How to Limit Spam in G-Suite and Gmail

Basic Behavioral Safeguards

• Guard your primary email address. Don't give it out to anyone you don't know; don't leave your business cards in fishbowls; don't register for newsletters or to be contacted with this email address. Don't register for free stuff. Don't give this email address to anyone but your closest associates. Keep it a secret.
  

• Use a fake email address for uncontrolled email. Set yourself up with a free a generic Gmail account. Direct anyone you don't know or trust, or, your newsletter subscriptions, whatever, to this account. If you must, get a separate set of business cards developed that has a different telephone number and email address than what you regularly use. Remember, keep your primary email address a secret.
  

• Don't plaster your email address anywhere on the Internet. It shouldn't be on your website, it shouldn't be left in comments on discussion threads, it shouldn't be easy to scrape-up from the web and add you to a list.
  

• Learn to recognize spam. You must learn to visually identify spam.
  

  • It'll most often come from senders you don't recognize with complicated email addresses. You don't know these people - don't even open it.
    

  • It will also contain a subject line that tries to convince you to do something - you're a winner, you're about to lose something, you could win millions, your account is in jeopardy, provide personal information about you - it's a call to action, and it's trying to get you to read the email. It's always too good to be true.
    

  • In the body of the message, it will often have misspelled words or awkward phrases and grammar because the person who composed the email isn't fluent in your language. It will also try to sell you something. This is obviously spam.
    

  • There may be attachments. Don't touch them. Don't download them.
    

  • In the body of the message, there will be hyperlinks that are designed to take you somewhere immediately on the web. If you received a questionable email from somebody you don't recognize, promising you impossible things, where their use of language and grammar are suspect, and it's got weird attachments, well, don't click on the hyperlink. This is obviously spam.
    

  • When you receive this crap, delete it, flag it as spam, or create a filter against it (see below).
    

• Don't forward chain messages. Don't forward anything to anyone that you don't trust. That's just spreading the spam around and rolling in it because you like the smell.
  

• Don't open spam; don't reply to spam. Obviously. Just delete the spam. You don't owe anybody anything. Just delete it.

End-User Safeguards and Filters

• Use a web-based mail system. Web-based mail systems are updated automatically by the vendor and have the most recent rules to protect you. Also, content isn't downloaded your computer - you're viewing email in a safe space. If you use an email client like Microsoft Outlook or Thunderbird or Apple Mail, you're counting on this application's rules to protect you, and you're downloading the spam and its harmful attachments to your PC. This situation is even worse if you're using an outdated mail client like MsOutlook 2007 - a product that has exited mainstream support from Microsoft and never receives any security updates.

• Flag or report spam. In the Gmail interface, if you select an email message, you have the option to flag the object as spam. Do so. This adds to a personal filter that can help filter spam from your inbox in the future. If you just delete it, Google doesn't know to screen for it in the future.

• Create a filter. When selecting the message in Gmail, you can opt to create a filter off of the email message. Filters are a powerful tool that you can use to keep spam email from hitting your web inbox as well as the inbox on your phones and mobile devices. When you do create a filter, you'll be prompted with a dialog that looks like this:

• In the filter rules, you're saying "If I receive anything from this email address"... Instead of an email address, you can also add any identifying "has the words" in the appropriate box (words like "sweepstakes", "viagra", whatever. The email address usually suffices. You can also modify the email address to be any alias from any domain you don't recognize by expressing it like *@spammerdomain.com - this says, "If I receive anything from spammerdomain.com ..." Then, create a filter off of these selections. Don't be too tight on these selections - you don't need many criteria - just enough to create a useful filter off of.

• When you push on to create the filter, you would want to check "Skip the Inbox" and "Delete it", applying the filter to all of the other messages found in your inbox. Press the CREATE FILTER button to save the filter.
  

• Editing your Gmail Filters. Over time, you may have many filters that you would want to look at and troubleshoot. You can find all of your filters to edit or delete them by going to the GEAR ICON in the upper right, then Settings; then to the Filters and Blocked Addresses tab. The list allows you to edit or delete any of your filters.

Administrator Safeguards

• The G-Suite / Google Apps Spam Controls. These controls can be applied to an entire Google Apps domain and are found within the APPS > G-Suite > Settings for GMail > Advanced Settings section of the administrator console.

• Whitelist Hosts. Administrators can approve a whitelist of senders by IP addresses or host names. Remember that these are exceptions created for the entire domain so that it affects every user within the domain.
  

• Inbound Gateway Declarations. If you use 2nd or 3rd party spam filters through other gateways, they can be declared here.
  

• Spam Control. Here, you can setup more aggressive spam filtering and a set of rules of how to manage spam for the domain. If content from a trusted party continually arrives flagged as spam to your user community, you can create exceptions through the Approved Senders List; if you want to spam to be quarantined rather than delete it, you can declare that here.

• Blocked Senders List. If your organization is constantly receiving spam from a known source or email alias, you can provide blacklists for the organization here.

Conclusion

Spam is a constant problem on the Internet and it's not likely to go away. It exists as a consequence of how easy it is to email anyone in the world, and, how extraordinarily gullible we are as humans.

Technical controls can only do so much to identify and filter spam - ultimately, it comes down to user behavior and user-controlled filtering that brings spam to-heel. That means you - as a user - have to modify your behavior, think critically, and leverage the tools that are at your disposal.

G-Suite and Google Home

Google Home is the new digital assistant offered by Google; it competes with the Amazon Echo lines of products. 

Google Home has a lot of desirable features and - in terms of a comparison between it and the Amazon Echo - this reviewer thought Home was a superior value. I'd tend to agree.

However, one of the most disappointing aspects of this product is that it doesn't work entirely with G-Suite accounts.

Yes, you read that right. It's a terrible bleeding-edge situation with the product right now.

With the right Domain settings, your G-Suite account can be paired to the device for its activation, but Google Home can't interact with your email or calendar. Yet. I get the impression that Google will be resolving that over time.

Okay. If you're not dissuaded, and if you believe that Google will (eventually) remedy that situation with its own backend solution, and, if you have a G-Suite account that you want to pair against the device, there's two settings that you have to enable under your Google Admin Console.

Enable Google Now

1. Login to your Google Admin Console.

2. Access Device Management, under Mobile, Advanced Settings, Other Google Services.

3. Make sure Google Now for iOS and Android is checked.

4. Save your settings.

Enable Web Access to Your Organization

1. Login to your Google Admin Console.

2. Access Apps, Additional Google Services.

3. Look for Web and Web Activity. Make sure it's on for Everyone or the Orgs you select.

4. Save your settings.

These settings will take some time to propagate through Google's servers; allow yourself up to 24 hours for propagation time.

Once this is done, run through pairing (setting up) the Google Home device using the Google Home app on your iOS or Android device. Sign in with your G-Suite account.

If it fails, it'll outright tell you that Google Home can't be paired against the account and to select a standard GMail account.

If it works, it'll tell you that you can continue with the G-Suite account but some of its features will be unavailable. 

Generally, I've staged two Home devices thus far and I'm content to wait Google out for G-Suite connectivity. I understand this is new technology and it'll take them some time to address the product throughout the entire ecosystem. Still, if you're impatient and looking for a work-around, I think this would work if you're not security-conscious:

1. Set yourself up a generic free Gmail account.

2. Setup forwarding from your G-Suite account to the Gmail account.

3. Setup a Send-As alias from the Gmail account that aliases your G-Suite account.

4. Share your G-Suite Calendar to the Gmail account with full control.

5. Pair the Google Home device against the Gmail account, and select the default calendars to use with the device.

Aside from the obvious security implications of routing your crap through a non-commercial account, I understand this will actually work. Myself, I'm not willing to do this - I'll wait under Google resolves the G-Suite connectivity issue on their own.

R

Domain Management and Acquisition

Internet domains are virtual properties on the Internet that reflect our unique brand.

Acquiring, managing, and renewing domains is a normal part of managing your company's presence on the Internet; failing to maintain annual ICANN requests or renew a domain means your website and email would stop working, and you run the risk of losing that intellectual property tied to your marketing.

Because of that, there's a bunch of incentive to interrupt these processes and to seize control of your property. Robot squatters can swoop-in, grab your domain, and extort your company so it can be returned to you. Further, you'll receive fraudulent notices in physical mail telling you that you must renew your domain with another registrar, whose intention is to also extort money from you. Finally, the data surrounding the domain's registration is technical and vulnerable to outside hackers looking to change the way your website works or how email routes. 

I want to protect my clients and ensure no disruptions in their service. This is why I’ve started offering a Domain Management service to my clients this year.

Under this service, I assume administrative and technical responsibility for my client's domain. My services:

• Monitor the domain renewal process on behalf of my client;

• Pass domain renewals through my own invoicing;

• Allow me to become a single point of contact for managing the domain as an asset, to help remove the complexity of technical issues involving the Zone File with web developers and others who rely upon it;

• Allow me to become a gatekeeper so that I can deflect attacks to prey upon my client’s domains and to avoid the risk of DNS scams;

• Setup privacy controls and restrictions that shield the personal private information of my client's from attacks;

• Manage MX, SPF, and DKIM records essential to my client's security and experience with Google Apps;

• Secure the name server to prevent DDOS (Distributed Denial of Service) attacks and brute force password attacks against my client’s own accounts.

The big benefit here is that I become a trusted custodian and guardian of my client's Internet presence. 

My pricing is very straight forward: $15/year/domain - annual renewals pass through my invoicing.

That’s it. 

Not bad for a professionally-managed service, and admittedly, not a lot of money it for me. Still, I’m doing this because I have a vested interest in my clients.

I’ve seen when domain Zone Files get hijacked; when companies get extorted out of thousands of dollars; when mail stops routing because of a technical error introduced by a web vendor; when a company’s owner or officer becomes the victim of a fraudster. It’s ugly, and I don’t want it to happen to anybody that I work with. I’m not looking to make a ton of money here; just perform a technical administrative task that’s increasingly at risk.

If you’re interested in this service, just let me know. I can give you a call, talk you through the process, and we can set a date to perform the technical steps necessary to assume control of the domain before it expires. If I do my work right, there’ll be absolutely no impact on your website or email routing.