How do you set up spoofing and authentication protection in Google Workspace?

Spoofing is mail that lies about who sent it: a lookalike domain, a colleague's name on a stranger's address, or your own domain forged outright. Google Workspace has five protections aimed at exactly this, grouped under Spoofing and authentication on Gmail's Safety page. This guide goes deeper on those five than our overview of advanced phishing and malware protection, which covers the attachment and link settings.

What is spoofing and authentication protection in Gmail?

Spoofing and authentication protection is a group of Google Workspace admin settings that act on incoming mail impersonating your domain, your staff or a lookalike of either, and on mail that fails sender authentication. Google describes the section as "protection against spoofing a domain name, employee names, email pretending to be from your domain, and unauthenticated email from any domain" (Google Workspace Admin Help).

Two terms first. SPF (Sender Policy Framework) lists the servers allowed to send for a domain. DKIM (DomainKeys Identified Mail) adds a signature that proves which domain sent a message and that it wasn't changed. Our SPF vs DKIM vs DMARC guide explains both.

What do the five settings catch?

At the time of writing (October 2026), Google lists these five settings. Every one offers the same three actions, and every one defaults to Keep email in inbox and show warning.

The examples are illustrative. Our guides to lookalike domain phishing and display name spoofing show how attackers use the first two patterns.

How do you turn on spoofing protection, step by step?

You need the Gmail Settings administrator privilege.

1. In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Safety.
2. On the left, select the organizational unit. Start with a pilot unit rather than the top level.
3. Scroll to Spoofing and authentication and click it.
4. Tick each of the five protections. For Groups, choose all groups or private groups only.
5. Choose an action for each. If you tick a setting but don't choose an action, Google applies the default warning.
6. Decide on Apply future recommended settings automatically. Google says new recommended settings in this section are then "turned on by default."
7. Click Save. Allow up to 24 hours for changes to take effect.

Which action should you choose?

Google notes that warning banners "appear only in Gmail web. Third-party apps do not display a warning banner." If staff read mail in Outlook or Apple Mail, a warning is close to no action. Our suggestion, not a Google default, is to start with Quarantine for domain spoofing and Groups spoofing, Move email to spam for employee names and similar domains, and the default warning for any unauthenticated emails until you've reviewed what it catches. If you choose quarantine, staff it: our Gmail admin quarantine guide covers review.

How does Gmail decide a message is authenticated?

For these settings, Gmail treats a message as authenticated when it passes SPF or DKIM. For the "any unauthenticated emails" setting, either one passing for any domain is enough. For the "spoofing your domain" setting, the question is whether mail claiming your domain is authenticated with SPF or DKIM.

Users see the result too. Google's Gmail Help says: "If you see a question mark next to the sender's name, the message isn't authenticated," meaning "Gmail doesn't know if the message is coming from the person who appears to be sending it" (Gmail Help). It adds that if a forwarded message passes SPF or DKIM but ARC shows it failed earlier, "Gmail treats the message as unauthenticated."

To check a flagged message, open it in Gmail, choose More > Show original, and read the Authentication-Results header. A forged message claiming your domain looks something like this (illustrative):

Authentication-Results: mx.google.com;
       spf=fail (google.com: domain of payroll@example.com does not designate 203.0.113.50 as permitted sender) smtp.mailfrom=payroll@example.com;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.com

There's no dkim=pass and SPF fails, so the domain-spoofing protection applies. Paste real headers into the Email Header Analyzer to read them side by side.

Where DMARC fits

DMARC, defined in RFC 9989, lets a domain owner tell every receiver what to do with mail that fails aligned SPF and DKIM. Gmail's spoofing settings protect only your own users. Publishing DMARC with p=quarantine or p=reject protects everyone your domain is forged to. Do both. Our DMARC setup guide for Google Workspace covers the record.

Why does Gmail flag legitimate mail as spoofing?

False positives almost always come from your own senders. Causes in order of likelihood:

1. An app or device sends as your domain without SPF or DKIM. Website forms, scanners, accounting software and helpdesks are typical. Fix them: add their SPF include and DKIM key, as in our guide to authenticating third-party senders, or route them through the Google Workspace SMTP relay service.
2. A gateway in front of Gmail isn't declared. If MX points to a filtering service, Gmail sees the gateway's IP. Configure Inbound gateway with its IPs and Automatically detect external IP (Google Workspace Admin Help); our inbound gateway guide has the steps. Google also says Gmail "does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway," so the gateway's own spoofing checks matter.
3. Forwarding broke authentication. Mail forwarded from an outside mailbox can fail SPF. ARC helps only where the forwarder supports it.
4. A real partner's domain looks like yours. The similar-domain check can catch genuine businesses with close names. Exempt them with an address list that keeps authentication on.

Don't "fix" it with an allowlist

Google says these advanced settings "work independently of other spam settings": listing a domain as a safe sender doesn't stop them, and "allowlist settings don't override the Quarantine option." Adding your own domain to an approved-senders list is worse. Google says doing so applies the setting "to your entire domain," and sender authentication, which is on by default for each address-list entry, is what stops forged mail matching it (Google Workspace Admin Help). Never turn that off.

How do spoofing settings interact with the alert center?

The alert center has a system-defined rule called Gmail potential employee spoofing, which Google lists as Active by default (Google Workspace Admin Help). Google's alert details page adds an important condition: "This alert is triggered only if the spoofing and authentication protection option for employee name spoofing is disabled" (Google Workspace Admin Help).

So once you turn on employee-name protection, expect that alert to go quiet. That's by design, not a fault. Our Google Workspace alert center guide covers the other email alerts worth routing to your team.

How do you test the settings safely?

1. Create a pilot organizational unit with IT staff and two or three volunteers.
2. Turn on all five protections there, with the actions you plan to use.
3. Wait up to 24 hours.
4. From an outside account, send a message whose display name matches a pilot user's directory name. It should get your employee-name action.
5. Review the pilot users' Spam folders and the quarantine daily for a week. List every legitimate sender that was caught and fix its authentication.
6. Roll out to the top-level unit, keeping any exceptions in their own unit.

Only test forged-domain delivery from servers you control and against your own domain. Check your published records first with the DMARC Checker, SPF Checker and DKIM Checker.

Next steps

• Open Gmail > Safety > Spoofing and authentication and note which of the five protections are off or still on the default warning.
• Fix every internal sender that fails SPF and DKIM before you move to quarantine.
• Publish or tighten DMARC so receivers outside your organization reject forgeries too.
• If you want spoofing checks before mail reaches Gmail, compare Google Workspace built-in filtering with a gateway; iBlockSpam's Google Workspace setup is one such option.

See all spam filter setup guides.