Added another sender to my NeverSpam list

[Kim_Nilsson]

In Gmail Compliance & Spam settings you can exclude certain addresses from the spam filter.

In my opinion, it's a good idea to do so for the official sender addresses from Google services, so they always reach their recipients. Google, of course, makes sure all such emails are properly signed and sent from the service, so they should generally be safe to recieive.

Ot course, the recipient must then abide by same safety precautions as always, as the actual content of the email, may still be dangerous or malicious in some way. That an email is properly sent only means that. It does not mean that the content is safe.

You find the Spam setting here.

https://admin.google.com/ac/apps/gmail/spam

And the ability to create and manage lists here. (Also clickable from inside the Spam setting).

https://admin.google.com/ac/apps/gmail/manageaddresslist?addressListType=1

I have the following options set for this NeverSpam rule.

And this is my list of known sender addresses (I added Keep today).

Here they are in a copyable list in Google Sheets.

https://docs.google.com/spreadsheets/d/1jis2uflHu9My8otwD6Kr4PMxSGADBaemDxwncy1MK9Q/edit?usp=sharing

The two at the top (cosafe & lifesify) are specific for our organisation, and not Google's.

[Justin_W]

Interesting. I've not gotten reports of anything from those Google addresses ever going to user's spam. (yet).

Question: Does the list override user "Spam" action? In other words, if a usually manually marks one as Spam - does it then go to spam from their on out (for just that user) or does the list keep it in the Inbox?

[Kim_Nilsson]

I think this setting is supposed to override users' actions.

[Kim_Nilsson]

We have our SPF, DKIM and DMARC settings quite stringent, and then emails not actually sent from users are considered "external" and "spoofing", so I had to exclude them.

[marion]

Thank you for this, it's helpful to us! We have a question though. Right now, we have two "sets" of rules/policies in the spam section:

(If it's not obvious, the second set is for our phishing training campaigns.) I don't understand why we wouldn't just do this instead -- have a single ruleset which uses both lists:

What would you advise? Thanks in advance.

[Kim_Nilsson]

That sounds like it should work fine.

The exclusion list should exclude the phishing training completely, regardless if it's in its own rule or the same rule as something else.