Table of Contents
Note: Make sure to perform the changes described in this KB before applying the ESG in the inbound scenario to avoid mail disruption
Problem
When in Google Workspace there are routing rules to forward emails to another mailbox within the same domain, Google delivers the message through the Email Security Gateway (ESG) without applying SRS (Sender Rewriting Scheme). This can cause the message to be rejected by ESG due to SPF or related authentication failures.
This behavior is a limitation of Google Workspace
Solution
Affected scenario (NOT recommended)
Google Workspace does not apply SRS when routing to a final mailbox.
Recommended workaround (SUPPORTED)
Configure routing rules to deliver messages to a Google Workspace Group, with the intended recipients added as group members. In this case, Google correctly applies SRS.
This works for both:
-
mail → routing rule → group -
mail → group directly