Set up an inbound mail gateway

As an administrator, you can set up Gmail to accept messages it gets from inbound mail gateways.

An inbound mail gateway is a mail server that processes inbound email in some way, before messages are delivered to recipients. For example, inbound gateways typically check for spam, archive messages, and scan for harmful attachments or software. Inbound gateways are useful for larger organizations with a lot of email. The processing that gateways perform frees up primary email servers to deliver messages to recipients.

Specify the inbound mail gateway IP address, or range of IP addresses, in the Inbound gateway setting.

Optionally, you can set up the gateway to:

• Automatically detect the external IP.
• Reject messages that aren't sent from the gateway.
• Require that connections from the gateway use Transport Layer Security (TLS).
• Manage spam based on gateway message tags.

Important: 

• Inbound gateway settings don't support private IP addresses.
• Gmail does not enforce the sender's DMARC policy for messages that arrive from the inbound gateway. Gmail does use authentication information for compliance evaluation and to help prevent spam and phishing.

Before you begin

Before you set up your inbound gateway, point the MX records for your domain to the gateway. For detailed instructions, visit Set up MX records.

Set up an inbound gateway

Set up the gateway to deliver messages to Gmail servers. Configuration steps differ depending on your gateway server.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceGmailSpam, Phishing and Malware.
3. On the left, select your top-level organization. 
4. Scroll to the Inbound gateway setting, then click Edit . The Inbound gateway settings open on the page.
5. Take these steps in inbound gateway settings:

    

   Setting	What to do
   1. Gateway IPs	Set up the IP addresses and options for your gateway: Click Add. The Add IP address/range box opens. In the Add IP address/range box, enter the gateway IP address or range of addresses. If messages pass through multiple gateways before reaching Gmail, add all gateway IP addresses. Enter only public IP addresses. Gmail doesn't support private IP addresses for gateways. In the Add IP address/range box, click Save. Automatically detect external IP—(Optional) When this option is selected, Gmail determines the source IP address to use for the SPF authentication. How Gmail determines the source IP address: Gmail scans Received: from message headers to find the first public IP address that’s not in the Gateway IP list. Gmail treats this IP address as the source IP for the message. This IP address is used for SPF authentication and spam evaluation. Learn more about how Gmail determines the source IP. When this option is off, Gmail checks only one hop backwards for the sending IP address. Reject all mail not from gateway IPs—(Optional) When this option is selected, messages from senders other than the inbound gateway are rejected. Require TLS for connections—(Optional) When this option is on, connection attempts gateways that don't use TLS are rejected. Learn more about setting up TLS for Gmail.
   2. Message tagging (Optional)	To set up message tagging options, check the Message is considered spam if the following header regexp matches box. In the field below Regexp, enter the gateway message header tag as a regular expression. To verify the header tag, click Test expression. Select one of these options: Message is spam if regexp matches—With this option, Gmail treats messages as spam when only the header is a match. For example, if your gateway adds the X-spam-gw header tag and you want Gmail to treat messages with this header as spam, enter ^X-spam-gw:. If you want Gmail to mark the message as spam if it matches the exact header and nothing else, enter ^X-spam-gw: spam$. Regexp extracts a numeric score—With this option, Gmail treats messages as spam when a score in the header matches the value for this option. Below this option, enter a numeric value in the field. The regexp for the numeric score must include a capture group. For example, if you want Gmail to handle messages as spam when the gateway adds the message header X-spam: or X-phishy: and a numerical score greater than or equal to .50, enter the regexp ^X-(?:spam|phishy): (0\.\d*|1\.0*)$, including just one capture group. Then, enter .50 for the numeric score. 0\.\d*|1\.0* indicates the decimal values from 0 to 1. The parentheses indicate the numeric group to extract. If your expression has multiple parentheses, include a question mark and colon after the opening parenthesis of the non-capturing group, as shown in the previous example. Disable Gmail spam evaluation on mail from this gateway; only use header value—(Optional) With this option, message header values are the main method used to determine if a message is spam.

    

6. At the bottom, click Save.

   Changes can take up to 24 hours but typically happen more quickly. Learn more
   You can track changes in the Admin console audit log.

7. Verify that incoming messages are delivered as expected:
   1. After the Time to Live (TTL) has expired for the MX records, send a message to a user in your domain. Learn about avoiding bounced messages after changing MX records.
   2. Confirm the inbound gateway server processes the message, and the recipient gets the message in their inbox.