18 Residual mail & service hygiene

Caveats

• ‘Bypass spam filters for internal senders’ is the toggle a mail-migration vendor quietly re-enables — watch it with the config-drift sentinel (№61).
• Comprehensive mail storage is a Vault prerequisite — without it, mail that never touched a user’s mailbox is not retained and will not be discoverable.

Setup steps

1. 1. Turn on every Safety protection and, critically, set each one to quarantine rather than 'keep in inbox with warning' where the policy allows; quarantine acts on incoming messages only.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/safety · captured 2026-07-15

   Apps › Google Workspace › Gmail › Safety

   Attachments (encrypted, scripts, anomalous)

   On + Quarantine

   Links and external images

   all On

   Spoofing and authentication

   all On (incl. 'Protect against domain spoofing based on similar domain names' and 'Protect against any unauthenticated emails')

2. 2. Verify no spam-bypass hole exists: an over-broad approved-senders list or 'bypass spam filters for internal senders' undoes the whole safety stack.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15

   Apps › Google Workspace › Gmail › Spam, phishing and malware

   Bypass spam filters for internal senders

   Off

   approved-sender lists

   empty or narrowly justified

   Enhanced pre-delivery message scanning

   On

3. 3. Turn off Google Sites — an unused publishing surface inside the tenant is a free phishing/exfil host carrying your domain's reputation.
   open ↗

   

   https://admin.google.com/ac/managedsettings/142495531730 · captured 2026-07-15

   Apps › Google Workspace › Sites › Service status

   Sites service status

   Off for everyone

4. 4. Sweep the Additional Google services list and turn off every service nobody uses.
   open ↗

   

   https://admin.google.com/ac/appslist/additional · captured 2026-07-15

   Apps › Additional Google services

   Unused additional services

   Off

5. 5. Turn on comprehensive mail storage, so a copy of every sent and received message — including mail that never lands in a user's mailbox — is stored and Vault (№32) actually sees everything.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/compliance · captured 2026-07-15

   Apps › Google Workspace › Gmail › Compliance

   Comprehensive mail storage

   On

6. 6. Keep the external-recipient warning on — Gmail flags at compose time when a recipient is outside the organization, the cheapest misdirected-mail control there is. It is on by default; the step is verifying no OU has turned it off.
   open ↗

   

   https://admin.google.com/ac/apps/gmail/enduseraccess · captured 2026-07-15

   Apps › Google Workspace › Gmail › End User Access

   Warn for external recipients

   On (checked)

How to verify

1. Walk the four hygiene screens and confirm each setting matches the control; there is no user-visible surface to probe.