How to Allowlist a Sender in Google Workspace

If you're searching for how to whitelist a sender in Google Workspace, the short version is: add the sender's address or domain to an approved senders list in the Admin console, then attach that list to a spam-bypass setting scoped to the organizational unit that needs it. The catch is that Workspace actually has three different allowlist-shaped settings, and picking the wrong one is the usual reason this has to be redone.

This guide covers all three, which one to reach for, and — because an allowlist is also a way to hand a phishing sender a free pass — how to pick the narrowest version that actually fixes your problem instead of the broadest one that happens to work too.

Before you start#

You need two things before you touch the Admin console: the sender's exact email address, or the domain if you're covering every address on it, and confirmation that the mail is actually the sender's own rather than spoofed. Google Workspace won't warn you if you allowlist a domain an attacker is impersonating — it will simply let that mail through too.

Also confirm the mail is really being caught by spam scoring and not something else. A message stuck in quarantine, intercepted by a content compliance rule, or rejected outright by a recipient-side policy won't be fixed by any setting below — those are separate controls, and approving a sender does nothing to them.

It helps to know what actually happened to the message before you change anything. Open the Admin console's email log search under Reports > Email log search for that message, or ask the recipient to check Show original — the header trail tells you whether it was scored as spam, blocked by a rule, or never delivered at all, and that's the difference between a two-minute fix and an hour of guessing.

Steps: add an approved sender#

This is the setting most people mean by "whitelist a sender" — it matches an email address or domain and applies to one organizational unit.

1. 1

   Confirm you have the right admin role

   You need Super Admin, or a custom role with the Groups/Gmail admin privilege for Services > Gmail. Without it, the Spam, Phishing and Malware page won't let you save a new setting.

2. 2

   Open the spam settings page

   In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Spam, Phishing and Malware. This is the same page every allowlist surface in this guide lives on — the difference is which setting on it you use.

3. 3

   Pick the organizational unit

   Select the OU on the left that covers the mailbox missing the sender's mail. An approved senders list only applies to the OU it's attached to, so choosing the top-level OU when the mailbox sits in a sub-OU is the single most common reason this doesn't take effect.

4. 4

   Build the approved senders address list

   Scroll to Spam and click Add another rule, or Configure if none exists. Choose Address Lists, then Create or edit list. On the Manage address lists page that opens, add the sender's exact email address, or the whole domain if every address at that domain should be covered. Address lists are reusable, so this one can be attached to a content compliance rule later without rebuilding it.

5. 5

   Attach the list to a bypass setting

   Back on the spam setting, choose "Bypass spam filters for messages from senders or domains in selected lists" and select the list you just built. Use the variant that also hides warnings only when you're certain the source is legitimate — it removes a visual cue recipients otherwise rely on.

6. 6

   Save and test

   Click Save. The change applies to new mail arriving after that point — it doesn't retroactively pull an already-delivered message back out of Spam. Ask the sender to resend, or manually mark the existing message not spam. If the label persists past the propagation window, move to the troubleshooting steps below rather than re-saving the same setting — a repeat save doesn't change anything the list didn't already have.

Every setting above lives on the same page, but each one intercepts mail at a different checkpoint before it reaches an inbox. An allowlist only opens the checkpoint it was built for — the others keep running on the same message.

Platform differences: which surface actually applies#

"Allowlist" describes three settings in Google Workspace, and they aren't interchangeable. Confusing an IP allowlist with an approved senders list is the most common version of the mistake behind the secondary complaint this guide gets — a sender that's supposedly allowlisted and still lands in Spam.

One case worth calling out: a marketing platform sending on a vendor's behalf from rotating infrastructure is a scenario where an address-level approved senders entry is the only one of the four that reliably keeps working, because it doesn't depend on a single stable IP. A content compliance rule can do more than any of these — including rewriting headers or rejecting mail outright — which is also why a misconfigured one produces symptoms that look identical to a broken allowlist.

What to do when it doesn't work#

If mail is still landing in Spam after you've saved the setting, work through these in order before assuming the allowlist itself is broken.

• Wrong organizational unit — the address list is attached to an OU that doesn't include the mailbox missing the mail. Re-check which OU the recipient's account actually sits in.
• Typo or subdomain mismatch — an entry for vendor.com doesn't cover mail sent from mail.vendor.com or news.vendor.com. Add the exact sending domain, not the brand's main one.
• Authentication failure, not content — SPF, DKIM or DMARC failures get flagged independently of any address list. Open Show original on the filtered message and check the Authentication-Results header before assuming the list didn't work.
• A content compliance rule fired first — rules built for routing or DLP can quarantine or reject mail before spam scoring even runs. Check compliance rules on the same Gmail settings page for anything matching the sender's domain or headers.
• IP allowlist mistaken for approved senders — the two settings don't reference each other. Adding an IP to one doesn't add the matching address to the other.
• Propagation delay — IP allowlist changes can take up to 24 hours; an approved senders list tied to an OU is faster to apply but still isn't instant.

A faster way to keep it working#

Manual allowlisting is static: it matches one address or domain, and it stops working the moment a vendor sends from a new subdomain, switches email platforms, or rotates the infrastructure behind a marketing tool. None of that is an attack — it's routine vendor housekeeping — but the address list doesn't know the difference, so it goes stale and the same complaint comes back in a few months.

AI Emaily's inbox layer classifies incoming mail on sender behavior and domain reputation rather than a fixed list, so a legitimate vendor's mail keeps getting through even after its sending setup changes, without an admin re-editing this Google Workspace page each time. It sits on top of whatever Workspace already does — this isn't a replacement for the steps above, just fewer trips back to this page. We build AI Emaily.