Google Workspace Email Security: Gateway Routing and Setup

Keep Gmail as the mailbox platform

Google Workspace email security can use an inbound SMTP gateway before Gmail. SecuraWall Email Protection applies configured spam, antivirus, phishing, attachment and quarantine controls on that route. Supported QR/OCR and BEC checks add signals within their documented limits. Backup MX only queues and forwards mail received through its secondary route. This is deployment guidance, not a claim that your Workspace configuration has been tested or automatically integrated.

Record the receiving route before updating DNS

Identify and verify the Google receiving destination appropriate for your domain and routing design. Save it as the separate manual delivery target in SecuraWall before making SecuraWall the only published MX for Email Protection. Do not point delivery back to the protected domain MX after that change. Keep the original DNS and Gmail routing settings so you can reverse a planned migration safely.

Review Gmail inbound gateway settings

Google Admin provides Inbound gateway settings under Apps, Google Workspace, Gmail, Spam, Phishing and Malware. Review public gateway IPs, external-source detection and TLS requirements against the current Google instructions. Gateway configuration affects how Gmail evaluates message authentication; Google notes that sender DMARC policy is not enforced for messages arriving from the inbound gateway, although authentication signals still inform evaluation. Review this behavior explicitly rather than assuming the original direct-delivery checks are unchanged.

Restrict direct delivery only after route testing

The optional Gmail setting that rejects mail not coming from gateway IPs needs a deliberate scope review. Check the domains and other sending paths affected before enabling it. Do not apply it indiscriminately to Backup MX, where the primary route must remain usable. Incoming forwarding and authenticated outgoing relay are different operations. SMTP Relay requires a separate add-on and approved sending setup; this guide does not configure a Google outbound connector.

Verify outcomes and separate user provisioning

Send a controlled message to a mailbox you own and compare the SecuraWall queue and scan records with Google delivery logs and actual mailbox receipt. Review authentication results, quarantine and destination errors. A 220 greeting only proves SMTP reachability, while a remote 250 response still does not prove inbox placement. The gateway does not create Gmail mailboxes or aliases. Manual and CSV quarantine access are local SecuraWall provisioning methods; Google Directory synchronization, OAuth mailbox access and Google single sign-on are not provided by this SMTP routing guide.

References and service conditions

• Google: set up an inbound mail gateway
• Current plan limits
• Security responsibilities