender, headers, the body and more, and its Reject message action "rejects the message before reaching the recipient" (Google Workspace Admin Help).

Google notes that for rejected messages "no other routing or compliance rules are applied," and that Gmail automatically adds an SMTP rejection code "such as 550 5.7.1" that you can't remove. Our page on the 550 5.7.1 error explains what the sender sees.

Our content compliance rules guide has worked examples, including rule order and testing.

Should you block the sender or quarantine the message?

Reject when you're certain the sender has nothing you'll ever want, such as a confirmed fraud domain or an abusive sender. Quarantine when you might be wrong. A rejected message is gone, so if you block a supplier domain by mistake, you can't recover the invoices you missed.

Before you block, also consider who loses information. A rejection tells the sender their message failed, so a determined attacker knows to switch to a new address. A quarantine via content compliance keeps a copy that an admin can review in the Gmail admin quarantine.

How do you unblock a sender in Google Workspace?

You unblock a sender by removing the entry from the blocked list, or by exempting it, and saving. Go back to Spam, Phishing and Malware > Blocked senders, click Edit next to the rule, open the list with Create or edit list, point to the address or domain and click Delete, then save. To keep the entry but let one address through, add that address to the rule's Bypass this setting for messages received from addresses or domains within these approved senders lists option instead.

Allow for the same delay as when you blocked it: Google says changes "can take up to 24 hours." Mail rejected in the meantime isn't held anywhere, so ask the sender to resend once the change is live.

If you reuse ordinary address lists in more than one setting, edit carefully. Google notes that "changes you make to an address list affect all settings that use that list." Giving blocked senders their own dedicated list avoids surprises, and the audit log shows who changed what and when.

How do users block senders themselves?

Users can block a sender for their own mailbox only. In Gmail on a computer, they open the message, click More next to Reply, and choose Block "sender". Google says that "after you block the sender, all future emails from them go to Spam" (Gmail Help). They review or undo blocks under Settings > See all settings > Filters and Blocked Addresses.

User blocks are useful for unwanted newsletters and personal nuisances, but they don't protect anyone else. For phishing, ask users to click Report phishing instead, so the report reaches Google and your admin alerts. Our guide to Google Workspace user-reported phishing covers what admins see.

What should you do after blocking a phishing sender?

Blocking stops future mail, not the copies already delivered. Work through this checklist:

1. Find every copy that was delivered. With Enterprise Plus, Frontline Plus or Education Plus, use the security investigation tool; otherwise use Email Log Search to list recipients.
2. Remove or quarantine those copies, and check who clicked a link or opened an attachment.
3. Treat anyone who entered a password as compromised: reset it and sign them out of every session.
4. Add the block, with a dated description so you know why it exists.
5. Watch for the Spike in user-reported spam and User-reported phishing alerts. Google's alert details page points from both to blocking the sender.
6. Review the blocked list every quarter and remove entries that no longer matter, so it stays readable.

Next steps

• Add your first Blocked senders rule at the top-level organization and write a short, neutral rejection notice.
• Use content compliance for IP-based or envelope-based blocks, and quarantine rather than reject when you're unsure.
• Check Google Groups delivery settings, since blocked senders can still reach group members.
• If you want one block list that applies before mail reaches Gmail, iBlockSpam's allow and block lists filter at the MX level for Google Workspace, alongside geographic and attachment filters.