19 Residual mail & service hygiene

The remaining mail and service defaults, all of them free on every edition. Gmail's Safety protections — attachments, links and external images, spoofing and unauthenticated senders — are turned on and set to quarantine rather than a warning banner; the spam-bypass holes (an over-broad approved-senders list, 'bypass spam filters for internal senders') are closed; comprehensive mail storage is turned on so Vault actually sees everything; and unused services such as Google Sites are turned off, because an unused publishing surface inside the tenant is a free phishing host carrying your domain's reputation. The Gmail Security Sandbox (23 Gmail Security Sandbox + safety-toggle verification) adds attachment detonation on top of these toggles, but it is edition-gated and these are not.

Caveats

The Safety toggles default to ‘keep in inbox and show warning’¹
‘Bypass spam filters for internal senders’ is the toggle a mail-migration vendor quietly re-enables²
Turning off a service such as Sites does not delete what is already published³
Comprehensive mail storage is a Vault prerequisite⁴

Setup steps

open ↗
https://admin.google.com/ac/apps/gmail/safety · captured 2026-07-15
Apps › Google Workspace › Gmail › Safety
Turn on every Safety protection and, critically, set each one to quarantine rather than 'keep in inbox with warning' where the policy allows; quarantine acts on incoming messages only.

Attachments (encrypted, scripts, anomalous)
On + Quarantine
Links and external images
all On
Spoofing and authentication
all On (incl. 'Protect against domain spoofing based on similar domain names' and 'Protect against any unauthenticated emails')

Advanced phishing and malware protection ↗
open ↗
https://admin.google.com/ac/apps/gmail/spam · captured 2026-07-15
Apps › Google Workspace › Gmail › Spam, phishing and malware
Verify no spam-bypass hole exists: an over-broad approved-senders list or 'bypass spam filters for internal senders' undoes the whole safety stack.

Bypass spam filters for internal senders
Off
approved-sender lists
empty or narrowly justified
Enhanced pre-delivery message scanning
On

Add custom spam filters to Gmail ↗ Help prevent phishing with pre-delivery message scanning ↗
open ↗
https://admin.google.com/ac/managedsettings/142495531730 · captured 2026-07-15
Apps › Google Workspace › Sites › Service status
Turn off Google Sites — an unused publishing surface inside the tenant is a free phishing/exfil host carrying your domain's reputation.

Sites service status
Off for everyone

Turn Sites on or off for users ↗
open ↗
https://admin.google.com/ac/appslist/additional · captured 2026-07-15
Apps › Additional Google services
Sweep the Additional Google services list and turn off every service nobody uses.

Unused additional services
Off

Turn on or off additional Google services ↗
open ↗
https://admin.google.com/ac/apps/gmail/compliance · captured 2026-07-15
Apps › Google Workspace › Gmail › Compliance
Turn on comprehensive mail storage, so a copy of every sent and received message — including mail that never lands in a user's mailbox — is stored and Vault (№30) actually sees everything.

Comprehensive mail storage
On

Set up comprehensive mail storage ↗

How to verify

Walk the four hygiene screens and confirm each setting matches the control; there is no user-visible surface to probe.

v0.1.3Assure policy #27 · #18 ↗