Back to Checks
googleworkspace

Groups are protected from inbound emails spoofing your domain

gmail_groups_spoofing_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail moves out of the inbox, to spam or quarantine, the inbound emails to groups that spoof the organization's domain. An action that only shows a warning is not enough. Google Groups are a high-value target because a single spoofed message can reach many recipients at once.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection of groups from domain-spoofing emails, attackers can send spoofed messages to group mailboxes that appear to originate from the organization. Since groups distribute to many recipients, a single spoofed email can enable mass phishing, social engineering, or misinformation campaigns across the organization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_groups_spoofing_protection_enabled

Recommendation

Enable protection of groups from inbound emails spoofing your domain and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Spoofing and authentication**
4Check **Protect your Groups from inbound emails spoofing your domain**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client
from prowler.providers.googleworkspace.services.gmail.lib.spoofing import (
    describe_consequence,
    is_protective,
)


class gmail_groups_spoofing_protection_enabled(Check):
    """Check that groups are protected from inbound emails spoofing your domain.

    This check verifies that Gmail is configured to take action on
    inbound emails to groups that spoof the organization's domain,
    helping prevent impersonation attacks targeting group mailboxes.
    CIS requires the configured action to move the message to spam or
    quarantine it, so an action that only shows a warning is reported as a
    failure.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.detect_groups_spoofing
            consequence = gmail_client.policies.groups_spoofing_consequence
            visibility_type = gmail_client.policies.groups_spoofing_visibility_type
            domain = gmail_client.provider.identity.domain
            scope = (
                "private groups only"
                if visibility_type == "PRIVATE_GROUPS_ONLY"
                else "all groups"
            )

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection of groups from inbound emails spoofing your "
                    f"domain is disabled in domain {domain}. "
                    f"Enable the protection and set the action to move the "
                    f"email to spam."
                )
            elif enabled is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection of groups from inbound emails spoofing your "
                    f"domain is not configured and uses Google's insecure "
                    f"default (disabled) in domain {domain}. "
                    f"Enable the protection and set the action to move the "
                    f"email to spam."
                )
            elif not is_protective(consequence):
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection of groups from inbound emails spoofing your "
                    f"domain is enabled for {scope} but "
                    f"{describe_consequence(consequence)} in domain {domain}. "
                    f"The action should move the email to spam."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection of groups from inbound emails spoofing your "
                    f"domain is enabled for {scope} with action "
                    f"'{consequence}' in domain {domain}."
                )

            findings.append(report)

        return findings

References