Back to Checks
googleworkspace

Enhanced pre-delivery message scanning is enabled

gmail_enhanced_pre_delivery_scanning_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Enhanced pre-delivery message scanning adds additional security checks for messages identified as potentially suspicious. When enabled, Gmail may slightly delay delivery to perform deeper analysis, improving detection of phishing and malware that might otherwise evade standard filters.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without enhanced pre-delivery scanning, some sophisticated phishing and malware messages may pass through standard filters and be delivered to users. The additional scanning layer catches threats that the first-pass filters miss, reducing the organization's exposure to zero-day phishing campaigns and targeted attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_enhanced_pre_delivery_scanning_enabled

Recommendation

Enable enhanced pre-delivery message scanning to improve Gmail's ability to detect and block sophisticated phishing and malware before delivery to users.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Spam, phishing, and malware**
4Check **Enhanced pre-delivery message scanning** - Enables improved detection of suspicious content prior to delivery
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_enhanced_pre_delivery_scanning_enabled(Check):
    """Check that enhanced pre-delivery message scanning is enabled.

    This check verifies that Gmail is configured to perform additional
    security checks on suspicious messages before delivering them,
    improving detection of phishing and malware.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            scanning_enabled = (
                gmail_client.policies.enable_enhanced_pre_delivery_scanning
            )

            if scanning_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Enhanced pre-delivery message scanning is enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif scanning_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Enhanced pre-delivery message scanning uses Google's "
                    f"secure default configuration (enabled) "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Enhanced pre-delivery message scanning is disabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Pre-delivery scanning should be enabled for improved threat detection."
                )

            findings.append(report)

        return findings

References