How to Apply Email Rules to Emails Containing Attachments in Google Workspace

Quick and easy-to-follow guide for Google Workspace administrators

What is the Attachment compliance setting

You can set up email rules that apply to any Google Workspace user account sending or receiving messages with attachments.

What emails can you apply the Attachment compliance setting to

First, you select which emails you want to apply the setting to, based on:

Organizational unit
Direction: Sending, Receiving, or Internal Sending / Receiving
Type of recipient: User, Group, or Non-existent
Specific email addresses or domains
Specific senders or recipients
Attachment file types
Attachment names
Message size

What can you do with the Attachment compliance setting

Then, you select what to do with such emails. You have these options:

Add headers
Modify their subject
Re-route to another mail server
Re-route to a different recipient
Add more recipients (BCC)
Bypass spam filters
Remove attachments
Enforce secure delivery
Reject emails
Quarantine emails

How to configure Attachment compliance in Google Workspace step-by-step with images

Step 1

In the Admin console at https://admin.google.com, click the Apps icon.

Step 2

Select Google Workspace.

Step 3

Click Gmail. Make sure not to check the box to the left; just click the service.

Step 4

Select Compliance.

Step 5

Under Organizational Units, select the OU with the users whose settings you want to update. The same updates will apply to all sub-OUs under the OU you choose.

By default, if you don’t select an OU, you will add your setting to the top OU, named after your domain. This way, you will apply changes to all users in your account.

You can search for an OU to find it faster if you have a large OU structure.

If you’re not familiar with OUs, click here.

Step 6

Find the Attachment compliance setting on this page and click the CONFIGURE button to the right.

If you don’t see the CONFIGURE button, click ADD ANOTHER RULE instead.

Step 7

First, on top, enter a short description of what you’re setting up, so you can recognize this email setting later.

Next, under 1. Email messages to affect, select which emails the compliance filter will work on. They may be:

Inbound: emails coming in from external people outside the domain.
Outbound: emails going out from this domain to external people.
Internal – sending: emails sent internally to other users in the Google Workspace account.
Internal – receiving: emails received internally from other users in the Google Workspace account.

Step 8

Under 2. Add expressions that describe the content you want to search for in each message, you get to say what the filter will look for in emails.

You can have it work whenever any of the expressions are detected or when all expressions are detected.

Click either Add button to add the expressions.

Step 9

You have three types of expressions:

File type – select a file type the filter will search for. If you don’t find yours in the list, you can enter a custom file type at the bottom.

Step 10

File name – the filter will search for attachments by name.

Step 11

Message size – the filter will look for emails whose size (body + attachments) is over x megabytes.

Step 12

Next comes 3. If the above expressions match, do the following. Here, you get to choose what to do with any emails matched by this compliance filter. Modify message offers the following options:

Headers – lets you add custom headers to emails. For example, you can add a custom header matching the description you entered for the setting. This helps analyze why an email was routed in a certain way or what triggered a filter.

Adding the X-Gm-Original-To header is useful when you reroute a copy of an email, and the new recipient wants to know the original recipient’s address. The latest recipient can see the original recipient by checking the X-Gm-Original-To header box in the email.

Add X-Gm-Spam and X-Gm-Phishy headers to indicate if the email is spam or phishing. For example, these headers will look like this:

X-Gm-Spam: 0 (means that the email is not spam)

X-Gm-Spam: 1 (means that the email is spam)

Prepend custom subject allows you to add something to the beginning of emails’ subjects.

Change route allows you to re-route emails to another mail server, already added to the Hosts setting as shown here.

Change envelope recipient allows you to change the email recipient to another email address, bypassing the original recipient.

Bypass spam filter for this message approves emails for delivery automatically, regardless if Gmail’s built-in spam filter thinks they are spam.

Remove attachments from this message strips the emails of all attachments.

Add more recipients adds extra recipients to the email. This acts similar to a BCC, so the sender and recipients of the message won’t know about the additional recipients you have added.

Encryption (onward delivery only) makes it mandatory for a secure connection to be established during the transmission of the email, otherwise, it will not be delivered.

Step 13

Under 3, you can also choose to Reject – additionally, you can type a custom rejection notice.

Step 14

You have the option of sending messages to a spam Quarantine.

Click here to learn about spam quarantines.

Step 15

Before you save the setting, you should also look at the additional options – click Show options at the bottom.

Step 16

Address lists – check to create a list of email addresses and/or domains. Then the Content filter may bypass this list, or only apply to this list.

Account types to affect – users, groups, or unrecognized (non-existent in your Google Workspace)

Envelope filter – you can have it only affect specific senders or recipients.

Click SAVE to add the routing rule.