G Suite admins have the ability to make G Suite go harder on phishing attacks in an organization by ticking some checkboxes here and there, but there doesn't seem to be an ability to check incoming phishing emails and set specific rules for them based on content.

The issue is that phishers are targeting my client's organization by getting some random Gmail or AOL address and setting their "From:" name as the CEO's, or main administrator's name, or other high-ranking people in the business. I've set G Suite's rules to be as hard on phishing as possible, but these emails keep coming through the filters using the same predictable tactics.

Each time one of these emails gets through, we add the email to a block list for the organization, but the attackers just open a new account and try again.

What would take care of would be if I could set up rules that say something along the lines of:

If ( email.from_name == "Jim Smith" && email.address !== jim@example.com ) {

In non-pseudo-code, if the email header says that they are a name in the organization, but the email is coming from outside the organization, reject it.

I followed this article's steps to prevent this, though it doesn't seem to be working.

According to the article, this can be done by going through the following steps:

  1. Go to admin.google.com
  2. Go to Apps > G Suite > Gmail > Advanced
  3. Scroll to Content Compliance and add a new rule
  4. Check "Inbound" for "Email messages to affect"
  5. Under "Add expressions that describe...", select "If ALL of the following match the message"
  6. Add expression rule "Advanced Content Match", Location = "Sender Header", Match Type = "Not contains text", content = "jim@example.com"
  7. Add expression rule "Advanced Content Match", Location = "Sender Header", Match Type = "Contains text", content = "Jim Smith"
  8. Click "Save"
  9. For "If the above expressions match...", select "Reject Message"
  10. Under "Show Options", select all options for "Account types to affect", being "Users", "Groups", and "Unrecognized / Catch-all"
  11. Hit "Save" in the bottom-right

That's what I put for this organization, though these emails are still getting through, so I'm either doing something wrong in this implementation or this doesn't work for some reason.

I'm almost surprised this anti-impersonation measure isn't a default, but I guess they don't want to screen too many false positives where people try to contact an organization and they happen to have the same name as the CEO. In this case though, the CEO doesn't have a very common name and way too many of these phishing attacks are happening, so it would definitely be worth implementing this if possible.


The only solution I have found is to add a third party Google approved app such as Managed Methods or Gaggle. I have also had no luck with build in capabilities except when it came to specifying known phishing domains as such which is a finger in the dike type of approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.