49 Email gateway interception

Points the domain's MX records at a third-party mail security gateway so inbound mail is filtered before Google ever sees it, declares the gateway's IPs to Gmail as the trusted hop so Gmail reads the gateway's verdict rather than its IP reputation, rejects anything that arrives at Google without passing through the gateway, and optionally smart-hosts outbound mail through it too. The MX change is DNS, not console — and it is the step that can black-hole all of your mail.

Documentation: Email routing and delivery options for Google Workspace ↗

Caveats

Weigh this one carefully¹
Gmail does not enforce the sender’s DMARC policy on messages arriving via the inbound gateway²
The gateway sees every message in plaintext³
‘Reject all mail not from gateway IPs’ is the setting that makes the control real⁴
Inbound gateway settings do not accept private IP addresses

Setup steps

Point the domain's MX records at the third-party gateway so inbound mail is processed before Google sees it. This is a DNS change, not a console change — and it is the step that can black-hole all mail.
```
MX → gateway vendor's hosts (lowest priority first); TTL lowered beforehand
```
open ↗
https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15
Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway
Declare the gateway's public IPs to Gmail so it treats them as the trusted hop and reads the gateway's spam verdict instead of the gateway's own IP reputation.

Gateway IPs
<vendor CIDRs>
Automatically detect external IP
ON

Set up an inbound mail gateway ↗
Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway
Close the bypass: reject anything that arrives at Google without having passed through the gateway, and require TLS on the gateway hop.

Reject all mail not from gateway IPs
ON
Require TLS for connections from the gateway
ON

Set up an inbound mail gateway ↗
open ↗
https://admin.google.com/ac/apps/gmail/hosts · captured 2026-07-15
Apps › Google Workspace › Gmail › Hosts
Add the gateway as a mail host so outbound mail can be routed through it too (smart host).

Add route → gateway smarthost:port; Require TLS = ON; Require CA-signed certificate = ON

Add mail servers for Gmail email routing ↗
open ↗
https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15
Apps › Google Workspace › Gmail › Routing
Add the outbound routing rule that sends internal→external mail via that host, then verify with test mail in both directions before removing the direct path.

Affect
Outbound
Route
the gateway host
Change envelope recipient
off

Add Gmail routing settings ↗

Ongoing maintenance

automatable: script Continuously: monitor gateway queue depth and delivery latency.
requires a human Per incident/policy change: keep gateway rules in step with Workspace-side controls.

How to verify

The MX records are public — confirm they point at the gateway, then send a test message from outside and read its headers for the gateway hop.
dig +short MX <domain>

v0.0.2Preventedition All (3rd-party) policy #6 · #19 ↗