implementing-google-workspace-phishing-protection

Navigate to Admin Console > Apps > Google Workspace > Gmail > Safety and enable protections against similar-domain spoofing, employee-name spoofing, and inbound domain spoofing. Set the action to quarantine or move to spam rather than relying only on warning banners.

Go to Admin Console > Security > Gmail Enhanced Safe Browsing and turn it on for the organization, since it is off by default. Roll it out per organizational unit to monitor false positives before full deployment.

No, several spoofing protections such as similar-domain and employee-name spoofing detection are not fully enabled by default. Administrators must manually enable each toggle and configure quarantine actions for effective protection.

You need Google Workspace Business Standard or higher, plus Gmail Settings administrator privilege and access to the Admin Console. DNS management access is also required to publish SPF, DKIM, and DMARC records.

DMARC is often left at p=none for monitoring and never progressed to enforcement. After verifying SPF and DKIM pass for outbound mail, update the DMARC policy to quarantine or reject based on organizational readiness.

Enroll high-privilege users such as super admins and executives in Google's Advanced Protection Program, which requires FIDO2 security keys for authentication. APP also blocks unapproved third-party app access and adds enhanced Gmail and Drive scanning.