49 Email gateway interception

draft

Points the domain's MX records at a third-party mail security gateway so inbound mail is filtered before Google ever sees it, declares the gateway's IPs to Gmail as the trusted hop so Gmail reads the gateway's verdict rather than its IP reputation, rejects anything that arrives at Google without passing through the gateway, and optionally smart-hosts outbound mail through it too. The MX change is DNS, not console — and it is the step that can black-hole all of your mail.

Documentation: Email routing and delivery options for Google Workspace ↗

Caveats

Weigh this one carefully¹
Gmail does not enforce the sender’s DMARC policy on messages arriving via the inbound gateway²
The gateway sees every message in plaintext³

Setup steps

Point the domain's MX records at the third-party gateway so inbound mail is processed before Google sees it. This is a DNS change, not a console change — and it is the step that can black-hole all mail.
```
MX → gateway vendor's hosts (lowest priority first); TTL lowered beforehand
```
open ↗

https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15

Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway
Declare the gateway's public IPs to Gmail so it treats them as the trusted hop and reads the gateway's spam verdict instead of the gateway's own IP reputation.

Gateway IPs

<vendor CIDRs>

Automatically detect external IP

ON

Set up an inbound mail gateway ↗

The field does not accept private IP addresses — only the gateway's public addresses.
Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Inbound gateway
Close the bypass: reject anything that arrives at Google without having passed through the gateway, and require TLS on the gateway hop.

Reject all mail not from gateway IPs

ON

Require TLS for connections from the gateway

ON

Set up an inbound mail gateway ↗

The reject setting is what makes the control real — and what black-holes mail the moment the vendor changes IPs without telling you. Subscribe to the vendor's infrastructure notices before flipping it.
open ↗

https://admin.google.com/ac/apps/gmail/hosts · captured 2026-07-15

Apps › Google Workspace › Gmail › Hosts
Add the gateway as a mail host so outbound mail can be routed through it too (smart host).

Add route → gateway smarthost:port; Require TLS = ON; Require CA-signed certificate = ON

Add mail servers for Gmail email routing ↗
open ↗

https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15

Apps › Google Workspace › Gmail › Routing
Add the outbound routing rule that sends internal→external mail via that host, then verify with test mail in both directions before removing the direct path.

Affect

Outbound

Route

the gateway host

Change envelope recipient

off

Add Gmail routing settings ↗

Ongoing maintenance

automatable: script Continuously: monitor gateway queue depth and delivery latency.
requires a human Per incident/policy change: keep gateway rules in step with Workspace-side controls.

How to verify

The MX records are public — confirm they point at the gateway, then send a test message from outside and read its headers for the gateway hop.

dig +short MX <domain>

draft v0.0.2 Prevent edition All (3rd-party) policy #6 · #19 ↗