How do you set up an approved senders (spam allowlist) list in Google Workspace?

An approved senders list tells Gmail to skip its spam filters for mail from addresses or domains you trust. It's the right fix for a supplier whose invoices keep landing in Spam, and the wrong fix for almost everything else, because a careless entry also lets phishing through. This guide covers exactly how Google Workspace matches senders, which bypass option to pick, and how to keep the list small.

For the side-by-side with Microsoft 365, read our guide to whitelisting a sender in Microsoft 365 and Google Workspace. For the wider tour of Gmail's spam, phishing and malware page, see Gmail spam settings in Google Workspace. Menu names here were checked against Google's Admin Help at the time of writing (November 2026).

What is an approved senders list in Google Workspace?

An approved senders list is an address list (a named set of email addresses and domains) that a Gmail Spam rule uses to let mail from those senders skip spam filtering. Google says "messages from these users bypass Gmail's spam filters, and recipients can decide whether they are spam or not" (Allowlists, denylists, and approved senders).

Two pieces work together. The address list lives under Routing and can be reused by other settings. The Spam rule lives under Spam, Phishing and Malware and decides what the list does. Neither does anything on its own.

Google Workspace has several things people call an allowlist. They behave differently:

How do you add an approved sender in Google Workspace, step by step?

You add an approved sender by building an address list with sender authentication on, then selecting that list in a Spam rule. Both steps need the Gmail Settings administrator privilege. The procedure below follows Google's address list and custom spam filter help pages.

1. In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Routing.
2. Click Manage address lists, then Add address list at the bottom of the table.
3. Name the list for its purpose, for example Approved senders - finance suppliers.
4. Click Add address for one entry or Bulk add addresses for several (comma-separated). Prefer full addresses such as billing@supplier.example over whole domains.
5. Leave Require sender authentication turned on for every entry, then click Save.
6. Go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware.
7. On the left, select the organizational unit that should get the exception. Selecting the top level applies it to everyone.
8. Scroll to Spam and click Configure (or Add another rule). Give the rule a unique name.
9. Tick Bypass spam filters for messages from senders or domains in selected lists, click Use existing list and select your list. Google warns that "you must select at least one address list, or this option has no effect."
10. Click Save and check that the rule appears in the Spam settings table.

Google says changes "can take up to 24 hours but typically happen more quickly", and every change is recorded in the Admin console audit log. Wait before you decide it hasn't worked.

How does Gmail match a sender against the list?

Gmail matches the From: address, the one users see in their inbox. Google's address list page is explicit: "Gmail doesn't use the Return-Path: address for address list matching." The Return-Path (also called the envelope sender) is the bounce address recorded during the SMTP conversation, and it often differs from the From address for mail sent through marketing or billing platforms.

Before matching, Gmail standardizes addresses. Google lists three rules:

• Periods and plus signs are removed from usernames.
• Subdomains are removed from email addresses.
• Addresses are converted to lowercase.

So admin@solarmora.com, a.d.m.i.n@solarmora.com, admin@support.solarmora.com and Admin@Solarmora.com all match the same entry, using Google's own example. Domain entries can be written as solarmora.com or @solarmora.com. Wildcards such as *@solarmora.com are accepted by the form but, in Google's words, "entering wildcard addresses has no effect".

Two consequences catch people out. A domain entry covers every subdomain too, so approving a company domain also approves anything sent from its marketing subdomain. And because Email Log Search shows the Return-Path rather than the From address, the sender you see in the log may not be the one Gmail compared. Our Email Log Search guide shows how to read those results.

What does "Require sender authentication" check?

Require sender authentication means a sender only matches the list if Gmail can prove the message really came from that sender's domain. It is on by default for new entries, and Google recommends "you always leave the sender authentication option on to help protect your domain from spoofing, spam, and other malicious attacks."

Google says Gmail checks that at least one of these is true:

• The message passes SPF and the From sender matches the Return-Path sender.
• The message has a valid DKIM signature, and the signing domain matches the From sender.

Google adds that "messages must pass DMARC to pass authentication." In practice that means the sender needs SPF or DKIM that aligns with the From domain. If you want to see what a real message shows, paste its headers into the Email Header Analyzer and look at the Authentication-Results line. An authenticated message from an example supplier would contain something like:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@supplier.example;
       spf=pass smtp.mailfrom=billing@supplier.example;
       dmarc=pass (p=QUARANTINE) header.from=supplier.example

That example is illustrative. If the trusted sender fails these checks, don't turn authentication off. Ask them to fix SPF, DKIM and DMARC, which also fixes their deliverability everywhere else. You can check their public records with the DMARC Checker and SPF Checker. If you only get a trickle of unauthenticated mail from one sender, Google suggests a content compliance rule with Bypass spam filter for this message limited to specific addresses instead. Our content compliance rules guide explains how to build one.

Which bypass option should you choose?

Choose Bypass spam filters for messages from senders or domains in selected lists. It is the only approved-sender option that keeps Gmail's warning banners. Google's Spam rule offers three bypass choices for external mail:

Google says the last option "overrides any other options you select for this setting" and "increases the possibility that people in your organization will get spam, phishing, or other unsafe messages."

Also note how rules combine. Google says some options apply to the entire organizational unit and override other rules that have them turned off: the approved senders bypass, aggressive filtering, the internal senders bypass and administrative quarantine. If two rules in one unit disagree, the one with the option turned on wins.

Is it safe to allowlist a sender in Gmail?

It's reasonably safe for a single, authenticated address from a partner you know, and risky for whole domains or shared platforms. Approved senders don't bypass everything: Google says messages with a virus or that are "part of a larger email attack" are still blocked. But ordinary phishing from that sender reaches the inbox, marked only with the banner "This message wasn't sent to Spam because of your organization's settings."

The bigger risk is a compromised partner. If a supplier's mailbox is taken over, every message the attacker sends from it passes authentication, matches your list and skips spam filtering. That's exactly how invoice fraud and business email compromise arrive. A domain entry widens that risk to every account at the company.

Google gives you an early warning. The alert center has an alert called Phishing in inboxes due to bad whitelist (the alert details page now calls it "bad allowlist"). Google explains that "messages classified as spam by Gmail filters might be delivered to user inboxes due to allowlist settings in the Google Admin console that override the spam filters" (View alert details). Its details page names the sender, source IP and the Allowlist type that overrode the filter. Google's system-defined rules list shows it as Active by default; make sure someone actually receives it. Our alert center guide shows how to set recipients.

When should you use the IP email allowlist instead?

Use the IP email allowlist only for a sending server whose IP address belongs to you or to one sender alone. Google says messages from allowlisted IPs "won't be marked as spam by Gmail", but its allowlists overview warns that recipients are "likely to still see a Gmail warning banner on those messages," such as "This email looks suspicious."

The IP allowlist has three limits (Add IP addresses to allowlists in Gmail):

• It always applies to your entire domain. You can't scope it to an organizational unit.
• It accepts public IPs only, as single addresses or CIDR ranges.
• An IP that is already in your Inbound gateway setting won't be added to the allowlist, because of how Gmail determines the true sender IP.

Never allowlist the IP ranges of a shared email service. Anyone else on that platform would inherit your exception.

Why is an approved sender still going to spam?

An approved sender usually still lands in Spam for one of five reasons. Check them in this order:

1. Authentication fails. The message doesn't pass SPF or DKIM aligned with the From domain, so it doesn't match an entry with authentication required.
2. The From address differs. The sender uses a different address or a new domain. Compare the From header, not the Return-Path in Email Log Search.
3. No list is selected. The Spam rule's bypass box is ticked, but no list was chosen.
4. Wrong organizational unit. The rule sits in a child unit that doesn't include the recipient. Rules can't be applied to groups; group members are affected by their own unit.
5. Timing. The change is less than 24 hours old.

Also remember that a user's own Gmail filters and "mark as spam" actions are separate from the admin list.

Can you manage approved senders with an API?

You can read them, but not change them. Google's Cloud Identity Policy API lists gmail.spam_override_lists (approved senders lists that bypass the spam folder), gmail.email_address_lists, gmail.blocked_sender_lists and gmail.email_spam_filter_ip_allowlist, and marks each as "Mutate supported: No" at the time of writing (November 2026) (Policy API settings). That's still useful: you can export the lists on a schedule and review them outside the console.

How large can the list be, and how do you keep it clean?

Google's recommended limits are 2,000 address lists and 100,000 addresses per list for approved and blocked senders, and all Gmail settings combined must stay within 5 MB (Gmail settings size limits). A good allowlist is nowhere near that.

Use this quarterly review checklist:

1. Export or screenshot every address list used by a Spam rule.
2. For each entry, write down who asked for it, why and when. Remove entries nobody can explain.
3. Replace domain entries with individual addresses wherever you can.
4. Confirm Require sender authentication is on for every entry.
5. Check that no rule uses either "hide warnings" option.
6. Review recent Phishing in inboxes due to bad whitelist alerts and remove the senders involved.
7. Never add your own domain. Google notes that adding your domain applies the setting to your entire domain, and spoofers forge exactly that.

If your MX records point to a filtering gateway, keep the allowlist there instead, so one list governs every message before it reaches Gmail. Our inbound gateway guide explains how Gmail treats gateway mail.

Next steps

• Open Spam, Phishing and Malware and list every Spam rule that bypasses filters. Remove any "hide warnings" option.
• Check that authentication is required on every approved entry, and ask failing senders to fix DMARC rather than loosening the rule.
• Make sure the Phishing in inboxes due to bad whitelist alert goes to a monitored mailbox.
• If you want approved and blocked sender lists with optional sender verification at the MX level, iBlockSpam's allow and block lists sit in front of Gmail; see how it works with Google Workspace.