Email threat protection Available now
Gateway filtering checks mail before it reaches Google Workspace and holds impersonation, payment-change scams, risky links and malware, each with readable reasons.
Google Workspace · Gmail
Email protection and backup for Google Workspace
Stop invoice fraud and phishing before it reaches Gmail, keep an independent copy of every mailbox, and bring lost mail back through restores your administrator approves.
KnoxDefender is not affiliated with or endorsed by Google.
- Your super admin authorizesA service account with specific Gmail and Admin scopes, each explained first.
- Choose mailboxesPick which mailboxes are protected and who approves restores.
- Point MX (optional)For filtering before delivery, MX goes to KnoxDefender and an inbound gateway setting delivers to Gmail.
- Monitor and recoverBackup freshness, restore tests, held mail and account alerts in one console.
What you get on Google Workspace
Six email pillars, each with its real status
Email backup and recovery In provider verification
Daily encrypted backups outside Google Workspace, with a key per organization; restores go to a "Recovered" label in the same mailbox.
SPF, DKIM and DMARC Available now
Checks your records, reads DMARC reports by sender and explains each fix with the record to copy.
Mailbox account security In provider verification
Alerts on forwarding to outside addresses, hidden rules, new delegates and suspicious sign-ins where licensing provides them.
Archiving and former staff In provider verification
Search retained mail across mailboxes, legal holds with recorded reasons, mail kept after an account is removed.
Awareness training Available now
Short lessons and authorized phishing simulations using invented brands only.
Filtering
Checked before the inbox
With gateway filtering, your MX record points to KnoxDefender and clean mail is delivered to Gmail. In the Google Admin console you add KnoxDefender as an inbound gateway so Gmail trusts the checks already made.
Gateway filtering needs no Google Workspace API permission: only DNS records (MX, a TXT ownership check) and a setting in your admin console.
Reporting phishing: the staff portal or forwarding the message as an attachment. A Gmail add-on is not available yet.
Good to know
- Google requires app verification for the Gmail scopes that backup uses. Google backup turns on for customers once that verification is complete.
- In Gmail, Trash is emptied after 30 days; an admin can then restore messages for another 25 days. KnoxDefender keeps its own copy for the retention you choose.
- API mode (no MX change) checks mail shortly after delivery. It is not pre-delivery blocking.
- Email only: Google Drive, Calendar and Contacts are not backed up.
Permissions
Exactly what we ask for, and why
Your administrator approves these before anything connects. We request only what your plan uses.
| Permission | Used for |
|---|---|
admin.directory.user.readonly | Finding mailboxes in your directory |
gmail.readonly | Backing up messages and scoring delivered mail |
gmail.insert, gmail.labels | Restoring messages into a "Recovered" label |
gmail.modify | Moving delivered threats to quarantine (API mode, protection plans only) |
gmail.settings.basic | Checking filters, forwarding and delegates (mailbox security plans) |
admin.reports.audit.readonly | Suspicious logins, 2-Step Verification changes and app grants (mailbox security plans) |
Does Google Workspace already back up my email?
Google keeps the service running. Deleted Gmail stays in Trash for 30 days, and an admin can restore it for another 25 days after that. Beyond that window, or after an attacker or a departing employee deletes mail, recovery depends on having your own copy.
Do we have to change our MX record?
Only for filtering before delivery. Domain protection and training need no Google permission at all; backup and mailbox security use the authorized service account.
Is Google backup available today?
It is built and tested, and switches on for customers once Google completes the app verification it requires for the Gmail scopes we use. We will tell you the status when you ask for a quote.
Where do restored messages go?
Into a "Recovered" label in the mailbox, after an administrator approves the request. Nothing is overwritten.
Protect your Google Workspace email.
Tell us how many mailboxes you have. We reply with a written quote, including nonprofit pricing.