Back to Checks
googleworkspace

Per-user outbound gateways are disabled

gmail_per_user_outbound_gateway_disabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

A per-user outbound gateway allows users to send mail through an external SMTP server instead of Google's mail servers. Disabling this setting ensures all outbound email is routed through the organization's configured mail infrastructure.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

With per-user outbound gateways enabled, users can route outbound email through external SMTP servers, bypassing organizational email security controls, DLP policies, and audit logging. This creates an unmonitored channel for data exfiltration and policy circumvention.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_per_user_outbound_gateway_disabled

Recommendation

Disable per-user outbound gateways to ensure all outbound email passes through the organization's mail infrastructure where security controls and monitoring are applied.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **End User Access** > **Allow per-user outbound gateways**
4Uncheck **Allow users to send mail through an external SMTP server when configuring a "from" address hosted outside your email domain**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_per_user_outbound_gateway_disabled(Check):
    """Check that per-user outbound gateways are disabled.

    This check verifies that the domain-level Gmail policy prevents users
    from sending mail through external SMTP servers, ensuring all outbound
    email passes through the organization's mail infrastructure.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            gateway_allowed = gmail_client.policies.allow_per_user_outbound_gateway

            if gateway_allowed is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Per-user outbound gateways are disabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif gateway_allowed is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Per-user outbound gateways use Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Per-user outbound gateways are enabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"External SMTP server usage should be disabled."
                )

            findings.append(report)

        return findings

References