Back to Checks
googleworkspace

Protection against any unauthenticated emails is enabled

gmail_unauthenticated_email_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when emails are not authenticated via SPF or DKIM. Unauthenticated emails cannot be verified as originating from the claimed sender, making them more likely to be spoofed or forged.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against unauthenticated emails, users may receive spoofed or forged messages that fail SPF and DKIM checks but are still delivered normally. This enables phishing, spam, and impersonation attacks that exploit the lack of sender verification.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_unauthenticated_email_protection_enabled

Recommendation

Enable protection against any unauthenticated emails and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Spoofing and authentication**
4Check **Protect against any unauthenticated emails**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_unauthenticated_email_protection_enabled(Check):
    """Check that protection against any unauthenticated emails is enabled.

    This check verifies that Gmail is configured to take action on
    emails that are not authenticated via SPF or DKIM, helping prevent
    delivery of spoofed or forged messages.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.detect_unauthenticated_emails
            consequence = gmail_client.policies.unauthenticated_email_consequence

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against unauthenticated emails is disabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif enabled is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against unauthenticated emails is not "
                    f"configured and uses Google's insecure default "
                    f"(disabled) in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif consequence == "NO_ACTION":
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against unauthenticated emails is set to "
                    f"take no action in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"A protective action should be configured."
                )
            elif consequence is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against unauthenticated emails is enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against unauthenticated emails is enabled "
                    f"with consequence '{consequence}' in domain "
                    f"{gmail_client.provider.identity.domain}."
                )

            findings.append(report)

        return findings

References