How to Enforce Secure Email Transmission for Google Workspace Users (TLS Compliance)

Quick and easy-to-follow guide for Google Workspace administrators

What is TLS

TLS is an email security protocol that encrypts emails for safe delivery.

Gmail message transmission security

By default, Gmail always uses TLS whenever the recipient you are sending to also supports TLS.
If the recipient doesn’t support TLS, you can’t establish a secure connection, and Gmail sends the message without TLS.

What is the TLS compliance setting

You can make sure that TLS is mandatory when communicating with specific email addresses or domains.
If the TLS connection fails, but you have enforced it using the TLS compliance setting, outgoing mail won’t be delivered. It will bounce back to you with an error message.
The same applies to incoming mail. However, only the sender will be notified that the delivery failed – you won’t receive an error on your end.

How to set up TLS compliance in Google Workspace step-by-step with images

Step 1

In the Admin console at https://admin.google.com, click the Apps icon.

Step 2

Select Google Workspace.

Step 3

Click Gmail. Make sure not to check the box to the left; just click the service.

Step 4

Select Compliance.

Step 5

Under Organizational Units, select the OU with the users whose settings you want to update. The same updates will apply to all sub-OUs under the OU you choose.

By default, if you don’t select an OU, you will add your setting to the top OU, named after your domain. This way, you will apply changes to all users in your account.

You can search for an OU to find it faster if you have a large OU structure.

If you’re not familiar with OUs, click here.

Step 6

Find the Secure transport (TLS) compliance setting on this page and click the CONFIGURE button to the right.

If you don’t see the CONFIGURE button, click ADD ANOTHER RULE instead.

Step 7

First, give the setting a short description on top.

Then under 1. Email messages to affect; check the box for each type of email you’d like to use TLS with. This setting can affect all incoming mail, outgoing mail, and outgoing mail requiring TLS via another setting.

Next under 2. Use TLS for secure transport when corresponding with these domains/email addresses; create a list and add domains/email addresses.

Click Use existing list if you already have a list. If not, click Create or edit list.

Step 8

Clicking Create or edit list takes you to the Manage address lists section.

You can Edit or Delete the existing rule or click ADD ADDRESS LIST to add a new list.

Step 9

Start by naming the list.

Then add the email addresses or domains that you want to add to the list. If you trust the sender, disable the Authentication required button, or you may end up actually rejecting their messages due to this setting.

Click BULK ADD ADDRESSES to add many addresses at once or click ADD ADDRESS to add a new address.

When you’re ready, click SAVE. Then go back to the TLS Compliance setting.

Step 10

At the TLS Compliance setting, under 2. Use TLS for secure transport when corresponding with these domains/email addresses; click Use existing list.

Step 11

Then check the box to the left of any list you want to add to the setting.

Step 12

Optionally, under 3. you may want to require a CA-signed certificate when delivering to anyone on the list. This means that their email server must present a certificate signed by a Certificate Authority that Google trusts.

If you’re unsure if they have one, it’s probably best not to enable this setting. Click Test TLS connection, and if you get an error as we did above, you can notify them to let them know there’s an issue with their certificate.

In such a case, uncheck the Require CA-signed certificate box and click SAVE.

Step 13

Now you can see your setting listed in the Attachment compliance section. You can Edit it, Disable it (turn off temporarily), Delete (completely remove, no restore option) or ADD ANOTHER RULE.

It may take up to 24 hours before the changes kick in.

That's all! You reached the end of the article. Continue to:

Optimized by Seraphinite Accelerator
Turns on site high speed to be attractive for people and search engines.

How to Enforce Secure Email Transmission for Google Workspace Users (TLS Compliance)

Quick and easy-to-follow guide for Google Workspace administrators

What is TLS

Gmail message transmission security

What is the TLS compliance setting

How to set up TLS compliance in Google Workspace step-by-step with images

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Step 9

Step 10

Step 11

Step 12

Step 13

That's all! You reached the end of the article. Continue to:

If you find this useful, share and help others!

Enable Warnings for Unintended Email Replies

Enable Enhanced Gmail Message Scanning

Set up TLS Compliance Rules

Designate an Alternate Secure Route for TLS Compliance

Better Gmail and email marketing

Protect your data and maximize security

Process optimization and collaboration

Resources for website creators

Submit Feedback

Report An Issue With Workspace123

Missing Content

Be the first to know