Google Workspace

Hardening

Inbound email gateway

Overview

To configure Cloud Email Security with Google Workspace for inbound email, we will perform the following steps:

Google Workspace configuration

Perform the following steps:

1. Sign in to your Google Admin console.

Sign in using an administrator account.

2. From the Admin console Home page, go to Apps > Google Workspace > Gmail > Advanced settings.

Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

3. In the Organizations section on the left, select the top-level organization (typically your primary domain).
4. Scroll to the Inbound gateway setting in the Spam section. Hover over the setting and click Configure to create a new setting or click Edit to edit an existing one.
5. Enter a description.
6. Under Gateway IPs, click Add and enter the IP address or range of addresses of Cloud Email Security server(s).

Note: Be sure to enter public IP addresses, as private IP addresses are not accepted.

7. Click Save.

Cloud Email Security configuration

Perform the following steps:

1. Install and configure MetaDefender Cloud Email Security. For details see Installation/Prerequisites.

2. Configure SMTP server profiles according to the existing MX record setup (SMTP server URL address values to point to the addresses present in the MX records). This is the way for Cloud Email Security to forward incoming emails to Google. For details see Configuration/Server profiles and Configuration/Policy.

3. Configure the appropriate security rules (the ones that will handle incoming email) as Inbound under Security Rules / rule / GENERAL / Rule direction. For details see Configuration/Policy.

   1. Set the server profiles created in the previous step as SMTP relay server profile for these rules.

4. Configure MetaDefender Cloud Email Security to listen on port 25. For details see the SMTP servers section in Configuration/Settings.

MX record redirection

Refer to your Internet domain registrar for details how to change MX record to point to MetaDefender Cloud Email Security IP address.

Outbound email gateway

Overview

To configure Cloud Email Security with Google Workspace for outbound email, we will perform the following steps:

An architecture like this is going to be created:

Google Workspace configuration

Outbound forwarding configuration

Perform the following steps:

1. Sign in to your Google Admin console.

Sign in using an administrator account.

2. From the Admin console Home page, go to Apps > Google Workspace > Gmail > Advanced settings.

Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

3. In the Organizations section on the left, select the top-level organization (typically your primary domain).
4. Scroll to the Outbound gateway setting in the Routing section.
5. Enter the outbound gateway server address of the Cloud Email Security server.
6. At the bottom of the Advanced settings page, click Save.

SMTP relay configuration

Perform the following steps:

1. Sign in to your Google Admin console.

Sign in using an administrator account.

2. From the Admin console Home page, go to Apps > Google Workspace > Gmail > Advanced settings.

Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

3. In the Organizations section on the left, select the top-level organization (typically your primary domain).

Note: You can configure the SMTP relay service setting for the top-level organization only.

4. Scroll to the SMTP relay service setting in the Routing section, hover over the setting, and click Configure. If the setting is already configured, hover over the setting and click Edit or Add another.

5. For a new setting, enter a unique description.

6. In the Allowed senders section, select Only addresses in my domains. This way the sender must be in one of your registered domains.

7. In the Authentication section, check Only accept mail from the specified IP addresses. This way the system only accepts email sent from Cloud Email Security.

8. Enter the IP address of Cloud Email Security:

   1. Click Add IP RANGE,
   2. Enter a description for the IP address,
   3. Enter the IP address of Cloud Email Security,
   4. Check the Enabled box to enable this IP address,
   5. Click Save.

9. Click Add setting or Save. Any new settings are added to the Advanced settings page.

10. At the bottom, click Save.

Cloud Email Security configuration

Perform the following steps:

1. Install and configure MetaDefender Cloud Email Security. For details see Installation/Prerequisites.

2. Configure SMTP server profiles accordingly to route outgoing messages back to Google for delivery (SMTP server URL address values to point to Google SMTP-relay address smtp-relay.gmail.com). This is the way for Cloud Email Security to loop outbound emails back to Google after processing. For details see Configuration/Server profiles and Configuration/Policy.

3. Configure the appropriate security rules (the ones that will handle outgoing email) as Outbound under Security Rules / rule / GENERAL / Rule direction. For details see Configuration/Policy.

   1. Set the server profiles created in the previous step as SMTP relay server profile for these rules.

4. Configure MetaDefender Cloud Email Security to listen on port 25. For details see the SMTP servers section in Configuration/Settings.

Email Assessment

To setup the Email Assessment with Microsoft 365 Graph API integration, perform the following steps:

1. Sign in to your Google Admin console.

Sign in using an administrator account.

2. From the Admin console Home page, go to Apps > Google Workspace > Gmail > Compliance.

3. (Optional) On the left, select the organization.

4. Scroll to the Content compliance setting in the Compliance section, hover over the setting, and click Configure. If the setting is already configured, hover over the setting and click Edit or Add another.

5. For each new setting, enter a unique short description, e.g. OPSWAT Email Risk Assessment.

6. In Email messages to affect, select Inbound.

7. From the list, specify whether any or all conditions must match to trigger what happens to the message. Select If ANY of the following match the message.

8. In the Expressions box click Add.

9. From the dropdown choose the type Advanced content match.

   1. In Location, select Headers and body from the dropdown.
   2. In Match type select Matches regex.
   3. In Regexp input the desired regular expression that matches the messages you want to assess. For example if you want to assess messages of joe@example.com and dan@example.com then use the regular expression (joe@example\.com)|(dan@example\.com). If you want to assess all messages use the regular expression .*.
   4. Select SAVE.

10. Under If the above expression match, do the following select Modify message from the dropdown.

    1. Set up dual delivery: check the Add more recipients box then in the Recipients box click Add .

       1. Add your individual assessment email address:

          1. Select Advanced from the dropdown.

          2. In Envelope recipient select Change envelope recipient.

          3. Select Replace recipient and add your individual assessment email address (see below).

          4. Make sure that in Spam and delivery options the option Do not deliver spam to this recipient is not checked.

          5. Under Headers select Add X-Gm-Spam and X-Gm-Phishy headers.

          6. Click Save.