How to Restrict Email Delivery to Specific Domains in Google Workspace

Securing Internal Communications

In highly regulated industries (like healthcare, defense contracting, or financial services), data exfiltration is a massive concern. You may have a specific group of employees—like outsourced contractors, seasonal interns, or data entry clerks—who need a corporate email address to communicate with internal staff, but who should never be allowed to email external domains (like gmail.com, yahoo.com, or a competitor’s domain).

To enforce this security boundary, Google Workspace Administrators can configure a Restrict Delivery routing rule, ensuring that specific Organizational Units (OUs) are physically incapable of sending or receiving emails outside of a pre-approved whitelist of domains.

Step 1: Create the Whitelist

Before you restrict delivery, you must define the list of domains that are allowed. At a minimum, this must include your own internal company domains.

1. Log into the Google Workspace Admin Console (admin.google.com).
2. Navigate to Apps > Google Workspace > Gmail > Routing.
3. Scroll down to the Restrict delivery section and click Configure (or Edit, if a rule already exists).
4. Under “Lists of allowed domains,” click Create or edit list. A new tab will open.
5. Click Add a List. Name it “Internal Only Domains.”
6. Add your primary domain (e.g., yourcompany.com) and any necessary subsidiary domains. Click Save and return to the previous tab.

Step 2: Apply the Restriction to an OU

You almost certainly do not want to apply this restriction to your entire company, as your Sales team needs to email clients. You must apply it only to a specific OU.

1. On the left side of the Routing page, select the Organizational Unit containing your contractors or restricted employees (e.g., “Seasonal Interns”).
2. In the Restrict Delivery configuration box, check the box next to the “Internal Only Domains” list you just created.

Step 3: Define the Rejection Message

When an intern attempts to email [email protected], Google’s servers will instantly reject the message and send a bounce-back error to the intern.

In the Rejection notice text box, you should provide a clear, custom explanation so the employee doesn’t submit a broken-email IT ticket.

Example: “Security Policy Enforcement: Your account is restricted to internal communications only. You are not authorized to email external domains.”

Step 4: Save and Test

Click the Save button at the bottom of the screen.

The policy usually takes effect within 10 to 15 minutes. To test it, log into a test account located within the restricted OU and attempt to send an email to your personal Gmail account. The email should bounce back immediately with your custom rejection message, proving that your data boundary is secure.