Starting in early 2024, Google tightened three enforcement efforts in the organization’s on-going fight against spam. First, bulk senders of email must authenticate email with domain-related email settings to ensure each email is actually from the sender specified. Second, large senders of email must offer a one-click unsubscribe option and process the request within two days, so people don’t experience absurdly long delays or complicated opt-out processes when they unsubscribe. Third, Google will enforce a spam rate threshold, so people who send too many messages that recipients report as spam will be much less likely to reach your inbox.
These changes have implications for Google Workspace administrators and every person who uses Gmail. Administrators, at a minimum, must make certain that email authentication is active and properly configured to ensure reliable email delivery and prevent spoofing. Gmail users must take care to not mass-send unwanted emails so as to not have an account flagged as a spammer. Details and links for both are covered below.
A Google Workspace administrator may manage several settings that help reduce spam email issues for the entire organization. The most critical one-time task is to activate DKIM for Gmail in the Google Workspace Admin console and configure two domain name system text records with your DNS provider. The other settings offer additional spam protections, but the authentication step is critical.
To prevent spoofing, a Google Workspace administrator must manage three email-related settings: DKIM, SPF and DMARC.
All three settings work together to ensure that your organization’s outbound email is authenticated and therefore more likely to be delivered to recipients’ inboxes.
A Google Workspace administrator can enable enhanced pre-delivery message scanning to prevent fraudulent email from being delivered to inboxes. This setting requires a one-time check of a box in the Admin Console: Apps | Google Workspace | Gmail | Spam, Phishing, And Malware | Select the check box that Enables Improved Detection Of Suspicious Content Prior To Delivery and then select Save. Note that this may introduce a slight delivery delay for some email messages.
Additionally, most administrators will want to enable a whole set of advanced options found in the Admin Console | Google Workspace | Gmail | Safety | Spoofing And Authentication | Select the pencil to edit, then check the box next to every option. Select Save when done.
Another way to deal with recurring spam is to add a sender’s domain to a blocked senders list. This blocks all email from either an email address or domain to any recipient in your organization. In a school setting, for example, an administrator might add a commonly mistyped domain to this list, such as whitehouse.com, which is a gambling site as of 2024. Access this in the Admin Console | Apps | Google Workspace | Gmail | Spam, Phishing, And Malware | Blocked Senders Option, then select Configure.
Similarly, an administrator may add domains to an approved senders list. This signals that email from the specified domain should be delivered to your organization’s accounts. In a school setting, the domains of a parent organization, local government or funding organization are often added to this list. In an enterprise setting, domains of partners, suppliers, vendors or affiliated companies are typically set to as always allowed. Access this in the Admin Console | Apps | Google Workspace | Gmail | Spam, Phishing, And Malware | Spam option, then select Configure.
Google’s changes may mean more email delivered to a user’s Gmail spam folder than the inbox. The following actions are available to people who use Gmail and can help reduce unwanted email.
Gmail gives you the option to report email either as spam or not spam. When you discover a spam email in your inbox, select the email, then click or tap the Report Spam icon. This indicates you prefer emails from that sender be sent to spam instead of your inbox.
Correspondingly, when you identify an email in spam that should not be labeled as such, select the email and then click or tap the Not Spam button. This sends a signal to the system that you think the email should not have been placed in spam and moves it into your inbox.
Make sure any mass emails you send offer an unsubscribe option. For example, when you send an email using Google’s mail merge feature, the templates include an Unsubscribe link by default. This also applies to any third-party email system you might use, such as Constant Contact, Mailchimp or Salesforce.
Email from people you have added to Google Contacts will be more likely to be delivered to your Gmail inbox. A series of searches and cleanout of your Gmail messages may help you identify addresses from senders to add to Contacts. To add addresses, go to Google Contacts on the web, select the + Create Contact button, then add your contact’s details, including their email address(es).
The Advanced Protection Program adds layers of security to your Google account, including more rigorous sign-in procedures, stronger limitations on third-party sign-ins and constraints on external application data access. You’ll need security keys — physical pieces of hardware — in order to enroll in the Advanced Protection Program. Once activated, the Advanced Protection Program makes it much more difficult for anyone other than you to access your account.
You may enroll in the Advanced Protection Program with any personal Gmail account; however, organizational users should know that a Workspace admin can choose to enable or disable the Advanced Protection Program for Workspace organizational accounts. If you are unable to enroll either a work or school account, check with your Google Workspace admin for details.
Beyond Google-provided controls, the Data & Marketing Association lets you register your email address with the Email Preference Service. Once added, the ethical email marketers who rely on this list will remove your address from unsolicited emailings. You may enter as many as three email addresses at a time, then confirm your removal request by clicking on a link in an email sent to each address.
Mention or message me on X (@awolber) to let me know how you deal with spam, either as a Google Workspace administrator or Gmail user.
