|
| 1 | +--- |
| 2 | +title: Add BCC rules |
| 3 | +pcx_content_type: how-to |
| 4 | +sidebar: |
| 5 | + order: 4 |
| 6 | +--- |
| 7 | + |
| 8 | +1. Log in to the [Google Admin Console](https://admin.google.com/). |
| 9 | +2. On the sidebar, go to **Apps** > **Google Workspace** > **Gmail** > **Compliance**. |
| 10 | +3. Go to **Content Compliance** > Select **Edit**. |
| 11 | +4. Add a **Content Compliance** filter, and name it `Email Security - BCC`. |
| 12 | +5. In **Email messages to affect**, select **Inbound**. |
| 13 | +6. Select the recipients you want to send emails to Email Security via BCC. Under **Add expressions that describe the content you want to search for in each message**: |
| 14 | + - Select **If ANY of the following match the message**. |
| 15 | + - Select **Add** to configure the expression. |
| 16 | + - Select **Advanced content match**. |
| 17 | + - In **Location**, select **Headers + Body**. |
| 18 | + - In **Match type**, select **Matches regex**. |
| 19 | + - In **Regexp**, input `.*`. You can customize the regex as needed and test within the admin page or on sites like [Regexr](https://regexr.com/). |
| 20 | + - Select **SAVE**. |
| 21 | +7. In **If the above expressions match, do the following**: |
| 22 | + - Select **Modify message**. |
| 23 | + - Ensure that **Envelope recipient** > **Change envelope recipient** is unselected, so that emails will not be dropped as an unintended consequence. You will select this option at a later stage. |
| 24 | + - Go to **Also deliver to**, select **Add more recipients** > **ADD** > Choose **Advanced**: |
| 25 | + - Under **Envelope recipient**, select **Change envelope recipient** > **Replace recipient** > Enter the email of the recipient. |
| 26 | + - Under **Spam and delivery options**, select **Suppress bounces from this recipient**. |
| 27 | + - Under **Headers**, select **Add X-Gm-Spam and X-Gm-Phishy headers**. |
| 28 | + - Select **SAVE**. |
| 29 | +8. In **Account types to affect**, select **Users** and **Groups**. |
| 30 | +9. Select **SAVE**. |
0 commit comments