Choosing a filter

Is Google Workspace's spam filter enough for a business?

By iBlockSpam Team How we check our guides Updated Oct 16, 2026 9 min read 7 sources

Short answer

For many businesses, yes. Gmail filters spam, phishing and malware for every Google Workspace user, and Google says it blocks more than 99.9% of them automatically. Turn on the Safety settings and check your edition for Security Sandbox. Consider an MX-level gateway if you need user quarantine digests, mail held during outages or one filter across several platforms.

On this page 7 sections

Google Workspace includes a capable spam filter for every user, and you don't have to set anything up for it to work. Whether it's enough depends less on Gmail's detection than on your edition, a handful of admin settings, and a few operational needs Gmail wasn't designed around. This guide gives the honest answer first, then the checks that settle it for your business.

Is Gmail's spam filter good enough for a business?

For most single-platform businesses, Gmail's built-in filter is good enough. Google says "more than 99.9% of spam, phishing attempts, and malware are automatically blocked in Gmail" (Google Workspace). That's Google's own marketing figure, published on its Workspace security page, not an independent test.

What's left still matters, because the messages most likely to get through are the targeted ones: a fake invoice from a lookalike domain, or a message from a real supplier's hacked account. No filter catches all of those. So the useful question is not "is Gmail good?" but "have we turned on what we pay for, and do we have gaps Gmail doesn't cover?"

What does Google Workspace include for email security?

Every Google Workspace user gets Gmail's spam, phishing and malware filtering. Admins get extra controls, and some editions get attachment sandboxing.

Protection	What it does	Who gets it
Spam, phishing and malware filtering	Moves junk to the user's Spam folder and blocks known malware	Every edition
Safety settings (advanced phishing and malware protection)	Extra checks on attachments, links and spoofing	Admin setting; Google's page doesn't limit it by edition
Security Sandbox	Opens attachments in an isolated environment to catch unknown malware	Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus
Custom spam rules	More aggressive filtering, admin quarantine, approved senders	Admin setting
Admin quarantine	Holds messages for admin review	Admin setting

Edition details are from Google's Security Sandbox page at the time of writing (October 2026). Business Starter isn't on that list. Google also says sandbox scanning can "delay message delivery by up to 3 minutes". For a feature-by-feature look against Microsoft, see Google Workspace vs Microsoft 365 email security.

Which Gmail settings should you turn on first?

The Gmail settings that matter most are under Apps > Google Workspace > Gmail > Safety in the Admin console. Google groups them into three areas (Google Admin Help):

Attachments: encrypted attachments and attachments with scripts from untrusted senders, and anomalous attachment types.
Links and external images: links behind shortened URLs, scanning linked images, and a warning when users click links to untrusted domains.
Spoofing and authentication: similar-domain spoofing, employee-name spoofing, inbound mail spoofing your own domain, unauthenticated mail, and spoofing of Google Groups.

Here's the catch. For each attachment and spoofing setting, Google offers three actions (keep in inbox with a warning, move to spam, or quarantine) and marks "Keep email in inbox and show warning" as the default. The link settings are simple on/off checkboxes. A warning banner is better than nothing, but users click through banners. Use this order:

Turn on every Safety setting for a pilot organizational unit (OU), with the default warning action.
Check "Apply future recommended settings automatically" in each group, so new protections switch on as Google adds them.
After a week, raise the action to Move email to spam or Quarantine for spoofing of your own domain and for encrypted or script-bearing attachments from untrusted senders.
Roll out to all OUs once the pilot users report no problems.
Review your Spam rules under Apps > Google Workspace > Gmail > Spam, Phishing and Malware and remove broad bypass entries.

Our guides to Gmail spam settings and advanced phishing and malware protection cover each option in detail.

Watch your bypass rules

Google's custom spam settings include "Bypass spam filters and hide warnings for all messages from internal and external senders". Google says it doesn't recommend it "because it increases the possibility" of users receiving spam and phishing (Google Admin Help). Approved-sender lists are safer, and Google notes it still blocks messages with a virus. Even so, a domain-wide bypass for a supplier also bypasses anyone spoofing that supplier.

Where does Google Workspace's spam filter fall short?

Google Workspace's gaps are design choices, not detection failures. They matter to some organizations and not at all to others.

Admin quarantine is silent. Google says "recipients are never notified when a message is quarantined", and by default only admins can review it (Google Admin Help). Quarantined messages are kept "up to 30 days after sending". If you quarantine aggressively, someone has to check it, or real invoices disappear quietly. See Google Workspace admin quarantine.
The Spam folder is per user. Users must remember to look. Many don't, and false positives sit there unnoticed.
It covers Google mailboxes only. Domains on Microsoft 365, cPanel or Exchange each have their own filter and console.
Outages are handled by the sender. If mail can't reach your domain, delivery depends on each sending server retrying. RFC 5321 says senders should give up after "at least 4-5 days" (RFC 5321), but you don't control their settings.
Licensing is per user. Each shared inbox that needs a full mailbox needs a license.

How do you check why Gmail filtered a message?

Open the message, choose Show original, and read the authentication results. A typical header looks like this (example values only):

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=s1;
       spf=pass (google.com: domain of billing@example.com designates 203.0.113.10 as permitted sender) smtp.mailfrom=billing@example.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

Paste the full header into the Email Header Analyzer to see each hop. A legitimate sender that fails SPF, DKIM or DMARC needs to fix its own records; an allow rule just hides the problem.

How do you tell whether Gmail's filtering is working for you?

Gmail's filtering is working for you when users rarely see junk, rarely miss real mail, and report what slips through. Three quick checks:

Ask users whether they've found real invoices or customer mail in Spam in the past month. If they have, find out why before you tighten anything.
Look up a missing message in the Admin console's email log search to see whether it arrived, went to spam or was quarantined. See Google Workspace email log search.
Check your own domain's authentication with the DMARC Checker. Spoofing of your domain is far easier to catch when you publish DMARC with an enforcing policy.

When should you add a gateway in front of Google Workspace?

Add a gateway in front of Google Workspace when the gaps above cost you time or money, not because Gmail is weak. A gateway is an inbound filter your MX records point to; it filters mail and relays the clean messages to Gmail.

Situation	Gmail alone	Gateway in front
Users need to find their own held mail	Spam folder; admin quarantine sends no notice	Personal quarantine with scheduled digests
Domains on more than one platform	Google mailboxes only	One filter and portal for all domains
Destination unreachable	Sender retries on its own schedule	Mail held (spooled) and delivered later
Many shared inboxes or aliases	Per-user licensing	Per-domain pricing
Attachment-type rules	Attachment compliance rules	Attachment-type and Office macro filters
Blocking mail by sending country	No sending-country option in the Safety or spam settings we reviewed (October 2026)	Geographic filters

With iBlockSpam, every user gets a personal quarantine and digests (hourly, daily, a chosen weekday or custom), mail is spooled for up to 5 days if delivery fails, and pricing is per domain with unlimited mailboxes (a mailbox count, not unlimited message volume). The Google Workspace built-in vs gateway comparison sets out both sides.

A gateway doesn't replace Gmail. Google's own filtering keeps running behind it, and that's what you want.

What changes in Gmail when a gateway is added?

Adding a gateway changes the route, not the mailbox. Users keep their inbox, labels and Spam folder. In the Admin console you configure the Inbound gateway setting under Spam, Phishing and Malware (Google Admin Help):

List the gateway IPs that deliver to Gmail. Private IP addresses aren't supported.
Turn on "Automatically detect external IP" so Gmail evaluates the real sender, not the gateway.
Leave Gmail's spam evaluation on. The option "Disable Gmail spam evaluation on mail from this gateway; only use header value" removes a layer.
Turn on "Reject all mail not from gateway IPs" after delivery is verified, so attackers can't skip your MX. See blocking direct-delivery bypass.
Plan the timing. Google says changes "can take up to 24 hours but typically happen more quickly."

One trade-off to know: "Gmail does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway." The gateway's spoofing checks take over that job. The full walkthrough is in Google Workspace inbound gateway setup. If you also run Microsoft 365, read do you need a spam filter with Microsoft 365.

Next steps

Check which Google Workspace edition you have and confirm whether it includes Security Sandbox.
Turn on every Safety setting for a pilot OU, then raise the actions on spoofing and risky attachments.
Remove broad spam-bypass rules you can't justify.
Run the free Email Health Check to see your MX, SPF and DMARC records.
If quarantine digests, spooling or mixed platforms matter to you, see how iBlockSpam works with Google Workspace.

Browse our other guides on choosing email protection.

Frequently asked questions

Does Google Workspace Business Starter include Security Sandbox?

No. At the time of writing (October 2026), Google's Admin Help lists Security Sandbox for Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus. Business Starter still gets Gmail's standard spam, phishing and malware filtering and the Safety settings, but not sandbox detonation of attachments.

Are Google Workspace users told when an email is quarantined?

No. Google's Admin Help says recipients are never notified when a message goes to an admin quarantine. By default only super admins and admins with the Access Admin Quarantine privilege can review it, and quarantined messages are kept up to 30 days after sending before they're deleted.

Are Gmail's advanced phishing settings strict by default?

Not fully. Each attachment and spoofing setting offers three actions, and Google marks keep email in inbox and show warning as the default. Review each one and choose move to spam or quarantine where you want a firmer response. Roll changes out to a test organizational unit first.

Does adding a gateway turn off Gmail's spam filter?

No, not unless you choose to. Gmail keeps evaluating mail that arrives through an inbound gateway. Google offers an optional setting to disable Gmail spam evaluation and rely only on the gateway's header, but leaving it off keeps two layers. Gmail does stop enforcing the sender's DMARC policy on gateway mail.

What is the most common Gmail spam setting mistake?

Over-broad bypass rules. Bypassing spam filters for whole domains, or for all internal and external senders, lets spoofed and phishing mail through. Google says it doesn't recommend the bypass-all option. Use approved sender lists sparingly and only together with sender authentication.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading