Create a Gmail Quarantine Transport Rule

1. Log in to the Google Admin portal.
2. In the Dashboard, select AppsGoogle WorkspaceGmailCompliance.
3. In the Content compliance section, Add Another Rule.

4. Configure the quarantine transport rule.

   1. In the Content compliance field, enter a descriptive name for the transport rule.
   2. For the Email messages to affect, select Outbound.

      This instructs Gmail to forward the email to Enterprise DLP before it leaves your network when the email recipient is outside your organization.

   3. Configure email forwarding to Enterprise DLP for emails that have not been inspected.

      1. In the Add experiences that describe the content you want to search for in each message section, select If ANY of the following match the message.
      2. Add.
      3. In the Add setting page, select Advanced content match.
      4. For the Location, select Full Headers.
      5. For the Match type, select Starts with.
      6. For the Content, enter x-panw-action: quarantine.
      7. Save.

   4. Configure the action Gmail takes for emails that need to be quarantined.

      1. In the If the above expressions match, do the following section, select Quarantine message.
      2. In the Move the message to the following quarantine, select the Gmail quarantine inbox you want to forward emails that need to be reviewed by an email administrator.
      3. Enable Notify sender when email is quarantined (onward delivery only).

   5. Configure the types of Gmail accounts the transport rule affects.

      1. Show Options.
         After you expand the options menu, the button displays Hide Options.
      2. In the Account types to affect section, select Users, Groups, and Unrecognized / Catch-all.

   6. Save.
5. Verify that the email transport rule was successfully added and that the Status is Enabled.

6. An email administrator must review and allow or reject quarantined emails forwarded to the quarantine mailbox.

   Due to a Gmail limitation, SaaS Security generates two Email DLP logs (ManageConfigurationSaaS SecurityData SecurityLogsEmail DLP Logs) when a quarantined email is allowed. The first Email DLP log describes the initial outbound email blocked by Email DLP. The second Email DLP log describes the allowed outbound email that is sent back to Enterprise DLP to add x-panw-inspected: true and x-panw-action: monitor to the email header before it continues on its path to the intended recipient.