# How do you use Gmail content compliance rules to improve email security in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-content-compliance-rules
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Setup guides
Author: iBlockSpam Team

> Use Gmail content compliance, objectionable content and attachment compliance rules for security: expressions, actions, rule order and three worked examples.

## Short answer

In the Admin console, go to Apps > Google Workspace > Gmail > Compliance. Content compliance matches text, regex, metadata or predefined detectors; attachment compliance matches file type, name or size; objectionable content matches a word list. Each rule can modify, reject or quarantine the message. A reject from any rule wins over every other action.

Gmail's built-in filtering catches most spam and malware without any configuration. Compliance rules are how you add your own judgment on top: quarantine the patterns that hurt your business, tag what deserves a second look, and reject what you never want. They live under one page in the Admin console and share a common rule format, which makes them flexible and easy to get wrong.

This guide covers the three rule types, how Gmail evaluates them together, and three security rules worth copying. For Gmail's own phishing and spoofing protections, see our [advanced phishing and malware protection guide](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection) first. Those settings should be on before you write custom rules.

## Where are the compliance settings?

In the Google Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Compliance**. You need the **Gmail Settings** administrator privilege ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)). Select an organizational unit on the left if the rule shouldn't apply to everyone, then hover over a setting and select **Configure**, or **Edit** or **Add another** if rules already exist.

Three settings on that page do the security work:

| Setting | Matches on | Best for |
|---|---|---|
| **Content compliance** | Text, regex, headers, metadata (authentication, source IP, TLS, size), predefined detectors | Most security rules |
| **Attachment compliance** | File type (detected by content, not just extension), file name, message size, encrypted attachments | Risky file types |
| **Objectionable content** | A list of whole words in the subject, body and text attachments | Simple keyword rules |

Each rule gets a unique description, a choice of messages to affect, up to 10 expressions, and one action.

## How do content compliance expressions work?

### Messages to affect

You can apply a rule to inbound, outbound or internal messages. Google counts a domain as internal if it's a verified Workspace domain, or a subdomain or parent domain of one ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)). For security rules on incoming mail, tick **Inbound** only, so you don't trip on your own staff's messages.

### Match types

Choose whether **any** or **all** of the expressions must match (Google's page shows the "If ANY of the following match the message" option), then add expressions:

- **Simple content match** works like Gmail search, so loose phrases match more than you'd expect.
- **Advanced content match** picks a location and a match type. Locations include **Headers and body**, **Full headers**, **Body**, **Subject**, **Sender header**, **Recipients header**, **Envelope sender**, **Any envelope recipient** and **Raw message**. Match types include **Contains text**, **Equals**, **Matches regex**, **Not matches regex**, **Matches any word** and **Matches all words**.
- **Metadata match** checks properties rather than text: **Message authentication**, **Source IP**, **Secure transport (TLS)**, S/MIME status, **Message size**, **Gmail confidential mode**, and, in editions with Security Sandbox, malware detected by the sandbox.
- **Predefined content match** uses Google's detectors, such as US credit card or Social Security numbers, with an optional count and confidence threshold. It isn't available in every edition.

Google defines "authenticated" for metadata matching in DMARC terms: the message passes SPF with the envelope sender aligned to the From domain, or passes DKIM for the From domain. That's a useful building block, because it lets a rule react to spoofing.

### Regex tips

Regex uses Google's RE2 syntax, and each expression is limited to 10,000 characters. Two details from Google's documentation catch people out:

- **Full headers** are checked one header field at a time, so one regex can't span the To: and Cc: fields.
- For content filtering, Gmail removes dots and plus signs from usernames, so `jane.doe@` in a rule may never match.

Add `(?i)` at the start of a pattern to make it case-insensitive. In RE2, `.` doesn't match a line break unless you also add the `s` flag, as in `(?is)`, which matters when a phrase wraps across lines.

### What gets scanned

Content compliance scans text attachments and common types such as .docx, .xlsx and .pdf, and "any rule that applies to the message body text also applies to the extracted text" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)). Google's [attachment compliance page](https://knowledge.workspace.google.com/admin/gmail/advanced/filter-messages-with-attachments) sets the limits: content filters scan up to 1 MB of converted content, Gmail "doesn't convert or scan files that are larger than 10MB," and it can't open password-protected files or archives. Google also warns that "there might be false positives and negatives." Treat rules as a useful layer, not a guarantee.

## Which actions can a rule take?

| Action | What happens | Notes |
|---|---|---|
| **Modify message** | Delivered with changes | Add headers, prepend a custom subject, remove attachments, change route or envelope recipient, add recipients, require TLS, encrypt with S/MIME (some editions) |
| **Reject message** | Refused before delivery | Optional custom rejection text; Gmail adds an SMTP code such as 550 5.7.1, and no other routing or compliance rules apply |
| **Quarantine message** | Held in an admin quarantine | Only for the **Users** account type; pick the default or a custom quarantine |

Avoid one modify option: **Bypass spam filter for this message**. It delivers incoming mail even when Gmail says it's spam. Attackers love any rule that grants a bypass based on text they can write.

For quarantine actions, create a custom quarantine first so each rule's catches land somewhere meaningful. Our [Gmail admin quarantine guide](https://iblockspam.com/blog/google-workspace-admin-quarantine) covers setting them up and reviewing them.

## In what order does Gmail evaluate rules?

Gmail doesn't run rules one after another and stop at the first match. Google describes this process ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/working-with-gmail-admin-settings-in-google-workspace)):

1. Gmail "evaluates the message against all policies independently" and builds a list of consequences.
2. "If there are any reject consequences, Gmail rejects the message and ignores the other consequences."
3. Otherwise, Gmail checks for conflicts. These only arise when two consequences would change the primary route or the primary envelope recipient.
4. Conflicts are settled by specificity ("locally applied settings take precedence over inherited ones"), then by age ("older settings take precedence over newer ones").
5. All non-conflicting consequences are applied together. Two different subject prefixes are both added.

Google adds that "there's no strictly defined ordering of conflicting rules between different sections." When a message matches several quarantine rules, the [quarantine documentation](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine) says it's sent to all the quarantines those rules name.

The practical upshot: you can't build an "allow first, then block" chain. To exempt a sender, use the rule's own **Show options** > address list bypass, which Google says bypasses the setting entirely on a match. Keep **Authentication required** on for those entries, or a forged From address gets the exemption too.

## Three security rules worth adding

These three rules are our own examples, not Google templates. Treat each pattern as a starting point to test on a small organizational unit, as described below, before you quarantine real mail.

### 1. Quarantine invoices that announce changed bank details

Payment redirection is one of the costliest email frauds, and the messages often contain no link or attachment for filters to catch. See our guide to [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

1. Create a custom quarantine named **Payment change review**, with your finance lead's group as reviewers.
2. Add a **Content compliance** rule. Description: `Inbound: changed bank details`. Messages to affect: **Inbound**.
3. Set the rule so that **all** expressions must match and add two expressions:
   - **Advanced content match**, location **Body**, **Matches regex**: `(?is)\b(new|updated|changed|different)\b.{0,40}\b(bank|banking|account|remittance|payment)\b.{0,20}\b(details|information|account)\b`
   - **Advanced content match**, location **Headers and body**, **Matches any word**: `invoice remittance payment wire IBAN`
4. Action: **Quarantine message**, pointing at **Payment change review**.
5. Under **Show options**, add an address list of the few suppliers who legitimately send these notices, set to bypass, with authentication required.

Because body rules also apply to text extracted from attachments, this catches the wording inside a PDF invoice too. Expect some legitimate matches. That's the point: a finance person reviews them and confirms changes by phone, using a number already on file.

### 2. Quarantine risky attachment types that Gmail still allows

Gmail already blocks executables and scripts such as .exe, .js, .vbs, .ps1, .iso and .lnk, including inside archives ([Gmail Help](https://support.google.com/mail/answer/6590)), and Google says file types "detected to be executables are automatically rejected." Your rule should target the next tier: formats attackers use to carry links and smuggle payloads past those blocks. Our guides to [dangerous attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) and [HTML smuggling](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling) explain why.

1. Add an **Attachment compliance** rule. Messages to affect: **Inbound**.
2. Choose **If ANY of the following match the message**, add an expression of type **File type**, and enter custom file types such as `html, htm, shtml, svg`. Tick **Also match files based on file format** so renamed files are caught too. Google matches extensions it doesn't list as supported, such as .htm, by file name only.
3. Action: **Quarantine message** to a quarantine named **Risky attachments**.

For the file types Google supports, Gmail can detect the type from the file's content, so renaming the extension doesn't help an attacker. Gmail also checks the names of files inside archives. It can't look inside password-protected archives, so consider a second expression that quarantines encrypted attachments from outside, if your business rarely receives them.

### 3. Tag or quarantine unauthenticated mail claiming to be from your domain

1. Add a **Content compliance** rule. Messages to affect: **Inbound**.
2. Set the rule so that **all** expressions must match and add:
   - **Advanced content match**, location **Sender header**, **Matches regex**: `(?i)@(example\.com|.+\.example\.com)$` (use your own domain)
   - **Metadata match**, attribute **Message authentication**, **Message is not authenticated**
3. Action: **Quarantine message**, or **Modify message** with **Prepend custom subject** set to `Unverified sender` while you test.

Gmail's Safety page already offers **Protect against inbound emails spoofing your domain**, so turn that on first. This rule gives you your own quarantine and wording for the same pattern, and the regex covers your subdomains too. Make sure your own SPF, DKIM and DMARC are right before you quarantine, or your own third-party senders will land there. Check them with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

### A note on tagging all external mail

A content compliance rule can prepend a subject tag such as `[External]` to every inbound message. It works, but subject tags clutter threads and users stop noticing them. Gmail already shows warning banners for many risky situations, which our [Gmail warning banners guide](https://iblockspam.com/blog/gmail-warning-banners-explained) explains. Use a custom header instead if another system needs to know the message came from outside.

## How should you test a new rule?

1. Create the rule on a test organizational unit with one or two accounts.
2. Use **Modify message** with a custom header, such as `X-Rule-Test: payment-change`, instead of quarantine at first.
3. Send test messages from an outside account, then check the headers with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) or trace them with [Email Log Search](https://iblockspam.com/blog/google-workspace-email-log-search).
4. Allow up to 24 hours for changes to apply everywhere.
5. Switch to quarantine or reject only when a week of real traffic gives acceptable matches.

## What compliance rules can't do

Rules match patterns. They don't judge reputation, detonate links or learn from user reports, and they only see mail after it reaches Gmail. If your MX points to a filtering gateway in front of Google Workspace, attachment and content policies can run there first, and Gmail's rules add a second layer. Our [inbound gateway guide](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup) covers that setup, and our [Google Workspace platform page](https://iblockspam.com/platforms/google-workspace) explains how iBlockSpam, with its attachment-type filters and custom domain rules, sits in front of Gmail.

## Next steps

- Turn on the Safety settings in Gmail first, then add the bank-details and attachment rules above to a test organizational unit.
- Create custom quarantines so each rule's catches are easy to review.
- Review all existing compliance rules for any that use **Bypass spam filter for this message** or address lists without authentication.
- Revisit your [Gmail spam settings](https://iblockspam.com/blog/gmail-spam-settings-google-workspace) so approved senders and compliance exemptions don't overlap.

See all [spam filter setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### What is the difference between content compliance and objectionable content in Gmail?

Objectionable content matches a list of whole words in the subject, body and text attachments, without case sensitivity, and can't match strings or bracketed text. Content compliance is the advanced version: it supports exact strings, regular expressions, header locations, metadata such as authentication or source IP, and, in some editions, predefined detectors.

### Can Gmail content compliance rules scan attachments?

Yes. Google says content compliance scans text attachments and common types such as .docx, .xlsx and .pdf, and body rules also apply to text extracted from attachments. Content filters scan up to 1 MB of converted content, and files larger than 10 MB aren't converted or scanned. Password-protected files can't be inspected.

### Which wins if two Gmail compliance rules match the same message?

If any matching rule rejects the message, it's rejected and nothing else applies. Otherwise Gmail applies all non-conflicting actions together. Conflicts over the route or envelope recipient are settled by specificity, with a rule set on the organizational unit beating an inherited one, and then by age, with older rules winning.

### Does Gmail block .exe attachments without a rule?

Yes. Gmail blocks executable and script types such as .exe, .js, .vbs, .ps1, .iso and .lnk, including inside archives such as .zip. Google's attachment compliance page also says files detected to be executables are automatically rejected. Use attachment compliance rules for the risky types Gmail still allows.

### How long do Gmail compliance rule changes take to work?

Google says changes to Gmail settings can take up to 24 hours, though they usually apply sooner. Test a new rule on a small organizational unit first, send test messages from an outside account, and check the result in Email Log Search or the quarantine dashboard before rolling it out.

## Sources

- [Google Workspace Admin Help: Set up rules for advanced email content filtering](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)
- [Google Workspace Admin Help: Filter messages with attachments](https://knowledge.workspace.google.com/admin/gmail/advanced/filter-messages-with-attachments)
- [Google Workspace Admin Help: Control message delivery based on message content](https://knowledge.workspace.google.com/admin/gmail/advanced/control-message-delivery-based-on-message-content)
- [Google Workspace Admin Help: Working with Gmail admin settings (how multiple settings affect message behavior)](https://knowledge.workspace.google.com/admin/gmail/advanced/working-with-gmail-admin-settings-in-google-workspace)
- [Google Workspace Admin Help: Set up email quarantine](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine)
- [Gmail Help: File types blocked in Gmail](https://support.google.com/mail/answer/6590)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-content-compliance-rules (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt