Workspace admins control SPF, DKIM, and DMARC from the Admin console, and inbound policy from the Gmail spam settings.
What phishing protection is#
Phishing is the use of deceptive email to steal credentials, money, or data. Defense combines domain authentication, inbound filtering, user training, and rapid reporting.
Why it matters#
Phishing remains the leading initial access vector in breaches. Domain owners also bear brand damage when their name is spoofed.
Setting up phishing protection for Google Workspace#
- Enforce DMARC p=reject so exact-domain spoofing fails.
- Register lookalike domains or monitor them for registration.
- Enable link rewriting and attachment sandboxing at the gateway.
- Run quarterly simulations and make reporting a one-click action.
- Apply BIMI so users learn what authentic mail looks like.
How Google Workspace reports results#
Open a delivered test message in Google Workspace and view the original or headers. Look for Authentication-Results and any provider-specific verdict headers. Use the provider's sender dashboard for aggregate reputation.
Common mistakes#
- Blaming users while leaving the domain unprotected.
- Allow-listing vendors broadly, which bypasses filtering.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.
Does Google Workspace require phishing protection?
Workspace admins control SPF, DKIM, and DMARC from the Admin console, and inbound policy from the Gmail spam settings. Treat phishing protection as required for any meaningful volume.