Despite the fact that Google Workspace (formerly known as G Suite) includes spam filtering, we still get Google Workspace users signing up to use SpamHero for improved filtering.
Setting up an inbound gateway is highly recommend as it will prevent spammers from getting around our filter and also allow DMARC authenticated emails from being rejected.
This article has been superseded by a new article from Google on setting up an inbound gateway
The instructions below have not been compared to the new article published by Google in the above article.
The (possibly obsolete) instructions below are based on the instructions Google has published for using outside email gateways such as SpamHero before G Suite was renamed to Google Workspace:
Setting your G Suite Inbound mail gateway to SpamHero
- Inbound gateways are available for the Business and Education editions of G Suite. If you are using another edition of G Suite, these instructions may not apply.
- Using SpamHero's outbound service with G Suite is not yet supported, but may be implemented in the future.
The inbound mail gateway setting enables you to designate SpamHero as the source of all your incoming email.
- Update your domain's MX records as instructed in the SpamHero setup instructions.
- Configure SpamHero to deliver mail to the G Suite mail servers (go to Settings > mail host in your SpamHero settings). SpamHero should automatically enter the primary G Suite mail host name if you did not previously have spam filtering enabled on your Google Apps account. Either way, you will want to update the Settings > mail host setting in SpamHero to list all of the Google Apps mail servers. For your convenience, Google has published a list of them here:
Do not enter the priority numbers, just list the mail hosts in the same order they appear on the above page.
Ensure to also set the Mail host configuration to **Mail host will only accept email from specific IPs or on a specified port**. This way we send from a predictable set of IP addresses.
- Log into the G Suite control panel for your domain, and click G Suite > Gmail > Advanced Settings, then scroll down to the Spam, phishing, and malware section, to the Inbound gateway option.
- In the Inbound gateway option, click CONFIGURE, then setup the gateway's name, and click ADD for each of the IP addresses for SpamHero, as found here:
- Select the check box that says "Reject all mail not from gateway IPs". This setting ensures that all incoming email comes through the inbound gateway server and is therefore properly filtered or archived. The Google Apps mail servers will reject incoming mail from any other mail server.
- Save your changes.
- Verify that incoming mail is properly delivered. Once your MX record changes from step 1 have taken effect (that is, after the previous MX record's TTL has expired), send an email message to a user in your domain. Confirm that (a) the inbound gateway server processes it and (b) the user receives the message in his or her inbox.