Set up Inline DLP for Gmail

Step 1: Create a Gmail Instance in Skyhigh CASB 

1. Log in to Skyhigh CASB.
2. Go to Settings > Service Management.
   
3. Click Add Service Instance.
   
4. Select Gmail, enter a name for this new instance, and click Done.
5. To configure the instance, click Configure.
   
6. Activate the Data Loss Prevention (DLP) to ensure compliance checkbox, and under Email DLP Mode, select Inline Only.
   
7. Review the prerequisites, and activate I have reviewed all prerequisites checkbox.
   
8. Make sure the following are complete:
   • Domains. Populate with all public domains configured with the Google Suite tenant.
   • Take a note of the Skyhigh CASB Email Service Domain. You will need this later.
   • Select the checkbox confirming you've configured Gmail, as you need this in the next step. 
     
9. Review the settings, and click Done.
   

Step 2: Configure Gmail to Route Email to Skyhigh CASB 

1. Log in to Google Suite admin (https://admin.google.com), and go to Apps.
   
2. Select Google Workspace.
   
3. Select Gmail. 
   
4. Scroll down and select Hosts.
   
5. On the Hosts tab, click ADD ROUTE.
   
6. Enter the following details for the new mail route:
   • Enter a name. 
   • Enter the single host as captured earlier (Skyhigh CASB Email Service Domain).
   • Enter port 25.
   • Disable MX lookup and Require secure transport TLS.

7. Select the Settings for Gmail tab, and click Compliance.
   

8. Under the Content compliance section, click CONFIGURE .
   

9. Configure the rule as follows:
   • Enter a name for the rule (for example, Skyhigh CASB DLP).
   • Select Outbound.
   • Select Internal - sending to enable scanning for internal emails, sent from GMail to the Skyhigh CASB PoP. Click ADD.
     
   • Advanced content match. Full headers, Not contains text, "X-SHN-DLP-SCAN: success".
     
   • Change Route and select the host created earlier.
     
   • More options:
     • Select Users and Groups as the account type to affect.
     • IMPORTANT: If this is a production environment, apply this rule to a test user/group so all mailboxes are not impacted.
       

• To enable DLP for specific users or mail groups, configure the following:
  • Under Envelope filter, select Only affect specific envelope senders.
    
  • Select Group membership (only sent mail) to enable DLP for mail groups.
  • Click Select groups, and select the required mail groups.
    
  • Click Save.
    

10. Under the Settings for Gmail, select Routing.
    
11. Find the SMTP relay service and click CONFIGURE.
    
12. Configure the SMTP relay service rule as follows:
    • Enter a name for the rule (for example,  Skyhigh CASB DLP).
    • Allowed Senders. Set to Only addresses in my domains.
    • Authentication. Select Only accept mail from the specified IP addresses and enter the following based on the environment. 
    • You must add each IP address to the list as in the following Gmail rule:

Step 3: Configure a DLP Rule 

1. In Skyhigh CASB, go to Policy> DLP Policies, and add a new rule applied to Gmail. An example is shown below.
   • Type: API
   • Active: ON
   • Services: Gmail instance you created earlier
   • Action: Block email
     
     
     

Step 4: Test the Configuration

1. Log in to Gmail using a user account, and send an email with content that will trigger the configured DLP rule.
   
2. Confirm that the email is NOT received by the recipient.
3. Confirm that a policy incident is created and the action blocked the email.