topic Re: Restricted delivery and subdomains/top-level domains? (Penalty Box OU) in Peer-Peer Topics

Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

icrew — Wed, 27 Mar 2024 22:55:25 GMT

Hi all:

We're looking into creating a "penalty box" OU, where one of the settings is to restrict email to only within our domain (no email from or to outside domains).

According to https://support.google.com/a/answer/2640542?hl=en, that should be pretty easy to do with the "restrict delivery" compliance setting.

But we're seeing some weird results: I'm setting this up on a test Workspace instance (sandbox.example.edu) that's fully independent of our production workspace instance (example.edu). They're two completely disconnected Workspace instances, and there isn't any domain allowlisting between them.

But it seems that even with the restrict delivery setting turned on, it's still possible to send mail between sandbox.example.edu and example.edu, and I can't figure out why. I'm guessing that this won't actually be much of an issue when we deploy to prod, but it's strange, so I thought I'd ask if anyone knows what's going on. Here's a screenshot of our settings:

And here's the address list you see there:

Any ideas would be appreciated!

Thanks,

Ian

Re: Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

Kim_Nilsson — Thu, 28 Mar 2024 10:28:45 GMT

Untick the box for internal mails and try again.

Re: Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

Kim_Nilsson — Thu, 28 Mar 2024 10:31:31 GMT

I agree that it shouldn't be necessary, but Google's logic may go on the language of the rule and not really on the technical difference when they say that parent domains and subdomains are allowed.

Internal email: To allow internal messages between users within your organization, use the Bypass this setting for internal messages option. Internal messages between your organization domains, including parent domains and subdomains, bypass this setting.

Re: Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

npl — Tue, 02 Apr 2024 08:17:05 GMT

You could also run the rule for internal and external and use the

Address lists: Bypass this setting for specific addresses/domains

option to bypass the for local domains - scroll to the bottom of the rules and click show more.

Re: Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

icrew — Wed, 03 Apr 2024 20:30:36 GMT

Thanks @Kim_Nilsson -- that did the trick. I hadn't noticed the "parent domains and subdomains" bit.