Google Workspace Email Routing Rules: How They Actually Work

How Google Workspace evaluates routing rules#

Google Workspace checks every Gmail setting against each message on its own and builds a list of consequences. If any consequence is a reject, the message is rejected and nothing else applies. Everything that does not conflict is applied. Only consequences that change the primary route or the envelope recipient can conflict, and those are settled by specificity, then age.

In Google's words, specificity means locally applied settings beat inherited ones (a setting on a child organizational unit beats one inherited from the parent), and organization-specific settings beat Default routing. After that, older settings take precedence over newer ones. Within one settings section, such as Routing, a setting higher on the page has higher priority in a conflict. Between different sections there is no strictly defined order, and Google advises against relying on creation date at all: build each rule so it stands on its own.

Two more facts from Google's Default routing article matter in practice. Default routing has lower priority than the other Gmail routing settings, including content and attachment compliance. And a reject in any setting takes the highest priority, even over settings you ranked above it. Routing rules sit at the domain delivery layer, before any user's Gmail filters; for the user-level equivalent, see how to create rules in Gmail.

Default routing vs Routing vs Content compliance: which setting for which job#

Content compliance has its own guide: how Google Workspace content compliance rules work.

Before you start#

• Privilege: you need the Gmail Settings administrator privilege (a super admin has it).
• Propagation: Google says changes can take up to 24 hours but usually happen sooner. You can confirm when a change was made in the Admin console audit log.
• Who is covered: Default routing can be limited to non-recognized addresses, which Google defines as suspended users, users with Gmail turned off, and addresses on your verified domains that do not belong to any user. In the Routing setting, the account-type options decide whether active users, groups, or inactive and unrecognized accounts are affected.
• Routing to another server: add that server first under Hosts with Add Route (hostname or IP, plus port), or the route will not be available to pick.

Set up Default routing#

Use Default routing for organization-wide behaviour. You can create up to 1,000 Default routing settings.

1. 1

   Open Default routing

   In the Admin console, go to Apps > Google Workspace > Gmail > Default routing. Click Configure, or Add another rule if settings already exist.

2. 2

   Choose the envelope recipients to match

   Pick a single recipient address, a regular expression pattern (Google uses RE2 syntax), one or more groups including child members, or all recipients.

3. 3

   Choose the action

   Select Modify message to change delivery, or Reject message to refuse it before delivery, optionally with a note for the sender. No other routing or compliance rules apply to a rejected message.

4. 4

   Pick the modify options

   Options include adding an X-Gm-Original-To header, adding X-Gm-Spam and X-Gm-Phishy headers, adding custom headers, prepending text to the subject, changing the route to a server you added under Hosts, changing the envelope recipient, bypassing the spam filter (incoming mail only), removing attachments, and adding more recipients.

5. 5

   Choose which addresses it affects

   Either perform the action only on non-recognized addresses, or on both non-recognized and recognized addresses. Then click Save.

6. 6

   Set the order

   To rank Default routing settings against each other, click Reorder next to a setting, enter a number (1 is the highest priority) and save. If two Default routing settings conflict, the higher-priority one applies and the other is ignored. A reject still outranks everything.

Set up a Routing setting#

The Routing setting is the more flexible one. It can be scoped to an organizational unit, it can affect outbound and internal mail as well as inbound, and it has a quarantine action. A setting applied directly on a child organizational unit beats one inherited from the parent, and a child unit can turn off rules it inherits.

1. 1

   Open Routing and pick the scope

   Go to Apps > Google Workspace > Gmail > Routing. Keep the top organizational unit selected to apply the setting to everyone, or select a child unit. Click Configure or Add another rule.

2. 2

   Name it and choose the messages to affect

   A name is required; you cannot save without one. Then choose any of inbound, outbound, internal sending and internal receiving.

3. 3

   Choose the action

   Modify message, Reject message, or Quarantine message. Quarantine applies only to the active user account type. Modify options include headers, a subject prefix, Change route, Change envelope recipient, bypassing spam filtering, removing attachments, adding recipients, and encryption for onward delivery.

4. 4

   Narrow it with show options

   Under the extra options, choose account types (active users, groups, inactive and unrecognized accounts), an address list to bypass or to apply only to, and an envelope filter on sender or recipient using a single address, a regular expression, or group membership.

5. 5

   Save

   Click Save at the bottom of the box. The new setting appears on the Routing page. Remember that a reject action is always assigned the highest priority.

Configure dual delivery#

Dual delivery sends incoming mail to more than one inbox, for example Gmail and a legacy server or an archive. Google recommends Gmail as the primary server (the one your MX records point to), with the other system as secondary; a legacy server should be primary only during a pilot or migration. Background: dual delivery explained.

1. 1

   Add the secondary server

   Under Apps > Google Workspace > Gmail > Hosts, use Add Route to add the non-Gmail server.

2. 2

   Create a Routing setting

   In Gmail > Routing, click Configure or Add another rule, enter a name, and select Inbound messages, Internal inbound messages, or both.

3. 3

   Add the extra recipient

   Choose Modify message. Under Also deliver to, check Add more recipients and click Add. Use the menu at the top of the Add setting box to select Advanced, check Change route, and pick the server you added.

4. 4

   Optional delivery options

   Google lists Do not deliver spam to this recipient and Suppress bounces from this recipient as options you can keep checked. Save the recipient, then save the Routing setting.

5. 5

   Test both destinations

   Send a test message and confirm it arrives in both places. If one copy is missing, look the message up in Email log search.

When a routing rule is not working: a 5-step check#

1. 1

   Find the message in Email log search

   Open Reporting > Email Log Search (or admin.google.com/ac/emaillogsearch), search by recipient or message ID within the last 30 days, and see where the message was actually delivered. That tells you whether your route was used. Walkthrough: Email log search.

2. 2

   Look for a reject anywhere

   A reject in any setting, in any section, wins outright and stops every other rule. Check Default routing, Routing and the compliance settings for a reject that matches the same message.

3. 3

   Check the scope

   Is the rule on the right organizational unit? Does it cover the right message direction (inbound versus internal inbound)? Are the right account types ticked? Does the regular expression match in RE2 syntax, not just in a generic tester?

4. 4

   Find the competing rule

   Only two things conflict: changes to the primary route and changes to the envelope recipient. Look for another setting that changes the same thing and is more specific (applied on the unit itself rather than inherited), older, or higher on the same settings page. If the two rules are in different sections, there is no defined winner, so rewrite them so they do not overlap.

5. 5

   Allow for propagation

   Changes can take up to 24 hours. Check the Admin console audit log for when the change was saved before deciding the rule is broken.

Where AI Emaily fits#

It does not touch Workspace routing. AI Emaily is an email client: it works on mail after Google has delivered it, sorting, labelling and drafting replies with rules you set and the Personal Context you give it, across Gmail, Outlook and IMAP accounts. Routing decides where a message lands; AI Emaily helps once it is in the inbox. We build AI Emaily.