# How do you set up spoofing and authentication protection in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-spoofing-authentication-protection
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> Set up Gmail's five spoofing and authentication protections in Google Workspace: what each catches, default actions, false positives and how to test.

## Short answer

In the Google Admin console, go to Apps > Google Workspace > Gmail > Safety > Spoofing and authentication. Turn on the five protections: similar domain names, employee names, inbound mail spoofing your domain, any unauthenticated email, and Groups. Each defaults to keeping mail in the inbox with a warning; choose spam or quarantine for the spoofing checks instead.

Spoofing is mail that lies about who sent it: a lookalike domain, a colleague's name on a stranger's address, or your own domain forged outright. Google Workspace has five protections aimed at exactly this, grouped under **Spoofing and authentication** on Gmail's Safety page. This guide goes deeper on those five than our overview of [advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection), which covers the attachment and link settings.

## What is spoofing and authentication protection in Gmail?

Spoofing and authentication protection is a group of Google Workspace admin settings that act on incoming mail impersonating your domain, your staff or a lookalike of either, and on mail that fails sender authentication. Google describes the section as "protection against spoofing a domain name, employee names, email pretending to be from your domain, and unauthenticated email from any domain" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)).

Two terms first. **SPF** (Sender Policy Framework) lists the servers allowed to send for a domain. **DKIM** (DomainKeys Identified Mail) adds a signature that proves which domain sent a message and that it wasn't changed. Our [SPF vs DKIM vs DMARC guide](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) explains both.

## What do the five settings catch?

At the time of writing (October 2026), Google lists these five settings. Every one offers the same three actions, and every one defaults to **Keep email in inbox and show warning**.

| Setting | What Google says it targets | Example it would catch |
|---|---|---|
| Protect against domain spoofing based on similar domain names | Mail "from domains that appear visually similar to your company's domains or domain aliases" | `invoices@examp1e.com` writing to staff at `example.com` |
| Protect against spoofing of employee names | Mail where "the sender's name is a name in your Google Workspace directory, but the email isn't from your company domain or domain aliases" | `"Dana Ruiz" <dana.ruiz.ceo@freemail.example>` |
| Protect against inbound emails spoofing your domain | "Business Email Compromise (BEC) messages not authenticated with either SPF or DKIM, pretending to be from your domain" | A forged `From: payroll@example.com` sent from an unknown server |
| Protect against any unauthenticated emails | Messages not "authenticated (by any domain) with either SPF or DKIM (or both)" | Mail from a misconfigured server that passes neither check |
| Protect Groups from inbound emails spoofing your domain | The domain-spoofing check for Google Groups, for all groups or private groups only | A forged message to `accounts@example.com`, a group address |

The examples are illustrative. Our guides to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) and [display name spoofing](https://iblockspam.com/blog/display-name-spoofing) show how attackers use the first two patterns.

## How do you turn on spoofing protection, step by step?

You need the **Gmail Settings** administrator privilege.

1. In the Google Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Safety**.
2. On the left, select the organizational unit. Start with a pilot unit rather than the top level.
3. Scroll to **Spoofing and authentication** and click it.
4. Tick each of the five protections. For Groups, choose all groups or private groups only.
5. Choose an action for each. If you tick a setting but don't choose an action, Google applies the default warning.
6. Decide on **Apply future recommended settings automatically**. Google says new recommended settings in this section are then "turned on by default."
7. Click **Save**. Allow up to 24 hours for changes to take effect.

### Which action should you choose?

| Action | Where the message goes | Who can fix a false positive |
|---|---|---|
| Keep email in inbox and show warning (default) | Inbox, with a banner | The user, who can ignore the banner |
| Move email to spam | Spam folder, no banner | The user, by marking it Not spam |
| Quarantine | Admin quarantine; the user sees nothing | Only an admin, by selecting Allow |

Google notes that warning banners "appear only in Gmail web. Third-party apps do not display a warning banner." If staff read mail in Outlook or Apple Mail, a warning is close to no action. Our suggestion, not a Google default, is to start with **Quarantine** for domain spoofing and Groups spoofing, **Move email to spam** for employee names and similar domains, and the default warning for **any unauthenticated emails** until you've reviewed what it catches. If you choose quarantine, staff it: our [Gmail admin quarantine guide](https://iblockspam.com/blog/google-workspace-admin-quarantine) covers review.

## How does Gmail decide a message is authenticated?

For these settings, Gmail treats a message as authenticated when it passes SPF or DKIM. For the "any unauthenticated emails" setting, either one passing for any domain is enough. For the "spoofing your domain" setting, the question is whether mail claiming your domain is authenticated with SPF or DKIM.

Users see the result too. Google's Gmail Help says: "If you see a question mark next to the sender's name, the message isn't authenticated," meaning "Gmail doesn't know if the message is coming from the person who appears to be sending it" ([Gmail Help](https://support.google.com/mail/answer/180707)). It adds that if a forwarded message passes SPF or DKIM but ARC shows it failed earlier, "Gmail treats the message as unauthenticated."

To check a flagged message, open it in Gmail, choose **More** > **Show original**, and read the `Authentication-Results` header. A forged message claiming your domain looks something like this (illustrative):

```
Authentication-Results: mx.google.com;
       spf=fail (google.com: domain of payroll@example.com does not designate 203.0.113.50 as permitted sender) smtp.mailfrom=payroll@example.com;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.com
```

There's no `dkim=pass` and SPF fails, so the domain-spoofing protection applies. Paste real headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to read them side by side.

### Where DMARC fits

DMARC, defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), lets a domain owner tell every receiver what to do with mail that fails aligned SPF and DKIM. Gmail's spoofing settings protect only your own users. Publishing DMARC with `p=quarantine` or `p=reject` protects everyone your domain is forged to. Do both. Our [DMARC setup guide for Google Workspace](https://iblockspam.com/blog/dmarc-setup-google-workspace) covers the record.

## Why does Gmail flag legitimate mail as spoofing?

False positives almost always come from your own senders. Causes in order of likelihood:

1. **An app or device sends as your domain without SPF or DKIM.** Website forms, scanners, accounting software and helpdesks are typical. Fix them: add their SPF include and DKIM key, as in our guide to [authenticating third-party senders](https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc), or route them through the [Google Workspace SMTP relay service](https://iblockspam.com/blog/google-workspace-smtp-relay-service).
2. **A gateway in front of Gmail isn't declared.** If MX points to a filtering service, Gmail sees the gateway's IP. Configure **Inbound gateway** with its IPs and **Automatically detect external IP** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)); our [inbound gateway guide](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup) has the steps. Google also says Gmail "does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway," so the gateway's own spoofing checks matter.
3. **Forwarding broke authentication.** Mail forwarded from an outside mailbox can fail SPF. ARC helps only where the forwarder supports it.
4. **A real partner's domain looks like yours.** The similar-domain check can catch genuine businesses with close names. Exempt them with an address list that keeps authentication on.

### Don't "fix" it with an allowlist

Google says these advanced settings "work independently of other spam settings": listing a domain as a safe sender doesn't stop them, and "allowlist settings don't override the Quarantine option." Adding your own domain to an approved-senders list is worse. Google says doing so applies the setting "to your entire domain," and sender authentication, which is on by default for each address-list entry, is what stops forged mail matching it ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains)). Never turn that off.

## How do spoofing settings interact with the alert center?

The alert center has a system-defined rule called **Gmail potential employee spoofing**, which Google lists as **Active** by default ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules)). Google's alert details page adds an important condition: "This alert is triggered only if the spoofing and authentication protection option for employee name spoofing is disabled" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/view-alert-details)).

So once you turn on employee-name protection, expect that alert to go quiet. That's by design, not a fault. Our [Google Workspace alert center guide](https://iblockspam.com/blog/google-workspace-alert-center-email) covers the other email alerts worth routing to your team.

## How do you test the settings safely?

1. Create a pilot organizational unit with IT staff and two or three volunteers.
2. Turn on all five protections there, with the actions you plan to use.
3. Wait up to 24 hours.
4. From an outside account, send a message whose display name matches a pilot user's directory name. It should get your employee-name action.
5. Review the pilot users' Spam folders and the quarantine daily for a week. List every legitimate sender that was caught and fix its authentication.
6. Roll out to the top-level unit, keeping any exceptions in their own unit.

Only test forged-domain delivery from servers you control and against your own domain. Check your published records first with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DKIM Checker](https://iblockspam.com/tools/dkim-checker).

## Next steps

- Open **Gmail** > **Safety** > **Spoofing and authentication** and note which of the five protections are off or still on the default warning.
- Fix every internal sender that fails SPF and DKIM before you move to quarantine.
- Publish or tighten DMARC so receivers outside your organization reject forgeries too.
- If you want spoofing checks before mail reaches Gmail, compare [Google Workspace built-in filtering with a gateway](https://iblockspam.com/compare/google-workspace-built-in-vs-gateway); iBlockSpam's [Google Workspace setup](https://iblockspam.com/platforms/google-workspace) is one such option.

See all [spam filter setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### What is the default action for Gmail spoofing protection settings?

Each of the five spoofing and authentication settings defaults to Keep email in inbox and show warning. If you turn a setting on without choosing an action, Gmail applies that default. You can change it per setting to Move email to spam or Quarantine, and per organizational unit.

### Why does Gmail flag my own company's emails as spoofing our domain?

The Protect against inbound emails spoofing your domain setting targets mail that claims to be from your domain but isn't authenticated with SPF or DKIM. Usually that's a website form, scanner or SaaS tool sending as your domain without authentication. Give that sender SPF and DKIM, or route it through Google's SMTP relay service.

### Does adding my domain to approved senders stop Gmail spoofing warnings?

Google says the advanced security settings apply even when a domain is listed as a safe sender, and allowlists don't override the Quarantine action. Adding your own domain to an address list is also risky: Google warns it applies the setting to your entire domain, and turning off sender authentication lets forged mail match.

### Why did I stop getting the Gmail potential employee spoofing alert?

Google says this alert is triggered only if the employee name spoofing protection is turned off. Once you turn on Protect against spoofing of employee names, Gmail acts on those messages directly with your chosen action, so the alert center no longer reports them through that rule.

### Do Gmail spoofing protections work behind a third-party email gateway?

They still run, but Gmail must see the real sender. Configure the Inbound gateway setting with the gateway's IPs and Automatically detect external IP, so SPF is checked against the original server. Google also says Gmail doesn't enforce the sender's DMARC policy on gateway mail, so the gateway's spoofing checks matter.

## Sources

- [Google Workspace Admin Help: Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)
- [Google Workspace Admin Help: View and edit system-defined rules](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules)
- [Google Workspace Admin Help: View alert details](https://knowledge.workspace.google.com/admin/security/view-alert-details)
- [Google Workspace Admin Help: Use address lists to apply settings to specific people or domains](https://knowledge.workspace.google.com/admin/gmail/advanced/use-address-lists-to-apply-settings-to-specific-people-or-domains)
- [Gmail Help: Check if your Gmail message is authenticated](https://support.google.com/mail/answer/180707)
- [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)
- [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-spoofing-authentication-protection (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt