How to Whitelist by Content Compliance in Google Workspace

You can bypass Google Workspace's spam filters by applying a content compliance rule to our IP addresses. This rule will allow our simulated phishing emails to be delivered to your user's inboxes. The Content Compliance whitelisting method involves two steps in Google Workspace: adding KnowBe4's IP addresses to the Email Whitelist, and enabling whitelisting by Content Compliance.

Content compliance is an alternative method to whitelisting by IP address in our Whitelisting by IP Address in Google Workspace article. We recommend using the content compliance method if you have an existing inbound gateway to use the content compliance rule or if you are unable to configure the inbound gateway.

Jump to:

• Add KnowBe4's IP Addresses to Your Google Workspace Whitelist
• Enable Whitelisting by Content Compliance

Add KnowBe4's IP Addresses to Your Google Workspace Whitelist

First, you’ll need to add KnowBe4’s IP addresses to your IP allow list for Google Workspace. Once you add KnowBe4’s IP addresses to your IP allow list, you can enable whitelisting by content compliance.

To add KnowBe4’s IP addresses to your Google Workspace whitelist, follow the steps below:

1. Log in to the Google Admin portal and click Apps.
2. Click Google Workspace.
3. Click Gmail.
4. Click Spam, Phishing and Malware.
5. Under the Organizational Unit section, highlight your domain. Do not select a sub-organizational unit (OU).
   Note: Google Workspace does not allow whitelisting by IP address for individual OUs. You can only whitelist by the entire domain.
   

6. In the Email whitelist section, enter our IP addresses. Make sure to separate each IP address with a comma. For a current list of our IP addresses, see the IP Addresses, Hostnames, and Header Information section of our Whitelisting by Content Compliance in Google Workspace article.
7. Click Save.

Back to top

Enable Whitelisting by Content Compliance

After you have added KnowBe4’s IP addresses to your Google Workspace whitelist, you can enable whitelisting by content compliance.

To enable whitelisting by content compliance, follow the steps below:

1. Log in to your Google Admin portal and select Apps.
2. Select Google Workspace.
3. In the Showing status for apps in all organizational units area, click Gmail.
4. In the Gmail area, click Compliance.
5. Navigate to the Content compliance section.
6. Click Add a Rule.
   Note: If you have previously created a content compliance rule, this option will be called Add Another Rule.
   

After you click Add a Rule or Add Another Rule, configure your content Content compliance by following the steps below:

1. In the Email Messages to Affect area, select the Inbound check box.
2. In the If ANY of the following match the message area, create an expression with the following settings:
   1. From the first drop-down menu, select Metadata match.
   2. From the Attribute drown-down menu, select Source IP.
   3. From the Match type drop-down menu, select Source IP is within the following range.
   4. In the Source IP is within the following range field, enter one of KnowBe4's IP addresses. For the most up-to-date list of our IP addresses, see the IP Addresses, Hostnames, and Header Information section of our Whitelisting Data and Anti-Spam Filtering Information article.
   5. Click Save.
3. Repeat the three steps above for each of our IP addresses.
4. In the If ANY of the following match the message section, add another expression with the settings in the screenshot and list below:
   1. From the first drop-down menu, select Advanced content match.
   2. From the Location drop-down menu, select Full headers.
   3. From the Match type drop-down menu, select Contains text.
   4. In the Content field, enter "X-PHISHTEST".
   5. Click Save.
5. In the If the above expressions match, do the following area, select the check boxes in the screenshot and list below:
   1. Under Spam, select the Bypass spam filter for this message check box.
   2. Under Encryption, select the Require secure transport (TLS) check box.

Back to top