51 Email gateway interception

Caveats

• Weigh this one carefully — for most organisations a third-party gateway in front of Gmail adds little that Gmail’s own stack does not already do, while adding a supplier, a cost and a new single point of failure in the mail path.
• Gmail does not enforce the sender’s DMARC policy on messages arriving via the inbound gateway — you inherit the gateway’s verdict, having traded Google’s anti-abuse stack for the vendor’s.
• The gateway sees every message in plaintext — it is now a supplier holding all your mail, and a compelled-disclosure target in its own right.

Setup steps

1. 1. Point the domain's MX records at the third-party gateway so inbound mail is processed before Google sees it. This is a DNS change, not a console change — and it is the step that can black-hole all mail.

   MX → gateway vendor's hosts (lowest priority first); TTL lowered beforehand

2. 2. Declare the gateway's public IPs to Gmail so it treats them as the trusted hop and reads the gateway's spam verdict instead of the gateway's own IP reputation.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15

   Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway

   Gateway IPs

   <vendor CIDRs>

   Automatically detect external IP

   ON

3. 3. Close the bypass: reject anything that arrives at Google without having passed through the gateway, and require TLS on the gateway hop.

   Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway

   Reject all mail not from gateway IPs

   ON

   Require TLS for connections from the gateway

   ON

4. 4. Add the gateway as a mail host so outbound mail can be routed through it too (smart host).
   open ↗

   

   https://admin.google.com/ac/apps/gmail/hosts · captured 2026-07-15

   Apps › Google Workspace › Gmail › Hosts

   Add route → gateway smarthost:port; Require TLS = ON; Require CA-signed certificate = ON

5. 5. Add the outbound routing rule that sends internal→external mail via that host, then verify with test mail in both directions before removing the direct path.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15

   Apps › Google Workspace › Gmail › Routing

   Affect

   Outbound

   Route

   the gateway host

   Change envelope recipient

   off

Ongoing maintenance

• automatable: script Continuously: monitor gateway queue depth and delivery latency.
• requires a human Per incident/policy change: keep gateway rules in step with Workspace-side controls.

How to verify

1. The MX records are public — confirm they point at the gateway, then send a test message from outside and read its headers for the gateway hop.

   dig +short MX <domain>