domainwidedelegation.comGet it set up

Use cases → Email operations

Monitor unauthorised Gmail filters with domain-wide delegation

Detecting and alerting on suspicious Gmail filter changes via the API requires careful baselining and regular polling, as not all changes surface in security dashboards immediately.

Who it is forSecurity operations teams responsible for Workspace email monitoring.
APIsGmail API
Typical scopesgmail.readonly

The problem

Attackers frequently establish persistence in compromised mailboxes by creating forwarding or auto-delete filters, which may not be immediately visible in the Security Investigation Tool. Manual auditing is infeasible at scale, and native alerting for filter changes is limited. Without automated monitoring, malicious rules can persist undetected, leading to data loss or silent exfiltration.

How it works

  1. Export the current set of Gmail filters for each monitored user using the Gmail API’s filters.list endpoint.
  2. Generate and store a cryptographic hash or a structured snapshot of each user’s filter configuration as a baseline.
  3. On a scheduled basis (e.g., hourly), fetch the latest filter data for each mailbox and compare it to the stored baseline.
  4. Log all differences, including new, modified, or deleted filters, with timestamps and relevant filter properties.
  5. Alert on suspicious patterns, such as filters that forward mail externally, auto-delete messages, or target sensitive keywords.

What changes

Any deviation from the known-good filter state is immediately flagged, providing early warning of attacker persistence techniques. This approach closes gaps left by native tools and enables incident responders to react faster.

The trap in this one. The Gmail API’s filters.list endpoint is eventually consistent. If an attacker adds a rule and deletes it quickly, scheduled polling may miss it entirely—no trace appears in the returned filter list. For critical accounts, consider cross-checking with audit logs or increasing polling frequency, as not all filter changes are captured in near-real time by the API or surfaced in the Security Investigation Tool.

Watch it explained

“Tip 5: Gmail safety features | 10 Security Tips for Google Workspace” — AppsEDU 🤓 Google Workspace tech experts on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

How do I identify if a filter is malicious?

Look for filters forwarding to external addresses, deleting messages without user action, or targeting sensitive keywords. Combine this with knowledge of normal mailbox rules for context.

Can I restore deleted filters if an attack is detected?

The Gmail API does not provide a historical record of deleted filters. You must reconstruct the intended state from your baselined snapshots and reapply them if needed.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Draft replies automatically in a shared inbox

A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.

Triage and route inbound mail across a domain

Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.

Send mail as a shared alias from automation

Deliver notifications, confirmations and campaign replies from a branded address like support@ or updates@ without a human in the loop.