domainwidedelegation.comStart free

Use cases → Email operations

Manage domain-wide email allow and block lists centrally

Set, update, and audit email whitelist and blacklist rules across all users from one place, avoiding manual filter drift and inconsistent enforcement.

Who it is forIT operations teams responsible for enforcing consistent mail policy across many users or business units.
APIsGmail API, Admin SDK
Typical scopesgmail.settings.basic, admin.directory.user.readonly

The problem

Left to users, whitelist and blacklist rules diverge, creating inconsistent exposure to threats and lost mail. Manual updates are slow, error-prone, and impossible to audit at scale. Centralised management is needed, but the native admin UI is limited and does not scale to hundreds or thousands of mailboxes.

How it works

  1. Enumerate all active users with the Admin SDK.
  2. With a delegated service account, apply or update the required filter(s) in each user's Gmail settings using the Gmail API.
  3. Store and version the intended ruleset outside Google Workspace for audit and rollback.
  4. Regularly scan for filter drift and reconcile any manual user changes.

What changes

All users get the same allow/block behaviour, with changes propagating in minutes and a clear audit trail of policy history.

The trap in this one. The Gmail API's filter insertion is not idempotent: if you push the same rule repeatedly, you create duplicates and unpredictable priority ordering, which can allow blocked senders through or override whitelists. Always fetch and diff existing filters before applying changes, and prune obsolete rules explicitly—otherwise, enforcement will silently degrade over time.

Questions people ask

Can users override or delete centrally-managed filters?

Yes, if users have access to their own filters, they can remove or modify them. Central management should periodically scan and reconcile to catch and revert such changes.

Does this approach work for groups or aliases?

No. The Gmail API only manages filters on individual user mailboxes, not on group or alias addresses. These require separate handling via group settings.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Standardise email signatures for all users in bulk

Set consistent signatures across the domain by updating each user's Gmail settings via a delegated service account.

Enforce encryption for sensitive email content automatically

Detect sensitive data in outbound mail and apply encryption or block sending using a delegated service account.

Send a survey to every employee by mail merge

Deliver a company-wide survey by generating individual emails to all users via a delegated service account, avoiding mass recipient limits.