# How do you set up an approved senders (spam allowlist) list in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-spam-allowlist-approved-senders
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Running email day to day
Author: iBlockSpam Team

> Set up a Gmail approved senders list in Google Workspace: address lists, sender authentication, the bypass options, IP allowlist and limits, safely.

## Short answer

Create an address list under Apps > Google Workspace > Gmail > Routing > Manage address lists, keep Require sender authentication on, then add a Spam rule under Spam, Phishing and Malware with Bypass spam filters for messages from senders or domains in selected lists. Gmail matches the From address, and changes can take up to 24 hours.

An approved senders list tells Gmail to skip its spam filters for mail from addresses or domains you trust. It's the right fix for a supplier whose invoices keep landing in Spam, and the wrong fix for almost everything else, because a careless entry also lets phishing through. This guide covers exactly how Google Workspace matches senders, which bypass option to pick, and how to keep the list small.

For the side-by-side with Microsoft 365, read our guide to [whitelisting a sender in Microsoft 365 and Google Workspace](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace). For the wider tour of Gmail's spam, phishing and malware page, see [Gmail spam settings in Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace). Menu names here were checked against Google's Admin Help at the time of writing (November 2026).

## What is an approved senders list in Google Workspace?

An approved senders list is an address list (a named set of email addresses and domains) that a Gmail Spam rule uses to let mail from those senders skip spam filtering. Google says "messages from these users bypass Gmail's spam filters, and recipients can decide whether they are spam or not" ([Allowlists, denylists, and approved senders](https://knowledge.workspace.google.com/admin/gmail/advanced/allowlists-denylists-and-approved-senders)).

Two pieces work together. The **address list** lives under Routing and can be reused by other settings. The **Spam rule** lives under Spam, Phishing and Malware and decides what the list does. Neither does anything on its own.

Google Workspace has several things people call an allowlist. They behave differently:

| Mechanism | Where it lives | Matches on | Scope | Good fit |
|---|---|---|---|---|
| Approved senders (Spam rule + address list) | Gmail > Spam, Phishing and Malware > Spam | From address or domain, optionally authenticated | Organizational unit | A trusted partner whose real mail is misfiled |
| Email allowlist | Gmail > Spam, Phishing and Malware > Email allowlist | Sending IP address or CIDR range | Whole domain only | A dedicated server you control |
| Content compliance bypass | Gmail > Compliance > Content compliance | Any condition you write | Organizational unit | A small amount of unauthenticated mail from a known sender |
| Inbound gateway | Gmail > Spam, Phishing and Malware > Inbound gateway | Relay IPs of a filter in front of Gmail | Domain | Telling Gmail about your MX-level filter, not allowlisting |

## How do you add an approved sender in Google Workspace, step by step?

You add an approved sender by building an address list with sender authentication on, then selecting that list in a Spam rule. Both steps need the Gmail Settings administrator privilege. The procedure below follows Google's [address list](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains) and [custom spam filter](https://knowledge.workspace.google.com/admin/gmail/advanced/add-custom-spam-filters-to-gmail) help pages.

1. In the Google Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Routing**.
2. Click **Manage address lists**, then **Add address list** at the bottom of the table.
3. Name the list for its purpose, for example `Approved senders - finance suppliers`.
4. Click **Add address** for one entry or **Bulk add addresses** for several (comma-separated). Prefer full addresses such as `billing@supplier.example` over whole domains.
5. Leave **Require sender authentication** turned on for every entry, then click **Save**.
6. Go to **Apps** > **Google Workspace** > **Gmail** > **Spam, Phishing and Malware**.
7. On the left, select the organizational unit that should get the exception. Selecting the top level applies it to everyone.
8. Scroll to **Spam** and click **Configure** (or **Add another rule**). Give the rule a unique name.
9. Tick **Bypass spam filters for messages from senders or domains in selected lists**, click **Use existing list** and select your list. Google warns that "you must select at least one address list, or this option has no effect."
10. Click **Save** and check that the rule appears in the Spam settings table.

Google says changes "can take up to 24 hours but typically happen more quickly", and every change is recorded in the Admin console audit log. Wait before you decide it hasn't worked.

## How does Gmail match a sender against the list?

Gmail matches the **From:** address, the one users see in their inbox. Google's address list page is explicit: "Gmail doesn't use the Return-Path: address for address list matching." The Return-Path (also called the envelope sender) is the bounce address recorded during the SMTP conversation, and it often differs from the From address for mail sent through marketing or billing platforms.

Before matching, Gmail standardizes addresses. Google lists three rules:

- Periods and plus signs are removed from usernames.
- Subdomains are removed from email addresses.
- Addresses are converted to lowercase.

So `admin@solarmora.com`, `a.d.m.i.n@solarmora.com`, `admin@support.solarmora.com` and `Admin@Solarmora.com` all match the same entry, using Google's own example. Domain entries can be written as `solarmora.com` or `@solarmora.com`. Wildcards such as `*@solarmora.com` are accepted by the form but, in Google's words, "entering wildcard addresses has no effect".

Two consequences catch people out. A domain entry covers every subdomain too, so approving a company domain also approves anything sent from its marketing subdomain. And because Email Log Search shows the Return-Path rather than the From address, the sender you see in the log may not be the one Gmail compared. Our [Email Log Search guide](https://iblockspam.com/blog/google-workspace-email-log-search) shows how to read those results.

## What does "Require sender authentication" check?

Require sender authentication means a sender only matches the list if Gmail can prove the message really came from that sender's domain. It is on by default for new entries, and Google recommends "you always leave the sender authentication option on to help protect your domain from spoofing, spam, and other malicious attacks."

Google says Gmail checks that at least one of these is true:

- The message passes SPF and the From sender matches the Return-Path sender.
- The message has a valid DKIM signature, and the signing domain matches the From sender.

Google adds that "messages must pass DMARC to pass authentication." In practice that means the sender needs SPF or DKIM that aligns with the From domain. If you want to see what a real message shows, paste its headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and look at the `Authentication-Results` line. An authenticated message from an example supplier would contain something like:

```
Authentication-Results: mx.google.com;
       dkim=pass header.i=@supplier.example;
       spf=pass smtp.mailfrom=billing@supplier.example;
       dmarc=pass (p=QUARANTINE) header.from=supplier.example
```

That example is illustrative. If the trusted sender fails these checks, don't turn authentication off. Ask them to fix SPF, DKIM and DMARC, which also fixes their deliverability everywhere else. You can check their public records with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) and [SPF Checker](https://iblockspam.com/tools/spf-checker). If you only get a trickle of unauthenticated mail from one sender, Google suggests a content compliance rule with **Bypass spam filter for this message** limited to specific addresses instead. Our [content compliance rules guide](https://iblockspam.com/blog/google-workspace-content-compliance-rules) explains how to build one.

## Which bypass option should you choose?

Choose **Bypass spam filters for messages from senders or domains in selected lists**. It is the only approved-sender option that keeps Gmail's warning banners. Google's Spam rule offers three bypass choices for external mail:

| Option | Spam filters | Warning banners | Recommendation |
|---|---|---|---|
| Bypass spam filters for messages from senders or domains in selected lists | Skipped for listed senders | Still shown | Use this one |
| Bypass spam filters and hide warnings for messages from senders or domains in selected lists | Skipped for listed senders | Hidden | Avoid; users lose their last clue |
| Bypass spam filters and hide warnings for all messages from internal and external senders | Skipped for all mail | Never shown | Google doesn't recommend it |

Google says the last option "overrides any other options you select for this setting" and "increases the possibility that people in your organization will get spam, phishing, or other unsafe messages."

Also note how rules combine. Google says some options apply to the entire organizational unit and override other rules that have them turned off: the approved senders bypass, aggressive filtering, the internal senders bypass and administrative quarantine. If two rules in one unit disagree, the one with the option turned on wins.

## Is it safe to allowlist a sender in Gmail?

It's reasonably safe for a single, authenticated address from a partner you know, and risky for whole domains or shared platforms. Approved senders don't bypass everything: Google says messages with a virus or that are "part of a larger email attack" are still blocked. But ordinary phishing from that sender reaches the inbox, marked only with the banner "This message wasn't sent to Spam because of your organization's settings."

The bigger risk is a compromised partner. If a supplier's mailbox is taken over, every message the attacker sends from it passes authentication, matches your list and skips spam filtering. That's exactly how invoice fraud and [business email compromise](https://iblockspam.com/blog/business-email-compromise-wire-transfer-recovery) arrive. A domain entry widens that risk to every account at the company.

Google gives you an early warning. The alert center has an alert called **Phishing in inboxes due to bad whitelist** (the alert details page now calls it "bad allowlist"). Google explains that "messages classified as spam by Gmail filters might be delivered to user inboxes due to allowlist settings in the Google Admin console that override the spam filters" ([View alert details](https://knowledge.workspace.google.com/admin/security/view-alert-details)). Its details page names the sender, source IP and the **Allowlist type** that overrode the filter. Google's [system-defined rules list](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules) shows it as Active by default; make sure someone actually receives it. Our [alert center guide](https://iblockspam.com/blog/google-workspace-alert-center-email) shows how to set recipients.

## When should you use the IP email allowlist instead?

Use the IP email allowlist only for a sending server whose IP address belongs to you or to one sender alone. Google says messages from allowlisted IPs "won't be marked as spam by Gmail", but its [allowlists overview](https://knowledge.workspace.google.com/admin/gmail/advanced/allowlists-denylists-and-approved-senders) warns that recipients are "likely to still see a Gmail warning banner on those messages," such as "This email looks suspicious."

The IP allowlist has three limits ([Add IP addresses to allowlists in Gmail](https://knowledge.workspace.google.com/admin/gmail/advanced/add-ip-addresses-to-allowlists-in-gmail)):

- It always applies to your entire domain. You can't scope it to an organizational unit.
- It accepts public IPs only, as single addresses or CIDR ranges.
- An IP that is already in your **Inbound gateway** setting won't be added to the allowlist, because of how Gmail determines the true sender IP.

Never allowlist the IP ranges of a shared email service. Anyone else on that platform would inherit your exception.

## Why is an approved sender still going to spam?

An approved sender usually still lands in Spam for one of five reasons. Check them in this order:

1. **Authentication fails.** The message doesn't pass SPF or DKIM aligned with the From domain, so it doesn't match an entry with authentication required.
2. **The From address differs.** The sender uses a different address or a new domain. Compare the From header, not the Return-Path in Email Log Search.
3. **No list is selected.** The Spam rule's bypass box is ticked, but no list was chosen.
4. **Wrong organizational unit.** The rule sits in a child unit that doesn't include the recipient. Rules can't be applied to groups; group members are affected by their own unit.
5. **Timing.** The change is less than 24 hours old.

Also remember that a user's own Gmail filters and "mark as spam" actions are separate from the admin list.

## Can you manage approved senders with an API?

You can read them, but not change them. Google's Cloud Identity Policy API lists `gmail.spam_override_lists` (approved senders lists that bypass the spam folder), `gmail.email_address_lists`, `gmail.blocked_sender_lists` and `gmail.email_spam_filter_ip_allowlist`, and marks each as "Mutate supported: No" at the time of writing (November 2026) ([Policy API settings](https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings)). That's still useful: you can export the lists on a schedule and review them outside the console.

## How large can the list be, and how do you keep it clean?

Google's recommended limits are 2,000 address lists and 100,000 addresses per list for approved and blocked senders, and all Gmail settings combined must stay within 5 MB ([Gmail settings size limits](https://knowledge.workspace.google.com/admin/gmail/gmail-settings-size-limits)). A good allowlist is nowhere near that.

Use this quarterly review checklist:

1. Export or screenshot every address list used by a Spam rule.
2. For each entry, write down who asked for it, why and when. Remove entries nobody can explain.
3. Replace domain entries with individual addresses wherever you can.
4. Confirm **Require sender authentication** is on for every entry.
5. Check that no rule uses either "hide warnings" option.
6. Review recent **Phishing in inboxes due to bad whitelist** alerts and remove the senders involved.
7. Never add your own domain. Google notes that adding your domain applies the setting to your entire domain, and spoofers forge exactly that.

If your MX records point to a filtering gateway, keep the allowlist there instead, so one list governs every message before it reaches Gmail. Our [inbound gateway guide](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup) explains how Gmail treats gateway mail.

## Next steps

- Open **Spam, Phishing and Malware** and list every Spam rule that bypasses filters. Remove any "hide warnings" option.
- Check that authentication is required on every approved entry, and ask failing senders to fix DMARC rather than loosening the rule.
- Make sure the **Phishing in inboxes due to bad whitelist** alert goes to a monitored mailbox.
- If you want approved and blocked sender lists with optional sender verification at the MX level, iBlockSpam's [allow and block lists](https://iblockspam.com/features/allow-block-lists) sit in front of Gmail; see [how it works with Google Workspace](https://iblockspam.com/platforms/google-workspace).

## Frequently asked questions

### Will Gmail still block a virus sent by an approved sender?

Yes. Approved senders bypass Gmail's spam filters only. Google says that if a message from an approved sender has a virus or is part of a larger email attack, Gmail still prevents it from being delivered. Spam from an approved sender lands in the inbox with a banner saying it wasn't sent to Spam because of your organization's settings.

### Can I use a wildcard like *@example.com in a Gmail address list?

The field accepts it, but it does nothing. Google says address list logic only matches full email addresses, so wildcard entries have no effect. To cover everyone at a company, enter the domain as example.com or @example.com. Gmail also treats subdomains as a match for the parent domain, so the domain entry covers mail.example.com senders too.

### Why does Gmail ignore my approved sender even though the address is on the list?

The most common cause is sender authentication. With Require sender authentication on, the message must pass SPF with a matching Return-Path or carry a valid DKIM signature for the From domain, and Google says it must pass DMARC. Other causes are a Spam rule with no list selected, the wrong organizational unit, or a change still within the 24-hour window.

### How many addresses can a Google Workspace approved senders list hold?

Google's recommended limits, at the time of writing (November 2026), are 2,000 address lists per account and 100,000 addresses per list, for approved and blocked senders combined. All Gmail settings together must also stay under 5 MB after compilation. A list that big defeats the purpose of an allowlist, so treat these as ceilings, not targets.

### Is the Gmail email allowlist the same as approved senders?

No. The email allowlist holds sending IP addresses and always applies to your whole domain. Approved senders are email addresses or domains in an address list, used by a Spam rule that you can scope to an organizational unit. Google warns that allowlisted IP mail can still show a warning banner such as This email looks suspicious.

## Sources

- [Google Workspace Admin Help: Add custom spam filters to Gmail](https://knowledge.workspace.google.com/admin/gmail/advanced/add-custom-spam-filters-to-gmail)
- [Google Workspace Admin Help: Use address lists to apply settings to specific people or domains](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains)
- [Google Workspace Admin Help: Allowlists, denylists, and approved senders](https://knowledge.workspace.google.com/admin/gmail/advanced/allowlists-denylists-and-approved-senders)
- [Google Workspace Admin Help: Add IP addresses to allowlists in Gmail](https://knowledge.workspace.google.com/admin/gmail/advanced/add-ip-addresses-to-allowlists-in-gmail)
- [Google Workspace Admin Help: View alert details](https://knowledge.workspace.google.com/admin/security/view-alert-details)
- [Google Workspace Admin Help: Gmail settings size limits](https://knowledge.workspace.google.com/admin/gmail/gmail-settings-size-limits)
- [Cloud Identity: Settings available in the Policy API](https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-spam-allowlist-approved-senders (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt