Cybersecurity and Infrastructure Security Agency Logo

Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Gmail Baseline Report

Customer Name Customer Domain Customer ID Report Date Baseline Version Tool Version
Cool Example Org example.org ABCDEFG 10/15/2026 15:53:04 Pacific Daylight Time 1 v1.1.0
Policy Indicators:

GMAIL-1 Mail Delegation

Control ID Requirement Result Criticality Details
GWS.GMAIL.1.1v1 Mail delegation SHOULD be disabled.
Automated Check
 Warning Should The following OUs are non-compliant:
  1. Cool Example Org
    Mail delegation is enabled

GMAIL-2 DomainKeys Identified Mail

Control ID Requirement Result Criticality Details
GWS.GMAIL.2.1v1 DKIM SHOULD be enabled for all domains.
Automated Check Configurable
 Warning Should 2 of 3 agency domain(s) found in violation: stephens-reed.com, example.org. View DNS logs for more details.

GMAIL-3 Sender Policy Framework

Control ID Requirement Result Criticality Details
GWS.GMAIL.3.1v1 An SPF policy SHALL be published for each domain that fails all non-approved senders.
BOD 25-01 Requirement Automated Check Configurable
 Fail Shall 1 failing domain(s):
  • example.org: Domain does not exist.
View DNS logs for more details.

GMAIL-4 Domain-based Message Authentication, Reporting, and Conformance

Control ID Requirement Result Criticality Details
GWS.GMAIL.4.1v1 A DMARC policy SHALL be published at the full domain or the second-level domain for all Google Workspace domains, including user alias domains.
BOD 25-01 Requirement Automated Check Configurable
 Fail Shall 2 of 4 agency domain(s) found in violation: stephens-reed.com, example.org. View DNS logs for more details.
GWS.GMAIL.4.2v1 The DMARC message rejection option SHALL be p=reject.
BOD 25-01 Requirement Automated Check Configurable
 Fail Shall 2 of 4 agency domain(s) found in violation: stephens-reed.com, example.org. View DNS logs for more details.
GWS.GMAIL.4.3v1 The DMARC point of contact for aggregate reports SHALL include `reports@dmarc.cyber.dhs.gov`.
BOD 25-01 Requirement Automated Check Configurable
 Fail Shall 3 of 4 agency domain(s) found in violation: stephens-reed.com, example.org, example.org.test-google-a.com. View DNS logs for more details.
GWS.GMAIL.4.4v1 An agency point of contact SHOULD be included for aggregate and failure reports.
Automated Check Configurable
 Warning Should 4 of 4 agency domain(s) found in violation: freeman.com, stephens-reed.com, example.org, example.org.test-google-a.com. View DNS logs for more details.

GMAIL-5 Attachment Protections

Control ID Requirement Result Criticality Details
GWS.GMAIL.5.1v1 "Protect against encrypted attachments from untrusted senders" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.5.2v1 "Protect against attachments with scripts from untrusted senders" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.5.3v1 "Protect against anomalous attachment types in emails" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.5.4v1 Google SHOULD be allowed to automatically apply future recommended settings for attachments.
Automated Check
 Pass Should Requirement met.
GWS.GMAIL.5.5v1 Emails flagged by SCuBA policies GWS.GMAIL.5.1 through GWS.GMAIL.5.3 SHALL NOT be kept in inbox.
BOD 25-01 Requirement Automated Check
 Fail Shall The following OUs are non-compliant:
  1. Cool Example Org
    anomalous type, encrypted attachment emails not removed from inbox

GMAIL-6 Links and External Images Protection

Control ID Requirement Result Criticality Details
GWS.GMAIL.6.1v1 "Identify links behind shortened URLs" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.6.2v1 "Scan linked images" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.6.3v1 "Show warning prompt for any click on links to untrusted domains" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.6.4v1 Google SHALL be allowed to automatically apply future recommended settings for links and external images.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.

GMAIL-7 Spoofing and Authentication Protection

Control ID Requirement Result Criticality Details
GWS.GMAIL.7.1v1 "Protect against domain spoofing based on similar domain names" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.7.2v1 "Protect against spoofing of employee names" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.7.3v1 "Protect against inbound emails spoofing your domain" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.7.4v1 "Protect against any unauthenticated emails" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.7.5v1 "Protect your Groups from inbound emails spoofing your domain" SHALL be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.7.6v1 Emails flagged by SCuBA policies GWS.GMAIL.7.1 through GWS.GMAIL.7.5 SHALL NOT be kept in inbox.
BOD 25-01 Requirement Automated Check
 Fail Shall The following OUs are non-compliant:
  1. Cool Example Org
    domain name, employee name spoof emails not removed from inbox
GWS.GMAIL.7.7v1 Google SHALL be allowed to automatically apply future recommended settings for spoofing and authentication.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.

GMAIL-8 User Email Uploads

Control ID Requirement Result Criticality Details
GWS.GMAIL.8.1v1 User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.

GMAIL-9 POP and IMAP Access for Users

Control ID Requirement Result Criticality Details
GWS.GMAIL.9.1v1 POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.
BOD 25-01 Requirement Automated Check Configurable
 Fail Shall The following OUs are non-compliant:
  1. Cool Example Org (group stoutbobby@example.org)
    IMAP access is enabled
  2. Julia Lee DDS's OU
    POP access is enabled
  3. Dr. Sara Fernandez's OU (in Tammy Reynolds's OU/Sharon Knox's OU)
    IMAP access is enabled

Note: IMAP is enabled in the following locations but ScubaGoggles was configured to allow exceptions for them:
  • Cool Example Org (group stoutbobby@example.org).
  • Sharon Knox's OU (in Tammy Reynolds's OU).
  • Julia Lee DDS's OU. Justification: because perfectly valid reasons

GMAIL-10 Google Workspace Sync

Control ID Requirement Result Criticality Details
GWS.GMAIL.10.1v1 Google Workspace Sync SHOULD be disabled.
Automated Check
 Warning Should The following OUs are non-compliant:
  1. Dr. Sara Fernandez's OU (in Tammy Reynolds's OU/Sharon Knox's OU)
    Google Workspace Sync is enabled

GMAIL-11 Automatic Forwarding

Control ID Requirement Result Criticality Details
GWS.GMAIL.11.1v1 Automatic forwarding SHOULD be disabled, especially to external domains.
Automated Check
 Warning Should The following OUs are non-compliant:
  1. Dr. Sara Fernandez's OU (in Tammy Reynolds's OU/Sharon Knox's OU)
    Automatic email forwarding is set to: enabled

GMAIL-12 Per-user Outbound Gateways

Control ID Requirement Result Criticality Details
GWS.GMAIL.12.1v1 The option to use a per-user outbound gateway that is a mail server other than the Google Workspace (GWS) mail servers SHALL be disabled.
BOD 25-01 Requirement Automated Check
 Fail Shall The following OUs are non-compliant:
  1. Dr. Sara Fernandez's OU (in Tammy Reynolds's OU/Sharon Knox's OU)
    Per-user Outbound Gateways are enabled

GMAIL-13 Unintended External Reply Warning

Control ID Requirement Result Criticality Details
GWS.GMAIL.13.1v1 Unintended external reply warnings SHALL be enabled.
Automated Check Log-Based Check
 Pass Shall Requirement met.

GMAIL-14 Email Allowlist

Control ID Requirement Result Criticality Details
GWS.GMAIL.14.1v1 An email allowlist SHOULD NOT be implemented.
Automated Check
 Pass Should Email allowlists are disabled in Cool Example Org.

GMAIL-15 Enhanced Pre-Delivery Message Scanning

Control ID Requirement Result Criticality Details
GWS.GMAIL.15.1v1 Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.

GMAIL-16 Security Sandbox

Control ID Requirement Result Criticality Details
GWS.GMAIL.16.1v1 Security sandbox SHOULD be enabled to provide additional email protections.
Automated Check Log-Based Check
 Pass Should Requirement met.

GMAIL-17 Comprehensive Mail Storage

Control ID Requirement Result Criticality Details
GWS.GMAIL.17.1v1 Comprehensive mail storage SHOULD be enabled to allow information traceability across applications.
Automated Check
 Pass Should Requirement met.

GMAIL-18 Spam Filtering

Control ID Requirement Result Criticality Details
GWS.GMAIL.18.1v1 Domains SHALL NOT be added to lists that bypass spam filters.
BOD 25-01 Requirement Automated Check
 Fail Shall The following OUs are non-compliant:
  1. Cool Example Org
    Spam filters are bypassed for one or more domains: {Scuba: [Scuba: (stephens-reed.com, example.org)]}
GWS.GMAIL.18.2v1 Domains SHALL NOT be added to lists that bypass spam filters and hide warnings.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.
GWS.GMAIL.18.3v1 "Bypass spam filters" and "hide warnings for all messages from internal and external senders" SHALL NOT be enabled.
BOD 25-01 Requirement Automated Check
 Pass Shall Requirement met.

DNS Logs

DNS queries ScubaGear made while identifying SPF, DKIM, and DMARC records. Note: if DNS queries unexepectedly return 0 txt records, it may be a sign the system-defualt resolver is unable to resolve the domain names (e.g., due to a split horizon setup).

SPF

Query Name Query Method Summary Answers
p​a​u​l​.​i​n​f​o traditional Query returned 1 SPF record v​=​s​p​f​1​ ​i​n​c​l​u​d​e​:​s​p​f​.​e​f​w​d​.​r​e​g​i​s​t​r​a​r​-​s​e​r​v​e​r​s​.​c​o​m​ ​-​a​l​l
l​o​g​a​n​-​g​a​r​z​a​.​c​o​m traditional Query returned 1 SPF record v​=​s​p​f​1​ ​i​n​c​l​u​d​e​:​s​p​f​.​p​r​o​t​e​c​t​i​o​n​.​o​u​t​l​o​o​k​.​c​o​m​ ​-​a​l​l
t​a​y​l​o​r​-​s​n​o​w​.​b​i​z traditional Query returned NXDOMAIN No answers returned
t​a​y​l​o​r​-​s​n​o​w​.​b​i​z DoH NA, DoH servers unreachable No answers returned

DKIM

Query Name Query Method Summary Answers
g​o​o​g​l​e​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m traditional Query returned NXDOMAIN No answers returned
g​o​o​g​l​e​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m DoH NA, DoH servers unreachable No answers returned
s​e​l​e​c​t​o​r​1​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m traditional Query returned NXDOMAIN No answers returned
s​e​l​e​c​t​o​r​1​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m DoH NA, DoH servers unreachable No answers returned
s​e​l​e​c​t​o​r​2​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m traditional Query returned NXDOMAIN No answers returned
s​e​l​e​c​t​o​r​2​.​_​d​o​m​a​i​n​k​e​y​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m DoH NA, DoH servers unreachable No answers returned
g​o​o​g​l​e​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z traditional Query returned NXDOMAIN No answers returned
g​o​o​g​l​e​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z DoH NA, DoH servers unreachable No answers returned
s​e​l​e​c​t​o​r​1​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z traditional Query returned NXDOMAIN No answers returned
s​e​l​e​c​t​o​r​1​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z DoH NA, DoH servers unreachable No answers returned
s​e​l​e​c​t​o​r​2​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z traditional Query returned NXDOMAIN No answers returned
s​e​l​e​c​t​o​r​2​.​_​d​o​m​a​i​n​k​e​y​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z DoH NA, DoH servers unreachable No answers returned
g​o​o​g​l​e​.​_​d​o​m​a​i​n​k​e​y​.​p​a​u​l​.​i​n​f​o traditional Query returned 1 txt records v​=​D​K​I​M​1​;​ ​k​=​r​s​a​;​ ​p​=​1​2​3​4​5

DMARC

Query Name Query Method Summary Answers
_​d​m​a​r​c​.​l​o​g​a​n​-​g​a​r​z​a​.​c​o​m traditional Query returned 2 txt records v​=​D​M​A​R​C​1​;​p​=​r​e​j​e​c​t​;​p​c​t​=​1​0​0​;​ ​r​u​a​=​m​a​i​l​t​o​:​D​M​A​R​C​@​h​q​.​d​h​s​.​g​o​v​,​ ​m​a​i​l​t​o​:​r​e​p​o​r​t​s​@​d​m​a​r​c​.​c​y​b​e​r​.​d​h​s​.​g​o​v
v​=​D​M​A​R​C​1​;​p​=​r​e​j​e​c​t​;​p​c​t​=​1​0​0​;​ ​r​u​a​=​m​a​i​l​t​o​:​D​M​A​R​C​@​h​q​.​d​h​s​.​g​o​v
_​d​m​a​r​c​.​o​n​m​i​c​r​o​s​o​f​t​.​c​o​m traditional Query returned NXDOMAIN No answers returned
_​d​m​a​r​c​.​o​n​m​i​c​r​o​s​o​f​t​.​c​o​m DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​c​o​m traditional Query returned NXDOMAIN No answers returned
_​d​m​a​r​c​.​c​o​m DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z traditional Query returned NXDOMAIN No answers returned
_​d​m​a​r​c​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​o​r​g traditional Query returned NXDOMAIN No answers returned
_​d​m​a​r​c​.​o​r​g DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​p​a​u​l​.​i​n​f​o traditional Query returned 1 txt records v​=​D​M​A​R​C​1​;​ ​p​=​r​e​j​e​c​t​;​ ​r​u​a​=​m​a​i​l​t​o​:​r​e​p​o​r​t​s​@​d​m​a​r​c​.​c​y​b​e​r​.​d​h​s​.​g​o​v​;​ ​p​c​t​=​1​0​0​;​ ​r​u​f​=​m​a​i​l​t​o​:​r​e​p​o​r​t​s​@​d​m​a​r​c​.​c​y​b​e​r​.​d​h​s​.​g​o​v
_​d​m​a​r​c​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z​.​t​e​s​t​-​g​o​o​g​l​e​-​a​.​c​o​m traditional Query returned 0 txt records No answers returned
_​d​m​a​r​c​.​t​a​y​l​o​r​-​s​n​o​w​.​b​i​z​.​t​e​s​t​-​g​o​o​g​l​e​-​a​.​c​o​m DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​o​r​g​.​t​e​s​t​-​g​o​o​g​l​e​-​a​.​c​o​m traditional Query returned 0 txt records No answers returned
_​d​m​a​r​c​.​o​r​g​.​t​e​s​t​-​g​o​o​g​l​e​-​a​.​c​o​m DoH NA, DoH servers unreachable No answers returned
_​d​m​a​r​c​.​t​e​s​t​-​g​o​o​g​l​e​-​a​.​c​o​m traditional Query returned 1 txt records v​=​D​M​A​R​C​1​;​ ​p​=​r​e​j​e​c​t​;​ ​r​u​a​=​m​a​i​l​t​o​:​m​a​i​l​a​u​t​h​-​r​e​p​o​r​t​s​@​g​o​o​g​l​e​.​c​o​m
_​d​m​a​r​c​.​c​o​m traditional Query returned NXDOMAIN No answers returned
_​d​m​a​r​c​.​c​o​m DoH NA, DoH servers unreachable No answers returned