EMAIL-034: Spoofed and unauthenticated mail is not left in the inbox (GWS.GMAIL.7.6)
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 3)
- Golden fixtures
- 8
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.GMAIL.7.6: the spoofing and authentication protections cover the impersonation patterns that carry business email compromise, including lookalike domains, employee-name spoofing and unauthenticated senders. Flagging such a message and leaving it in the inbox still puts it in front of the recipient. Reads gmail.spoofing_and_authentication and requires the domain, domain-name, employee-name, groups and unauthenticated-email consequences each to be SPAM_FOLDER or QUARANTINE.
Recommended value
Every spoofing and authentication protection moves flagged mail to spam or quarantine
Remediation
Admin console > Apps > Google Workspace > Gmail > Safety > Spoofing and authentication. For each protection, set the action to move the message to spam or to quarantine rather than keeping it in the inbox.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| field-missing | Not Assessed |
| known-bad-domain | FAIL |
| known-bad-domainname | FAIL |
| known-bad-employee | FAIL |
| known-bad-groups | FAIL |
| known-bad-unauth | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.GMAIL.7.6v1
- NIST SP 800-53
- SI-3, SI-8, IA-2
- MITRE ATT&CK
- T1566.002, T1534