How to Apply Email Rules to Emails With Specific Content or Patterns in Google Workspace

Quick and easy-to-follow guide for Google Workspace administrators

What is the Content compliance setting

You can set up email rules for incoming or outgoing messages containing specific phrases, text, or other patterns.

What emails can you apply the Content compliance setting to

First, you select which emails you want to apply the setting to, based on:

Organizational unit
Direction: Sending, Receiving, or Internal Sending / Receiving
Type of recipient: User, Group, or Non-existent
Specific email addresses or domains
Specific senders or recipients
Specific content

What can you do with the Content compliance setting

Then, you select what to do with such emails. You have these options:

Add headers
Modify their subject
Re-route to another mail server
Re-route to a different recipient
Add more recipients (BCC)
Bypass spam filters
Remove attachments
Enforce secure delivery
Reject emails
Quarantine emails

How to configure content compliance rules in Google Workspace step-by-step with images

Step 1

In the Admin console at https://admin.google.com, click the Apps icon.

Step 2

Select Google Workspace.

Step 3

Click Gmail. Make sure not to check the box to the left; just click the service.

Step 4

Select Compliance.

Step 5

Under Organizational Units, select the OU with the users whose settings you want to update. The same updates will apply to all sub-OUs under the OU you choose.

By default, if you don’t select an OU, you will add your setting to the top OU, named after your domain. This way, you will apply changes to all users in your account.

You can search for an OU to find it faster if you have a large OU structure.

If you’re not familiar with OUs, click here.

Step 6

Find the Content compliance setting on this page and click the CONFIGURE button to the right.

If you don’t see the CONFIGURE button, click ADD ANOTHER RULE instead.

Step 7

First, on top, enter a short description of what you’re setting up, so you can recognize this email setting later.

Next, under 1. Email messages to affect, select which emails the compliance filter will work on. They may be:

Inbound: emails coming in from external people outside the domain.
Outbound: emails going out from this domain to external people.
Internal – sending: emails sent internally to other users in the Google Workspace account.
Internal – receiving: emails received internally from other users in the Google Workspace account.

Step 8

Under 2. Add expressions that describe the content you want to search for in each message, you get to specify what the filter will look for in emails.

You can have it work whenever any expressions are detected or when all expressions are detected. Next, click either Add button to add expressions.

Step 9

You have three options when setting up an expression.

Simple content match: works like the search function in Gmail.

For example, if you type “a word,” any text with “a” and “word” is returned. For example: “a new and different word” is a match.

Predefined content match: available only with Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus.

This option allows you to choose predefined searches, like ones for Credit Card numbers or Social Security numbers.

Step 10

Advanced content match: select the Location to search and how it gets matched under Match type. Then enter the content to search for.

The text must be an exact match. If you type “a word,” text such as “a new and different word.” won’t match, but “she wrote a word” will.

Click SAVE to add the expression.

Step 11

Metadata match: allows you to choose an Attribute to search for, like message authentication, source IP, TLS, or message size.

Then you also get to choose the match type – for example, an email may match if it is or isn’t authenticated with SPF/DKIM.

Step 12

Next comes 3. If the above expressions match, do the following. Here, you get to choose what to do with any emails matched by this compliance filter. Modify message offers the following options:

Headers – lets you add custom headers to emails. For example, you can add a custom header matching the description you entered for the setting. This helps analyze why an email was routed in a certain way or what triggered a filter.

Adding the X-Gm-Original-To header is useful when you reroute a copy of an email, and the new recipient wants to know the original recipient’s address. The latest recipient can see the original recipient by checking the X-Gm-Original-To header box in the email.

Add X-Gm-Spam and X-Gm-Phishy headers to indicate if the email is spam or phishing. For example, these headers will look like this:

X-Gm-Spam: 0 (means that the email is not spam)

X-Gm-Spam: 1 (means that the email is spam)

Prepend custom subject allows you to add something to the beginning of emails’ subjects.

Change route allows you to re-route emails to another mail server, already added to the Hosts setting as shown here.

Change envelope recipient allows you to change the email recipient to another email address, bypassing the original recipient.

Bypass spam filter for this message approves emails for delivery automatically, regardless if Gmail’s built-in spam filter thinks they are spam.

Remove attachments from this message strips the emails of all attachments.

Add more recipients adds extra recipients to the email. This acts similar to a BCC, so the sender and recipients of the message won’t know about the additional recipients you have added.

Encryption (onward delivery only) makes it mandatory for a secure connection to be established during the transmission of the email, otherwise, it will not be delivered.

Step 13

Under 3, you can also choose to Reject – additionally, you can type a custom rejection notice.

Step 14

You have the option of sending messages to a spam Quarantine.

Click here to learn about spam quarantines.

Step 15

Before you save the setting, you should also look at the additional options – click Show options at the bottom.

Step 16

Address lists – check to add a list of email addresses and/or domains. Then the Content filter may bypass this list, or only apply to this list.

Account types to affect – users, groups, or unrecognized (non-existent in your Google Workspace)

Envelope filter – you can have it only affect specific senders or recipients.

Click SAVE to add the routing rule.