Gmail (Google Workspace) - SMTP Secure Email Gateway Configuration
Introduction.
This section provides instructions for configuring email routing between Gmail and the Lookout secure email gateway.
Headers of the email sent or received by the Gmail tenant are inspected for a flag that specifies whether the email has already been inspected by Lookout.
If the flag is not present, the header is amended with Lookout tenant specific information that allows the Lookout Security Platform to route the email to the correct tenant and apply policy. The email is sent from Gmail to Lookout through a configured route, processed by Lookout and a flag added to the header by Lookout. The email is then routed back to Gmail. Recognising that email has already been inspected, Gmail routes the email to the initial intended recipient.
This configuration includes the following procedures:
Obtain configuration information from Lookout Management Console
Create and configure a mail flow rule in Gmail
Configure a connector for routing email from Gmail to the secure the email gateway
Configure forwarding of email
- Obtain configuration from Lookout Management Console. This section assumes that a default environment has already been configured and the sanctioned application already created within App Management. The sanctioned application has Gmail (SMTP) enabled and Email enabled within the Protection Model.
- Log into the Lookout Management Console and navigate to Administration > Environment Management.
- Edit the Default environment.
- Click the Email tab.
- Take note of the Domain Name in the ‘Incoming Emails from Cloud Applications or User’ section.
- In the ‘Outgoing Email Settings’ section select Internal Relay.
- Enter smtp-relay.Gmail.com in Domain Name.
- Enter the Port number as 25 Port (this should match the port number set in Google Workspace Admin Console).
- Click Save.
- Navigate to Administration ➔ App Management. Note the same as the Google Workspace application to be used for SMTP integration.
- Configure a connector for routing emails from Gmail to the secure the email gateway. This section details the process to configure an outbound route for emails to be routed from Gmail to Lookout should they meet the rules specified in section 3. An outbound route is created to target the MX record DNS entry of your specific Lookout tenant.
- In the Google Workspace Admin Console, navigate to Apps ➔ Google Workspace ➔ Gmail.Click on Hosts.
- Click Add Route.
- In the Name field, enter a meaningful name.
- Select Single host from the dropdown
- In the Enter hostname or IP field, enter the domain name from step 1d, found in the Lookout Management Console
- In the port field, enter the port from step 1g, found in the Lookout Management Console
- Under section 2. Options, select:
- Perform MX Lookup on host Perform MX Lookup on host
- Require mail to be transmitted via a secure (TLS) connection (Recommended)
- Require CA signed certificate (Recommended)
- Validate certificate hostname (Recommended)
- To validate the connector configuration. Click Test TLS Connections. A successful response should be displayed. If the response is not successful, check configuration and contact support. Click Save.
- Create and configure a mail flow rule in Gmail. The section details how to configure rules that determine whether an email should be routed from Gmail to Lookout. If Gmail recognizes a specific flag in the email header indicating that the email has already been inspected by Lookout, the email bypasses the rule and is sent to its intended recipient. If the rule is matched and the flag is not within the header, then the header is amended with a Lookout specific tenant flag and sent to Lookout through the route configured in section 2.
- In Google Workspace Admin Console navigate to Apps > Google Workspace > Gmail.Scroll down and click Compliance. Scroll down to Content Compliance and Click on Add Rule. The Add Setting window will pop up. In the title field enter a name.
- In section 1.Email messages to affect, select which type of emails should be routed to Lookout for inspection. Inbound: All emails that are received from external senders will be routed to Lookout for inspection Outbound: All emails that are sent to external recipients from internal senders will be routed to Lookout for inspection. Internal – Sending: All emails that are sent to internal recipients from internal senders will be routed to Lookout for inspection. Internal – Receiving: All emails that are received by internal recipients from internal senders will be routed to Lookout for inspection. NOTE: It is recommended that Outbound is selected as a minimum to ensure security of data leaving the organization.
- In section 2. Add expressions that describe the content you want to search for in each message, select If ANY of the following match the message from the drop down. Under Expressions click on ADD. The Add Setting window will pop up. Select Advanced Content Match from the drop down. In the Location drop down, select Headers + Body.
- In the Match Type drop down, select Not contains text In the Content field, enter X-CC-Processed and click Save In section 3. If the above expressions match, do the following select Modify message from the drop down.
- Under Headers, select Add custom Headers Click ADD. In the X-Header key field enter CC-ACCOUNT-TENANTID In the Header value field enter the application name from the Lookout Management Console followed by a colon, followed by the Lookout tenant ID. Example: Google_SMTP:etst04 where Google_SMTP is the application name in the Lookout Management Console and etst04 is the Lookout tenant ID.
- Click Save. Note: The header is case sensitive. The application name must be as it is shown in the Lookout Management Console and the tenant ID MUST be in lowercase. Scroll down to Route and select change route In the drop down, select the Host that you created above. Click Save.
Whitelist the Lookout secure email gateway to Gmail (SMTP) - Inbound Connector
This section details the configuration required to accept inbound messages from Lookout after inspection. The IP addresses of the Lookout SMTP servers are whitelisted, accepting inspected emails, for sending onward to the intended recipients.
In the Google Workspace Admin Console, navigate to Apps > Google Workspace > Gmail, scroll down and click on Routing.
Scroll down to SMTP relay service and click Add New Rule.
Give the rule a meaningful name
In section 1. Allowed Senders, select Any addresses (not recommended) from the drop down.
In section 2. Authentication, select Only accept mail from the specified IP addresses.
Under the IP address / ranges section, add the IP addresses for the Lookout SMTP servers NOTE: These IP addresses must be obtained from support. They cannot be obtained through NSLOOKUP.
Click Save. Click Save.
Testing the configuration:
To test the configuration, send an email from Gmail to a recipient that you have access to. Inspect the Gmail logs to ensure the email has been sent out, received back. Then check at the recipient client to ensure that the email has arrived and that it has been processed by Lookout by inspecting the header.
After a couple of minutes of the email being sent navigate to Reporting > Email Log Search in the Google Workspace Admin Console.
Click on Search.
The email will be shown in the list of emails. Click on the Subject/Message ID
Under Recipient details expand the drop down and ensure that the email was delivered to the MX record specified in step 2f. You can achieve this by executing a NSLOOKUP of the MX record and ensuring that one of the resolved IP addresses is the same as the IP address shown in the Email Log Search.
If the email has successfully been inspected by Lookout and sent back to Gmail for onward processing, the Email Log Search will show that the email has further been received from an SMTP client with the same IP address as that configured above.
In the recipient email client, the email should have been received. Open the email and inspect the header to ensure that the processed flag has been added.
