23 Gmail Security Sandbox + safety-toggle verification

Security Sandbox detonates incoming attachments in a virtual machine before delivery, catching malware that static scanning misses; it can run for a whole OU or be narrowed by rules (external senders only, high-risk OU only) if the delivery delay is unaffordable tenant-wide. The other half of this control is free on every edition: Gmail's Safety toggles for attachments, links and images, and spoofing and authentication — plus the auto-adopt setting that applies future Google-recommended safety settings without a manual review cycle. Those toggles matter as much as the sandbox does, because they ship on defaults that warn rather than quarantine.

Caveats

‘Keep email in inbox and show warning’ is the default action for several Safety toggles and is not the control¹
Security Sandbox delays delivery by up to about 3 minutes²
Security Sandbox is available on Business Standard and Plus, Enterprise Standard and Plus, and Frontline Plus³
‘Enable virtual execution’ scans every attachment⁴

Setup steps

open ↗
https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15
Apps › Google Workspace › Gmail › Spam, Phishing and Malware
Scroll to Security sandbox and enable pre-delivery detonation of attachments for the whole OU (organizational unit) rather than maintaining rule exceptions.

Enable virtual execution of attachments in a sandbox environment = checked

Set up rules to detect harmful attachments ↗
Apps › Google Workspace › Gmail › Spam, Phishing and Malware › Security sandbox rules
If you cannot afford the delivery delay tenant-wide, configure targeted rules instead (e.g. only messages from outside the domain, only to the high-risk OU).

Security sandbox rules > Configure > match: sender is external AND recipient in high-risk OU

Set up rules to detect harmful attachments ↗
open ↗
https://admin.google.com/ac/apps/gmail/safety · captured 2026-07-15
Apps › Google Workspace › Gmail › Safety
Verify every Safety toggle is on and set to the strict action — these are the free half of this control, configured setting-by-setting by №19.

Attachments (encrypted, scripts, anomalous types), Links and external images (shortened URLs, linked-image scanning, untrusted-domain warnings), Spoofing and authentication (domain spoof, employee-name spoof, inbound unauthenticated, unauthenticated images) = all On; action = Quarantine or Move email to spam

Advanced phishing and malware protection ↗
Apps › Google Workspace › Gmail › Safety
Turn on 'Apply future recommended settings automatically' in each Safety section (Attachments, Links and external images, Spoofing and authentication) so future Google-recommended settings apply without a manual review cycle.

Apply future recommended settings automatically
checked in each section (Attachments, Links and external images, Spoofing and authentication)

Advanced phishing and malware protection ↗

How to verify

Confirm the sandbox and safety toggles on the OU, then check the security sandbox verdicts appear in the investigation tool for recent attachments.

v0.1.3Preventedition Biz Std+, Frontline Plus / All policy #7 · #6 ↗