Back to Checks
googleworkspace

Protection against domain spoofing based on similar domain names is enabled

gmail_domain_spoofing_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail moves out of the inbox, to spam or quarantine, the emails that appear to come from domain names that look similar to the organization's domain. An action that only shows a warning is not enough. Lookalike domains are a common phishing technique used to trick users into trusting malicious messages.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against domain spoofing based on similar domain names, users may receive phishing emails from lookalike domains (e.g., examp1e.com instead of example.com) that appear legitimate. This enables credential theft, malware delivery, and business email compromise attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_domain_spoofing_protection_enabled

Recommendation

Enable protection against domain spoofing based on similar domain names and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Spoofing and authentication**
4Check **Protect against domain spoofing based on similar domain names**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client
from prowler.providers.googleworkspace.services.gmail.lib.spoofing import (
    describe_consequence,
    is_protective,
)


class gmail_domain_spoofing_protection_enabled(Check):
    """Check that protection against domain spoofing based on similar domain names is enabled.

    This check verifies that Gmail is configured to take action on
    emails that appear to come from similar-looking domain names,
    helping prevent phishing via domain impersonation. CIS requires the
    configured action to move the message to spam or quarantine it, so an action
    that only shows a warning is reported as a failure.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.detect_domain_name_spoofing
            consequence = gmail_client.policies.domain_spoofing_consequence
            domain = gmail_client.provider.identity.domain

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against domain spoofing based on similar domain names "
                    f"is disabled in domain {domain}. "
                    f"Enable the protection and set the action to move the "
                    f"email to spam."
                )
            elif not is_protective(consequence):
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against domain spoofing based on similar domain names "
                    f"{describe_consequence(consequence)} in domain {domain}. "
                    f"The action should move the email to spam."
                )
            else:
                report.status = "PASS"
                state = "is enabled" if enabled else "uses Google's default (enabled)"
                report.status_extended = (
                    f"Protection against domain spoofing based on similar domain names "
                    f"{state} with action '{consequence}' in domain "
                    f"{domain}."
                )

            findings.append(report)

        return findings

References