If you're looking for instructions and guidelines related to legal, security, and compliance concerns, go to Google Workspace legal and compliance.
As an administrator, you can add settings that specify how to handle messages with attachments. The setting can be based on file type, file name, or message size.
Settings can specify any of these actions for messages with attachments:
- Reject the message
- Quarantine the message and attachment for review
- Modify the delivery of the message and the attachment
You can also add a setting that detects encrypted attachments. This is useful if you send unencrypted copies of message attachments to an archive server.
How attachments are scanned
Gmail can detect the file type for standard and custom file types. So, even if malicious senders rename the file extension, Gmail can still detect the file type.
Gmail scans the names of files inside archives, including encrypted and nested, non-encrypted archives.
Content filters scan messages and attachments up to 1MB. Message contents and attachments are converted to a single file in a scannable format. Gmail scans the converted file. For converted files larger than 1MB, Gmail scans only the first 1MB of the converted file. Gmail doesn’t convert or scan files that are larger than 10MB.
Gmail can't:
- Scan the inner archives of an encrypted archive.
- Open or inspect attachments that are password-protected files or archives.
- Open or inspect ZIP files that are password protected. Gmail can inspect ZIP file attachments that aren't password protected.
Note: We can’t guarantee that content filters will detect and flag all sensitive message content or attachments. The filters use regular expressions and other content parameters to determine match probability. There might be false positives and negatives, which are triggered by many factors.
How settings are applied
Unless you change the options, the rules apply to all users in an organizational unit. You can disable in a child organization any rules they inherit from a parent organization. You can also add multiple rules to each organization.
When you set up multiple rules, what happens to a message depends on the conditions you set and which rule has precedence. For details, read How multiple settings affect message behavior.
Set up an attachment compliance rule
Initial step: Go to Gmail Compliance settings in the Admin console
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
Apps
Google Workspace
-
Scroll to the Attachment compliance setting, point at the setting, and click Configure. If the setting is already configured, click Edit or Add another.
-
For each new setting, enter a unique description.
Go to the next step to configure the setting.
Step 1: Enter email messages to affect
A domain is internal if it is a verified workspace domain, or a subdomain or parent domain of a verified workspace domain.
- Check the boxes next to the messages you want the rule to apply to.
- Go to the next step to continue.
Step 2: Add one or more expressions to specify what's searched
You can add up to 10 expressions. Each expression must be individually added and saved.
-
From the list, specify whether any or all conditions must match to trigger what happens to the message. For example, if you select If ANY of the following match the message, any matching condition can trigger the consequence to the message.
-
Click Add.
-
From the list, choose what you want to specify for the expression:
-
File type—Select the attachment types to include. You can also enter a custom file type to find matches based on that file type.
Note: For your protection, file types that are detected to be executables are automatically rejected. For a complete list of extensions, go to File types and extensions supported in expressions. -
File name—Enter an attachment name that you want to include. Any part of an attachment file name is returned as a match, whether it's upper or lowercase.
-
Message size—Enter the size limit for messages. The size is in megabytes. The size includes the message body and all attachments. This size limit applies to the raw size of the entire message. Because of the encoding overhead, the raw message size can be up to 33% larger than the base size of the message and attachments
-
-
Click Save. You might need to scroll to see it.
-
Go to the next step to continue.
Step 3: Specify what happens if expressions match
-
Specify whether to modify, reject, or quarantine a message when conditions are met. Read details below.
-
Configure the options for the actions you choose.
-
(Optional) Click Show options to configure additional options to limit the application of this setting. Go to Configure additional parameters below, for details.
-
Go to Save the configuration.
Reject message
Rejects the message before reaching the recipient. You can enter a message to notify the sender about why the message was rejected. For matching messages, no other routing or compliance rules are applied.
Note: Gmail automatically adds an SMTP rejection code, such as 550 5.7.1. This is a requirement of the SMTP standard and can't be deleted.
Quarantine message
Sends the message to an admin quarantine where you can review the message before you send or reject it. This option is only available for the Users account type. For details, see Account types to affect.
To notify your users when their sent messages are quarantined, check the Notify sender when mail is quarantined (onward delivery only) box.
Modify message
Add headers, remove attachments, change the envelope recipient, add more recipients, and change the route. For details, read Options for modifying messages.
Note: We recommend you use the routing settings for the use cases they're intended to support. Use an attachment compliance setting for attachment-related use cases. Use a Routing setting for general routing-related use cases, such as dual delivery. Learn about mail routing use cases and examples.
Controls
Add X-Gm-Original-To header
Add a header tag if the recipient is changed, so the receiving server knows the original envelope recipient. An example of the header tag format is X-Gm-Original-To: user@solarmora.com.
Add X-Gm-Spam and X-GM-Phishy headers
Add headers that indicate message spam and phishing status. Administrators for receiving servers use this information to set up special rules for managing spam and phishing messages. For details, go to Add spam headers setting to all default routing rules.
Add custom headers
Add custom headers to messages affected by this setting. For example, you can add a header that matches the description you entered for the setting. Custom headers can help you troubleshoot routing settings and message delivery.
Add custom text to subject
Add custom text to the beginning of the subject line for specified messages. For example, enter Confidential for sensitive messages. If a message with the subject Monthly report is affected by this setting, the subject line is updated to: [Confidential] Monthly report.
Change route and Also reroute spam
-
Change the route—Change the message destination from the default Gmail server to a different mail server. Before you can change the route, you must add the server by following the steps in Add mail servers for Gmail email routing.
-
Also reroute spam—This option is available when you select Change the route. Blatant spam is dropped at delivery time. The Also reroute spam option routes any additional email you mark as spam. Leave the box unchecked to route normal messages, but not spam. Admin console email settings (for example, a list of preauthorized senders) overrides spam settings.
- Suppress bounces from this recipient—Prevent bounced messages from being rerouted to the configured mail route. For example, you might want to prevent bounced messages from being rerouted to an automated system. Leave this box unchecked if you want the receiving mail system to get bounced messages, for example so senders know when their message isn't delivered.
Change envelope recipient
The message bypasses the original recipient’s mailbox and goes to the new recipient. Change the envelope recipient in one of these ways:
- Replace the recipient’s entire email address—After Replace recipient, enter the full email address, such as user@solarmora.com.
- Replace username—To change just the username of the recipient's email address and keep the domain the same, before @existing-domain, enter the username, such as user.
- Replace domain—To change just the domain of the recipient's email address and keep the username the same, after existing-username@, enter the domain, such as solarmora.com.
An MX lookup on the new recipient's domain determines the destination server. Or, if you’re using the Change the route control, the specified route determines the destination server. To Bcc additional recipients, use the Add more recipients option, described later on this page.
Bypass spam filter for this message
Deliver incoming messages to recipients even if the spam filter identifies them as spam. This option applies only to incoming messages. You can’t bypass spam filters for outgoing messages. Note: This option is not available for the Groups account type. For details, go to Account types to affect.
Remove attachments from message
To remove any attachments from messages, select this option. You can also add text to let recipients know that attachments were removed.
Add more recipients
- To set up dual or multiple delivery, check the Add more recipients box
.
- To add individual email addresses, select Basic from the list
- (Optional) To add more addresses, click Add
- (Optional) To choose advanced options for your secondary delivery, select Advanced from the list.
You can change the envelope recipient, add headers, prepend a custom subject, and remove attachments for secondary deliveries. Note: The Do not deliver spam to this recipient advanced option isn't supported for the Groups account type.
When you add recipients, keep in mind:
- Rules have a limit of 100 additional recipients.
- Settings for the primary delivery also apply to the secondary deliveries.
- For secondary deliveries, the Do not deliver spam to this recipient and Suppress bounces from this recipient boxes are checked by default.
- Adding additional recipients creates a message for each added recipient. Advanced Gmail settings apply to each message.
Encryption (onward delivery only)
By default, Gmail tries to deliver messages using Transport Layer Security (TLS). If secure transport isn’t available, the message is delivered over a nonsecure connection. Select encryption options for messages affected by the setting:
- Require secure transport (TLS)—Require all messages meeting the conditions in the setting to be sent over a secure connection. If TLS isn't available on the sending or receiving side, the message won't be sent.
- Encrypt message if not encrypted—Encrypts messages with S/MIME. If you have an Enterprise or Enterprise for Education account, you can also bounce messages or require that messages can only be sent if they are S/MIME encrypted. For details, go to Enhance message security with hosted S/MIME.
Supported editions for this feature: Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus. Compare your edition
Tip: We recommend that you test new rules to make sure they work correctly for your organization. For more information, see Best practices for faster rules testing.
Configure additional parameters (Optional)
To set up additional options for a routing policy, such as creating address lists or choosing the account types it will affect, at the bottom, click Show options.
An address list is a list of email addresses and domains that you create. Use address lists to apply or bypass settings for the email addresses and domains in the list. Read detailed information about address lists, and how they're used with Gmail settings.
For address list matching, Gmail checks:
- Incoming messages—The sender domain or email address against the address list
- Outgoing messages—The recipient domain or email address against the address list
To use address lists in this setting:
- Click Show options.
- Check the Use address lists to bypass or control application of this setting box.
- (Routing settings only) Select an Apply address list to correspondents option for address list matching:
- Apply address lists to correspondents—Check the "from" field for received mail, and the recipients for sent mail. For senders, the Authentication required option is also checked (see details in Step 8).
- Apply address list to recipients—Check that recipients are in the address lists.
Note: This option isn't available in Gmail content compliance settings.
- Select an option for bypassing or applying this setting:
- Bypass this setting for specific addresses/domains—Bypass the setting entirely if there's an address list match. All other criteria in the setting is ignored.
- Only apply this setting for specific addresses/domains—Use an address list match as a condition for applying the setting. If there are other criteria in the setting, those conditions must also match for the setting to be applied. Examples of other criteria are match expressions, account types, and envelope filters.
- Click an address list option:
- Use existing list—Select the name of an existing address list, then go directly to Step 9.
- Create or edit list—The Add address list box or Manage address list tab opens. Complete Steps 6–9.
- In the Add address list box, enter the name of the new address list.
-
To enter email addresses or domains to the list one at a time, click Add Address. To enter a comma-separated list of addresses or domains, click Bulk Add Addresses.
-
To bypass the setting for approved senders that don't use authentication, turn off the Authentication required option. Be aware that turning off authentication requirements can increase the possibility of getting spam or spoofed messages. Learn more about sender authentication.
-
Click Save.
When you're done, continue to Account types to affect.
Account types to affect (Required)
Depending on the message action you chose and the type of organizational unit you’re configuring, some account types might not be available.
Select one or more account types that the setting applies to:
- Users (default)—The setting applies to provisioned users. For sending and outbound mail, the setting is triggered when your users send email. For receiving and inbound mail, the setting is triggered when your users receive email.
- Groups—The setting applies to groups set up in your organization. For sending and outbound mail, the setting is triggered when your groups forward email or summaries to members. For receiving and inbound mail, the setting is triggered when your groups receive email.
- Unrecognized/Catch-all—The setting is triggered when your organization receives email that doesn’t match one of your provisioned users. This selection only applies to received and inbound email.
Note: The Groups and Unrecognized/Catch-all account types don’t apply to these controls:
- Add X-Gm-Spam and X-Gm-Phishy headers
- Bypass spam filter for this message
- Also reroute spam
When you're finished, go to Add and save the setting.
Envelope filter
To affect only specific envelope senders and recipients, set up an envelope filter:
- At the bottom of the Add setting window, click Show options.
- Check one or both of these options:
- Only affect specific envelope senders
- Only affect specific envelope recipients
- From the list, choose an option:
- Single email address—Enter the complete email address for a user.
- Pattern match—Enter a regular expression to specify a set of senders or recipients in your domain. For example:
^(?i)(user1@solarmora\.com|user2@solarmora\.com|user3@solarmora\.com)$
Learn more about Guidelines for using regular expressions.
- Group membership—Select one or more groups in the list. For envelope senders, this option applies only to sent mail. For envelope recipients, it applies only to received mail. If you haven't, first create the group.
Note: This option affects group members, and members of child groups. For example, if Group B is a member of Group A, this option affects members of Group A and Group B.
When you're finished, go to Save the configuration.
Save the configuration
Final step: Add and save the setting
- Click Add setting or Save.
New settings open on the Compliance settings page.
- At the bottom, click Save.
Common and custom file types supported in expressions
The table below defines common and custom file types you can use in an attachment compliance expression. For your protection, file types that are considered executables are automatically rejected. Learn more about blocked file types.
- Common file types. By default, all common file types are matched by file format and filename to identify the type of content and the attachment's extension. Examples include image/photo.jpg or document/letter.doc.
- Custom file types. By default, custom file types are matched only by filename, for example, photo.jpg or letter.doc. To match custom file types to file, format as well, check the Also match files based on file format box.
Note: Generally speaking, most formats get converted into text or html (including unknown formats). Content matches are then made against the resultant normalized data.
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.