Google Workspace is the email platform of choice for a large and growing segment of Indian businesses — from startups to mid-size enterprises and educational institutions. Gmail's spam filter has an excellent reputation, and it earns it: for mass spam, known phishing campaigns and commodity malware, Google's AI-powered filtering is among the best available.
But targeted email threats are a different matter. Business Email Compromise (BEC), spear phishing, CEO fraud, zero-day malware in attachments, and delayed-activation URLs are specifically designed to bypass mass-threat detection systems. These are the attacks that cost Indian businesses crores — and they often come from clean domains, carry no malicious attachments, and contain no known bad URLs.
This guide explains what Google Workspace's built-in email security covers, where the gaps are, and what third-party platforms Indian businesses add to fill them.
What Email Security is Built into Google Workspace?
Google Workspace's email security capabilities are more substantial than most users realise. Here is what is included across all paid Google Workspace plans:
Gmail Spam Filter
Google's spam filter uses machine learning models trained on billions of emails across all Gmail accounts worldwide. It is genuinely excellent at:
- Bulk spam — blocking mass campaign emails from known spam networks
- Phishing from known domains — catching emails from domains Google has identified as phishing infrastructure
- Malware attachments (known) — scanning attachments against virus databases using multiple AV engines
- Suspicious links (known) — blocking emails containing URLs on Google's Safe Browsing blocklist
Google claims a spam detection rate exceeding 99.9% for commodity threats. This is broadly accurate for mass campaigns.
Google Workspace Email Security Settings (Admin Console)
Beyond the spam filter, Google Workspace admins can configure:
- SPF, DKIM and DMARC — Google Workspace generates DKIM keys natively; you publish SPF/DMARC via DNS
- MX record validation — confirms email comes from legitimate mail servers
- Email quarantine — quarantine policies for spam, phishing and suspicious emails
- Comprehensive mail storage — Vault archiving (included from Business Starter)
- Data Loss Prevention (DLP) — content-based outbound filtering (available on Business Plus and above)
- S/MIME encryption — for Business Plus and above, end-to-end encryption for sensitive emails
- Advanced phishing and malware protection — under-used settings in Admin Console that include attachment scanning for encrypted archives, scripts, and files from untrusted senders
What Google Workspace Does Not Include
Despite Google's strong spam filtering, there are specific threat categories where Google Workspace's native capabilities fall short:
1. AI-powered BEC and impersonation detection Google's spam filter is trained on mass campaigns. It does not have a dedicated AI model for Business Email Compromise — display name spoofing where an attacker uses "Sanjeev Gupta, CEO" as the display name with a fraudulent sending address.
Google does block some impersonation attempts, but sophisticated BEC attacks from clean domains, newly registered lookalike domains, and compromised legitimate accounts bypass Google's filters regularly.
2. Cloud sandboxing for zero-day attachments Google scans attachments against known virus databases. It does not detonate suspicious attachments in an isolated sandbox environment to catch zero-day malware — malware that has never been seen before and has no signature to match.
Zero-day PDF exploits, weaponised Office macros, and novel malware payloads in ZIP files pass Google's attachment scanning until they are identified by the threat intelligence community — which can take hours or days.
3. Time-of-click URL rewriting Google Safe Browsing checks URLs at delivery time against its blocklist of known malicious sites. It does not rewrite URLs so they are re-checked at the moment a user clicks.
The attack type this misses: a URL that is clean at the time the email arrives (no Google Safe Browsing entry) but points to a malicious page that goes live two hours later. Google's check is done — the user sees the email as clean. When they click the link hours later, there is no second check.
4. Email continuity If your Google Workspace tenant experiences an outage (it happens, though rarely), your email is simply unavailable. Google does not provide an independent continuity inbox that operates when Gmail is down.
5. 99-year compliance archiving independent of Google Google Vault provides archiving within Google Workspace. But Vault archives are tied to your Google Workspace subscription — if you cancel, migrate to another platform, or experience a tenant-level issue, your archive is at risk.
Who Targets Google Workspace Users?
Google Workspace's market dominance makes it a primary target. Attackers specifically:
- Register domains that look like Google Workspace admin domains to run credential phishing
- Craft BEC emails that exploit the fact that Gmail on mobile displays only the sender name, not the full email address
- Exploit Google's own services (Google Docs sharing notifications, Google Forms, Google Drive links) to bypass email security — the links are to legitimate Google domains and pass all filters
- Use newly registered, reputation-zero domains to avoid Google's blocklists
Third-Party Email Security for Google Workspace — The Options
Sophos Email Security — The Natural Choice for GWS
Sophos Email is the most commonly deployed third-party email security platform for Google Workspace in India, and for good reason: it deploys cleanly as an MX gateway in front of Gmail, Cloudfy manages both GWS and Sophos from a single engagement, and the integration is straightforward.
How it works with Gmail: Your domain's MX records point to Sophos Email first. All inbound email flows through Sophos's cloud scanning layer, which applies:
- AI impersonation detection (BEC, display-name spoofing, lookalike domains)
- Sophos Sandstorm cloud sandboxing (detonates zero-day attachments)
- Time-of-click URL rewriting (re-checks links at click time)
- Outbound DLP (Advanced edition)
- Email continuity (30-day spooling)
Clean email is then forwarded to Gmail. The user experience is unchanged — they still use Gmail on web, mobile and Outlook. The only difference is that threats are caught before they arrive.
Cloudfy advantage: Since Cloudfy is both a Google Workspace partner and an authorised Sophos partner, we handle the MX reconfiguration, SPF/DKIM alignment, Sophos Central policy setup and post-deployment tuning in a single coordinated deployment.
Best for: SMBs using Google Workspace who want AI BEC detection and sandbox scanning without disrupting their Gmail experience.
→ View Sophos Email Security for Google Workspace
Mimecast — Best for GWS + Continuity + Archiving
Mimecast deploys as an MX gateway in front of Google Workspace, adding the same three-pillar capabilities it provides for Microsoft 365 users.
Key capabilities added over Google's built-in:
- Mimecast Targeted Threat Protection — AI phishing and impersonation detection
- Email continuity — email keeps flowing even if Gmail is down
- 99-year archiving — independent of your Google Workspace subscription; critical for SEBI, RBI, IT Act compliance
- DMARC Analyser — included; helps you identify all sources sending email from your domain
Best for: Google Workspace organisations with compliance archiving requirements, businesses that need email continuity, and companies using DMARC Analyser for domain protection.
→ View Mimecast Email Security
Barracuda Email Protection — API-Native Option
Barracuda offers both MX gateway and API-native deployment options. For Google Workspace, it connects via Google Workspace API to scan email and provides additional protection without MX changes.
Unique capability for GWS: Barracuda's lateral phishing detection catches attacks from compromised Google Workspace accounts — when an employee's Gmail is hijacked and used to send phishing or BEC emails to colleagues from the inside.
Best for: Google Workspace organisations that want zero MX disruption and lateral phishing protection.
→ View Barracuda Email Protection
Google Workspace Email Security Configuration Checklist
Before evaluating third-party tools, make sure these built-in protections are enabled:
DKIM (Google Workspace Admin Console):
- Apps → Google Workspace → Gmail → Authenticate email
- Generate a DKIM record for your domain
- Add the DKIM TXT record to your DNS
- Wait 48 hours, then enable DKIM signing
SPF (DNS):
- Add TXT record:
v=spf1 include:_spf.google.com ~all - Verify no duplicate SPF records exist
DMARC (DNS):
- Add TXT record at
_dmarc.yourdomain.com:v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com - Monitor for 4+ weeks before moving to p=quarantine then p=reject
Advanced phishing & malware protection (Admin Console → Apps → Google Workspace → Gmail → Safety):
- Enable "Enhanced pre-delivery message scanning"
- Enable "Attachments — Additional protections" → Protect against anomalous attachment types
- Enable "Links and external images — Additional protections" → Identify links behind short URLs
- Enable "Spoofing and authentication — Additional protections" → all three spoofing options
Google Vault:
- Confirm Vault is enabled and retention rules are configured
- Verify legal holds are in place for any active litigation matters
2-Step Verification:
- Enforce 2SV for all users via Admin Console → Security → 2-step verification
SPF Configuration for Google Workspace with Multiple Sending Services
A common challenge for Google Workspace businesses is SPF configuration when you use multiple email sending services. The SPF record include:_spf.google.com only authorises Google's servers. If you also use:
- Mailchimp or SendGrid for marketing email — add their
include:to your SPF - Zoho CRM or HubSpot for CRM email — add their sending domain
- Tally or Zoho Books for invoicing — check if they send from your domain
Remember the SPF 10-lookup limit. If you include too many services, your SPF record fails permanently. Use an SPF lookup tool (mxtoolbox.com/spf.aspx) to count your current DNS lookups.
Full DMARC configuration guide: DMARC Setup Guide for Indian Businesses
Google Workspace + Sophos Email: How the Deployment Works
For reference, here is the MX gateway deployment process for Google Workspace + Sophos Email:
Step 1 — Sophos Email provisioning Cloudfy creates your Sophos Email tenant, configures your domain, and generates the Sophos MX hostnames.
Step 2 — MX record update Your domain's MX records are updated to point to Sophos Email instead of Google. This is a DNS change that typically propagates within 1–24 hours. During propagation, some mail continues through Google's MX.
Step 3 — Smart host configuration (Gmail) In Google Workspace Admin Console, configure a smart host (inbound gateway) so Gmail recognises that email from Sophos's IPs is legitimate and doesn't apply Google's spam filter redundantly on email that has already been scanned.
Step 4 — SPF update
Add Sophos's SPF include: to your SPF record alongside _spf.google.com so outbound email signed by Sophos passes SPF.
Step 5 — Policy configuration Sophos Central: configure anti-spam thresholds, impersonation protection policies, sandboxing policies, URL protection policies, quarantine notifications and user allow/block lists.
Step 6 — Post-deployment tuning Review the first 48 hours of quarantine to identify any legitimate email caught by Sophos policies. Adjust whitelists accordingly.
Total deployment time: 2–4 hours of active work + DNS propagation. No email downtime.
FAQs
Does Google Workspace detect BEC attacks?
Partially. Google's spam filter catches some BEC patterns, particularly those from known bad senders. But it does not have a dedicated AI impersonation detection model for targeted BEC — CEO fraud from a lookalike domain, display-name spoofing, or vendor impersonation from a clean domain typically bypass Google's filter. Dedicated tools like Sophos Email Advanced or Mimecast add this specifically.
Will adding a third-party email gateway slow down email delivery?
No — cloud email gateways are designed for minimal latency. Sophos Email, Mimecast and Barracuda all claim sub-second scanning latency for clean emails. In practice, delivery times are indistinguishable from direct delivery to Gmail.
Does this affect Gmail on mobile?
No. The MX gateway operates at the server level — between the internet and your Google Workspace mail server. End users continue using Gmail on web, mobile app, or any mail client exactly as before. The only visible change is the quarantine digest email (if configured) notifying users of emails that were blocked.
Can I use Google Vault and third-party archiving at the same time?
Yes. Google Vault and Mimecast's independent archiving can run simultaneously. This is actually recommended for organisations with strict compliance requirements — you have both an on-platform archive (Vault) and an independent archive (Mimecast) that survives a Google tenant issue.
How does Cloudfy help with Google Workspace email security?
Cloudfy is an authorised Google Workspace partner and an authorised partner for Sophos Email, Mimecast and Barracuda. We handle both sides of the deployment — the Gmail configuration and the third-party gateway setup — in a single coordinated engagement with INR billing and GST invoice.
Contact us for a free email security assessment for your Google Workspace environment. We'll review your current SPF/DKIM/DMARC configuration, check which Admin Console protections are enabled, and recommend the right third-party layer based on your team size and threat profile.