Google Workspace built-in protection vs an inbound gateway

Google Workspace filters spam, phishing and malware for every user, with no setup. An inbound gateway sits in front of Gmail at the MX level and filters mail before Google sees it. This page compares the two honestly, including when you should keep things as they are.

The short answer

Gmail's built-in protection is strong, and Google gives admins more controls on top. If you run only Google Workspace, have turned on the advanced phishing and malware settings, and your users are comfortable with the Spam folder, a gateway may add little. A gateway like iBlockSpam is worth it when you want a personal quarantine with digests for every user, one filtering policy across Google Workspace and other platforms, mail held during outages, or a per-domain price that doesn't grow with each new mailbox.

What Google Workspace does well

Filtering you don't have to run

Every Google Workspace mailbox gets Gmail's spam, phishing and malware filtering. There's nothing to route and no extra hop. Spam lands in each user's Spam folder, where they can find false positives themselves.

Advanced phishing and malware protection

Admins can switch on advanced phishing and malware protection in the Admin console. It covers three areas:

• Attachments: encrypted attachments and attachments with scripts from untrusted senders, plus anomalous file types.
• Links and external images: links behind shortened URLs, scanning linked images, and a warning when users click links to untrusted domains.
• Spoofing and authentication: lookalike domains, employee-name spoofing, inbound mail spoofing your own domain, and unauthenticated mail.

For attachment and spoofing settings, you choose whether to keep the message in the inbox with a warning, move it to spam, or quarantine it. Google marks "keep in inbox with a warning" as the default, so review these choices rather than assuming they're strict.

Security sandbox, on some editions

Security sandbox opens attachments in an isolated virtual environment to catch malware that signature scanning can miss. Google lists it for Frontline Plus, Business Standard, Business Plus, Enterprise Standard and Enterprise Plus. Google notes that scanning can delay delivery by up to 3 minutes.

Admin controls

You can customize Gmail's spam settings: filter more aggressively, send spam to an admin quarantine instead of users' Spam folders, and bypass filtering for approved senders.

Where Google's model has gaps

None of these are flaws. They're design choices that suit some organizations less well.

• Quarantine is admin-first. Google's email quarantine is reviewed by admins by default, and Google says recipients are never notified when a message is quarantined.
• It covers Google mailboxes only. If you also run domains on Microsoft 365 or cPanel, each platform has its own filtering, policies and admin console.
• Licensing is per user. Google Workspace protection comes with each user license. That's simple, but it means every shared inbox that needs a full mailbox needs a license.

Built-in vs gateway at a glance

How the gateway fits with Gmail

You configure Gmail's inbound gateway setting with the gateway's public IP addresses, then point your MX records at the gateway. A few settings matter:

1. Gateway IPs. List every gateway IP that delivers to Gmail.
2. Automatically detect external IP. Gmail then looks past the gateway to the first public IP not on your list and uses it for SPF and spam evaluation. Without it, Gmail checks only one hop back.
3. Reject all mail not from gateway IPs. This stops senders from skipping your MX and delivering straight to Google. Turn it on after you've verified delivery, not before.
4. Leave Gmail's spam evaluation on. Google offers an option to disable it and rely only on the gateway's header. You get two layers by leaving it on.

Two caveats from Google's documentation are worth knowing. Gmail doesn't enforce the sender's DMARC policy for mail that arrives through the gateway, so the gateway's spoofing protection becomes more important. And changes can take up to 24 hours to take effect, so plan the cutover. Our inbound gateway setup guide walks through each step, and the Google Workspace platform page has the full setup.

Who should choose which

Stay with Google Workspace alone if

• You run only Google Workspace and have no plans to add other platforms.
• You've reviewed and turned on the advanced phishing and malware settings.
• Your edition includes security sandbox and you use it.
• Users handle their Spam folders well, and you don't need quarantine digests.

Add an inbound gateway if

• You manage several domains across Google Workspace, Microsoft 365 or cPanel and want one policy and one portal. MSPs often fall here.
• You want every user to get a personal quarantine with digests rather than relying on the Spam folder or admin-only review.
• You have many shared inboxes or aliases, and per-domain pricing is easier to budget than per-user add-ons.
• You want mail held during outages and alerts when your MX, SPF or DMARC records change.

If you're weighing an MX gateway against tools that connect to Gmail by API instead, read secure email gateway vs API email security. The Microsoft side of this question is covered in Microsoft 365 built-in filtering vs a gateway.

Before you decide

Check what your domain looks like today. The free Email Health Check shows your current MX, SPF and DMARC records, so you can see what a change would touch. If you add a gateway, test with a few mailboxes first and confirm the route with the Email Header Analyzer.

Sources

• Google Workspace Admin Help: Advanced phishing and malware protection
• Google Workspace Admin Help: Set up rules to detect harmful attachments (security sandbox)
• Google Workspace Admin Help: Customize spam filter settings
• Google Workspace Admin Help: Set up an email quarantine
• Google Workspace Admin Help: Set up an inbound mail gateway