Is there anyone here that knows GMail security & safety settings...?

[Koldov]

Loaded question I know, as we all have different set-ups and different settings, so what works in one won't necessarily work in another...

 

But, I have an issue trying to get an email sent to us and I don't know what settings to use to get it through 100%.

 

We have a phone system that emails us a .wav file of a voicemail.

 

So far this has consistently come through to the school reception admin email address on the phone system.

 

We can only have 1 email address, so the school receptionist admin 'owner' of this email account has set up a 'personal' forward to 2 others (receptionists).

 

I have stopped automatic forwarding for users as a safety baseline, so this has stopped it happening.

 

I thought I would try and do this properly through the GMail Admin Console.

 

From what I can see this action sends the emails to the other recipients into quarantine! With no actual reason (the matched rule just says 'loading....' and then 'unavailable').

 

I have put in everything I can think of in everywhere I possibly can to get this email through. Content Compliance rule, Attachment Compliance rule, Spam 'Allowed Senders'.... it's just not happening.

 

What is the correct way to make sure an email gets through and bypass all restrictions?

[paulkerton]

I believe you're looking for the Restrict delivery settings:

https://support.google.com/a/answer/2640542

 

[flipthebit]

I've not used GMail at work for a while. But could you set up a shared mail account for all those you wish to receive the message? Delegated access? No need to forward it on then. Point the voicemail to the shared account and they all see it from the shared account.

 

[john]

4 minutes ago, flipthebit said:

I've not used GMail at work for a while. But could you set up a shared mail account for all those you wish to receive the message? Delegated access? No need to forward it on then. Point the voicemail to the shared account and they all see it from the shared account.

 

Yep that can be done (its a normal user account in Google Workspace and then delegate it out. Could you send it to a Google Group as another option instead?

[Koldov]

Thank you, I will look into it but the office politics around delegating (as it's the main admin email account) and the policies against shared, plus asking the already overworked (their words not mine) admin staff to deal with an extra sign-on to other mailboxes, or working out how to view it from theirs, just make it too complicated. Also I've never done it before, so there's that...

 

Thing is I don't think I'm really asking it to do anything too complicated, I think I've put the rule in correctly that says if an email arrives from X also send it to X and Z... it should just work, right? It's not even really forwarding as I thought a rule would deal with it as more of a 'copy and also send to' before it even hits the first original mailbox.

 

I have another surprising development though... this morning the emails were in quarantine as expected, but the 'Matched Rule' was filled in.

 

It says 'No Auth' and this is my quarantine for emails that come in that match the following setting... but the original emails arrive to the original mailbox and obviously don't trigger this. Only when it has been sent by Google to the other mailboxes.

 

I had emails getting quarantined before with Arbor emails, no matter what rules I put in to allow it, these settings somehow seem to kick in first and override any rules that I put in to allow a certain email address or domain.

 

 

Edited September 29, 2025 by Koldov

[paulkerton]

You're trying to make square pegs fit round holes. The problem you need to deal with is the users not wishing to click on their profile picture, and click on a delegated inbox to gain access. (If you went the delegation route)

That shouldn't end up as a day's long tech work event for a job that should take 3 minutes, because your staff aren't willing to do their bit.

[flipthebit]

Have an account to only receive the phone messages, then delegate that to the others. I don't think there's much they need to do thereafter. It's just another mailbox they have access to.

[Koldov]

OK, so yesterday I created an OU/created a user/added a GMail only license/changed the setting to allow the mailbox to be delegated/worked out from the above post from  @paulkerton how to restrict delivery & sending/turned off as many settings as I could find so it doesn't really function as an email account and they can only really read the emails (not quite 3 minutes work, but I'm guessing this was overkill)...

 

Signed in and sent the invitations from the  'Grant Access To Your Account' setting, all were accepted...

 

Sent another email with instructions on how to open the new mailbox:

 

Step 2: Open the delegated inbox

1. On your computer, sign in to your Gmail account.
2. At the top right, click your Profile picture .
3. In the menu, find the account that’s marked as "Delegated."
4. Click the delegated account's name.
   • A new tab opens that shows the owner’s inbox.

Came in today and nobody has the option to open the delegated inbox.... 

 

AAAAAARGH!

 

Have I changed one setting too many? Are the instructions wrong? The only option I can see is to 'Add Account'...

 

Strangley the email doesn't get quarantined but still goes to SPAM, whereas it didn't do this with the original email account it was sending to, added an exclusion in and it now delivers... weird though... and frustrating!

Edited October 1, 2025 by Koldov

[Koldov]

Well, seem to have answered my own question, but need clarification and confirmation that this is correct. Can I ask if you all just let anyone delegate their mailbox?

 

Because, I didn't find anything from my research apart from the usual 'allow delegation, invite users' etc.

 

Then I find this line in a forum:

 

"I eventually jumped through enough hoops to reach a support chat with a human, and enabled delegation to groups for all organisational units which seems to have worked.

 

Delegation to groups was previously only enabled for the unit containing the new account, which in theory should have worked but this stuff seems very buggy."

 

Although it relates to groups, I surmised it would be the underlying problem. Anyway, to test it I enabled delegation for the OU my user is in (single Admin user in  a single OU), refreshed my inbox and the delegated inbox appeared.

 

If this is true I just can't quite get my head around that it would appear I need to let everyone delegate their mailbox in order to able to get one mailbox delegated. That seems to me to very insecure and just a disaster waiting to happen... why this can't be more fine-grained...? Even if I try to work around it by putting in Groups or extra OUs, I will still have to give those individuals in the group or OU the ability to delegate their own mailbox in order to see a delegated inbox... crazy!  Might as well go back to allowing auto-forwarding, much less hassle...

 

This is what I meant in my OP, first line of "we all have different set-ups and different settings, so what works in one won't necessarily work in another..." so the generic advice and all the official Google advice doesn't mention you have to have this setting enabled for each user/OU/Group who need to see a delegated inbox, which is strange because this isn't a setting that is turned on by default, so it should really say that you have to turn it on for everyone to able to use it for one inbox...

 

 

[flipthebit]

According to Google Gemini the account delegating itself needs the permission set, the user accessing that account doesn't. They just accept the invitation.

[Koldov]

Well, we all know AI isn't infallible and it's  sometimes the way the question is asked/worded that can give a variety of different outcomes (my underlining in Gemini's response below)...

 

"Yes, the Google Workspace Admin setting "Mail delegation Let users delegate access to their mailbox to other users in the domain" must be turned on for the delegation process to work at all.

 

 

This Admin Console setting is a master switch that controls whether any user in your domain is allowed to delegate their mailbox and whether any user in your domain is allowed to accept a delegation and view another user's mailbox.

 

 

---

 

Key Points on Delegation Permissions

 

• Enabling the Feature: The Admin setting must be enabled for both the user who is delegating their mailbox (the mailbox owner) and the user who will be viewing it (the delegate) to even attempt the process. If it's disabled for either user's Organizational Unit (OU), the delegation will fail.

• The Delegate's Role: While the Admin setting grants the ability to use delegation across the domain, the user who will be viewing the mailbox (the delegate) must still be explicitly granted access by the mailbox owner and then accept the invitation to become a working delegate.

• The Default State: In the Google Workspace Admin Console, mail delegation is often off by default and must be manually enabled by a Super Admin for your domain or specific OUs."

 

 

 

Edited October 1, 2025 by Koldov