Restricted delivery and subdomains/top-level domains? (Penalty Box OU)

[icrew]

Hi all:

We're looking into creating a "penalty box" OU, where one of the settings is to restrict email to only within our domain (no email from or to outside domains).

According to https://support.google.com/a/answer/2640542?hl=en, that should be pretty easy to do with the "restrict delivery" compliance setting.

But we're seeing some weird results: I'm setting this up on a test Workspace instance (sandbox.example.edu) that's fully independent of our production workspace instance (example.edu). They're two completely disconnected Workspace instances, and there isn't any domain allowlisting between them.

But it seems that even with the restrict delivery setting turned on, it's still possible to send mail between sandbox.example.edu and example.edu, and I can't figure out why. I'm guessing that this won't actually be much of an issue when we deploy to prod, but it's strange, so I thought I'd ask if anyone knows what's going on. Here's a screenshot of our settings:

And here's the address list you see there:

Any ideas would be appreciated!

Thanks,

Ian

[Kim_Nilsson]

Untick the box for internal mails and try again.

[Kim_Nilsson · Accepted solution]

I agree that it shouldn't be necessary, but Google's logic may go on the language of the rule and not really on the technical difference when they say that parent domains and subdomains are allowed.

• Internal email: To allow internal messages between users within your organization, use the Bypass this setting for internal messages option. Internal messages between your organization domains, including parent domains and subdomains, bypass this setting.

[icrew]

Thanks @Kim_Nilsson -- that did the trick. I hadn't noticed the "parent domains and subdomains" bit.

[npl]

You could also run the rule for internal and external and use the 

 Address lists:  Bypass this setting for specific addresses/domains

option to bypass the for local domains - scroll to the bottom of the rules and click show more.