Configure Google Workspace Outbound Filtering Using a Content Compliance Rule – Help Center

Google Workspace can be configured to route outbound email through MXGuardian for filtering. However, some Google Workspace services generate messages using a google.com sender address rather than an address belonging to your domain.

For example, when a user shares a Google Drive document with an external recipient, Google may generate a notification from an address such as:

drive-shares-dm-noreply@google.com

Because google.com is not one of your authorized domains, MXGuardian will not allow these messages to be relayed through your account.

To prevent this, we recommend using a Google Workspace Content Compliance rule to route normal outbound mail through MXGuardian while allowing Google-generated messages to be delivered directly by Google.

Step 1: Add MXGuardian as an Outbound Route

Sign in to the Google Admin console at admin.google.com.
Navigate to:
Apps > Google Workspace > Gmail > Hosts
Click Add Route.
Enter a name for the route, such as:
MXGuardian Outbound
Under Specify email server, select Single host.
Enter the following:
Host: smtp.mxguardian.net
Port: 25
Make sure Perform MX lookup on host is NOT selected.
Enable the following options:
- Require mail to be transmitted via a secure (TLS) connection
- Require CA signed certificate
- Validate certificate hostname
Click Test TLS connection to verify that Google Workspace can connect to MXGuardian.
Click Save.

Step 2: Create the Content Compliance Rule

In the Google Admin console, navigate to:
Apps > Google Workspace > Gmail > Compliance
Locate Content compliance.
Click Configure. If you already have one or more Content Compliance rules, click Add Another Rule.
Enter a description for the rule, such as:
Route Outbound Mail through MXGuardian
Under Email messages to affect, select:
Outbound
Under Add expressions that describe the content you want to search for in each message, click Add.
Select:
Advanced content match
Configure the expression as follows:
Location: Sender header
Match type: Not contains text
Content: google.com
Click Save to save the expression.

Step 3: Route Matching Messages Through MXGuardian

Under If the above expressions match, do the following:

Locate Route.
Select Change route.
Select the MXGuardian Outbound route created in Step 1.
Click Save to save the Content Compliance rule.

Step 4: Remove the Default Outbound Gateway

If MXGuardian was previously configured using Google Workspace's default Outbound Gateway setting, remove that configuration after the new Content Compliance rule has been created and saved.

In the Google Admin console, navigate to:
Apps > Google Workspace > Gmail > Routing
Locate the Outbound gateway setting.
If smtp.mxguardian.net is configured as the default outbound gateway, remove or disable that setting.
Save your changes.

If you don't have a default outbound gateway configured, you can skip this step.

How This Works

Messages sent by users from your Google Workspace domain will be routed through MXGuardian for outbound filtering.

For example:

user@yourdomain.com → MXGuardian → Internet

Google-generated messages with a sender address containing google.com will not match the Content Compliance rule and will instead be delivered directly by Google.

For example:

drive-shares-dm-noreply@google.com → Google → Internet

This prevents Google-generated notifications from being rejected by MXGuardian while ensuring that normal outbound email from your users continues to be filtered by MXGuardian.

Testing

After saving the configuration, send a normal email from a Google Workspace user to an external email address and verify that the message appears in the MXGuardian outbound message logs.

You should also test sharing a Google Drive document with an external recipient. The Google Drive notification should be delivered directly by Google and should not appear as an outbound message in MXGuardian.