When you configure Netskope SMTP Proxy with Gmail, all outgoing emails from Gmail are sent to Netskope SMTP Proxy for policy evaluation.
The configuration involves the following steps,
Configure the Gmail Server and the upstream MTA in the Netskope Tenant
- In the Netskope UI, go to Settings > Security Cloud Platform > SMTP.
- On the SMTP page, click the Google Gmail app.
- Under Google Gmail, click Edit.
- In the Edit Google Gmail Settings window:
- Email Server Setting: Copy and enter this FQDN in Google Admin console to route emails through the Netskope Cloud. You will require this FQDN when configuring Netskope SMTP Proxy as a connector in the Google Admin console.
- Domain: Enter and verify the Gmail domain you want to use for email processing. You can enter a domain, subdomain, or a wildcard domain (e.g., abc.com, cde.abc.com, and *.abc.com). To learn more about finding the Gmail domain in the Google Admin console see: Finding the Gmail domain in the Google Admin console.
Caution
Configure each of your MAIL FROM domains. If not, emails from the domain will be rejected.
- Next Hop: Enter the IP address/FQDN as smtp-relay.gmail.com and the port as 587.
Click +Add to add multiple domain entries. Select Set Tenant ID and Next Hop for Each Domain if you want to enter a unique next hope for each domain entry.
- Click Save.
Finding the Gmail Domain in the Google Admin Console
- Log into the Google Admin console and click the main menu
to view the left pane. - Go to Account > Domains > Manage domains. You can see a list of domains you can use to configure Netskope SMTP proxy.
Configure Netskope SMTP Proxy in Google admin center
- Log into the Google Admin console and click Apps > Google Workspace > Gmail.
- On the Settings for Gmail page, click Hosts to define the host that Gmail will use to connect to the Netskope SMTP Proxy.
- Under Hosts click Add Route.
- In the Add mail route dialog box, specify the host name and paste the Netskope domain name you copied from the Netskope tenant.
- Click Test TLS connection to verify that the connection to the host was successful. Click Save.
Configure Content Compliance to send traffic from Gmail to Netskope
- On the Settings for Gmail page, click Advanced settings.
- On the General Settings page, go to the Compliance section.
- Mouseover Content compliance and click Add Another to add a new entry.
- In the Add setting dialog box, set the following:
- Under step 1, Email messages to affect, select Outbound.
- Under step 2, Add expressions that describe the content you want to search for in each message,
- Click Add to add a new expression and select Advanced content match.
- Under Location, select Full header and under Match type, select Not contains text.
- Enter the following content,
x-netskope-inspected. Click Save.
- Under step 3, If the above expressions match, do the following, select Change route and select the Netskope host from the drop-down list.
- In the Encryption (onward delivery only) section of step 3, select Require secure transport (TLS).
- Click Show options and under step B. Account types to affect, select Users, Groups and, Unrecognized / Catch-all.
- Click Add Setting.