Users Receive Red Warning Banner in Gmail

Question

Why do targets (users) see a red or yellow warning banner when a Phishing email arrives in the target's Inbox?

Answer

Some GSuite users may see the following alerts when they receive Phishing emails. Although you may have Safelisted the Phishing mail server IP addresses in GSuite, you will also have to add the Phishing IP addresses as Inbound Gateways.

1. Log in to the Google Admin Console
2. Select the Apps icon
3. Click on the GSuite app icon
4. Click on the Gmail icon (the red M)
5. Scroll to the bottom of the page and click Advanced Settings
6. Select the organization's domain in the left column under General Settings
7. Scroll down to the Spam section and locate Inbound gateway.
8. Click the CONFIGURE button to the right of the page.
9. Click Edit.

10. On the Inbound gateway page, add the IPs to the IP addresses / ranges setting. (See Safelisting Guide for a list of IP addresses)
11. Make sure Require TLS for connections from email gateways listed above is checked.
12. Under Message Tagging, enter text for the Spam Header with a random string of unique characters in the Regexp field (Optional)
    • i.e. gsdghthryjjdfjfjdhj.
13. Make sure the radial button Message is spam if regexp matches is selected.(Optional)
14. Check the box for Disable Gmail spam evaluation on mail from this gateway; only use header value. (Optional)
15. Click Save