Create an Inbound Gateway for Mesh in Google Workspace
To ensure email filtered by Mesh is delivered safely without any double filtering from Google, you need to create an inbound Gateway for Mesh in Google Workspace.
It is recommended that you consult Google’s official documentation.
If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.
You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected
Step 1: Navigate to Google Admin
Navigate to Google Admin → Gmail. Select - Spam, Phishing and Malware
URL: https://admin.google.com/ac/apps/gmail/spam
Step 2: Edit Inbound Gateway
Click on edit Inbound Gateway.
Step 3: Add Gateway IPs
You will need to add two sets of IP addresses:
Mesh delivery IP ranges specific to your region.
Google’s sending IP ranges.
Important: If using the “Reject all mail not from gateway IPs” we recommend including Google’s sending IP ranges to prevent circumstances where they can reject emails from their own servers.
If you decide to leave “Reject all mail not from gateway IPs” unchecked, senders can bypass the Mesh or Google gateway.
List of Google IPs
Extracted from _spf.google.com (Google could changes these without notice)
35.190.247.0/24
64.233.160.0/19
66.102.0.0/20
66.249.80.0/20
72.14.192.0/18
74.125.0.0/16
108.177.8.0/21
173.194.0.0/16
209.85.128.0/17
216.58.192.0/19
216.239.32.0/19
2001:4860:4000::/36
2404:6800:4000::/36
2607:f8b0:4000::/36
2800:3f0:4000::/36
2a00:1450:4000::/36
2c0f:fb50:4000::/36
172.217.0.0/19
172.217.32.0/20
172.217.128.0/19
172.217.160.0/20
172.217.192.0/19
172.253.56.0/21
172.253.112.0/20
108.177.96.0/19
35.191.0.0/16
130.211.0.0/22Step 4: Select Checkboxes
Click the following checkboxes:
Automatically detect external IP (recommended).
Reject all mail not from gateway IPs.
Require TLS for connections from the email gateways listed above.
Step 5: Create Regexp
Check the box "Message is considered spam if the following header regexp matches"
Enter a random string into the Regexp text box.
This value does not matter as long as it will not appear in the email headers.
Step 6: Disable Spam Evaluation
Check the box "Disable Gmail spam evaluation on mail from this gateway; only use header value"
The setup should now look like this:
Step 7: Continue Mesh Gateway Setup Guide
The next step is to continue Mesh Gateway setup guide which includes details to keep internal emails within Google’s infrastructure.
You’re all set!