Email security for Google Workspace

Gmail filtering is strong and always on. It works best against anything Google has seen before across its own mail traffic.

• Spam and bulk campaigns sent to many recipients.
• Known malware in attachments, and many malicious links.
• Senders and domains already flagged elsewhere.
• Mail that fails SPF, DKIM or DMARC for domains that publish them.

The mail that reaches inboxes despite all of the above shares one property: nothing about it has been seen before.

• A message written for one person, from a domain registered days ago.
• No attachment and often no link - just a request to pay or change details.
• A display name that matches a real contact, on a domain one character off.
• A first-time sender claiming to be someone who has written many times before.

These are business email compromise, invoice fraud and targeted credential phishing - see how business email compromise works for an annotated example.

Zoes connects through domain-wide delegation, the standard Workspace mechanism for organization-wide apps. Mail routing does not change.

1. 1Sign in to Zoes with a super admin account.
2. 2In the Admin console under API controls → Manage domain-wide delegation, add the client ID and scopes Zoes shows you.
3. 3Choose which users to protect from the synced directory.

Zoes scans the Primary and Updates tabs. Promotions, Social and Forums are not scanned. Remove the delegation in the Admin console at any time to revoke access.