domainwidedelegation.comStart free

Use cases → Email operations

Manage email blacklists centrally across multiple inboxes

A delegated service account maintains a domain-wide blacklist, updating user-level Gmail filters to block or quarantine unwanted senders automatically.

Who it is forIT administrators and security teams responsible for email hygiene across all users.
APIsGmail API, Admin SDK
Typical scopesgmail.settings.basic, admin.directory.user.readonly

The problem

Unwanted or malicious senders get through global spam checks, and users create inconsistent personal filters. Maintaining a central blacklist is tedious, and relying on users to update their own settings leaves gaps, especially as new accounts are created or ownership shifts.

How it works

  1. A delegated service account reads the canonical blacklist from a central source.
  2. It enumerates all active users via the Admin SDK.
  3. For each user, it uses gmail.settings.basic to create or update filters blocking blacklisted senders.
  4. The job runs on schedule or on-demand, ensuring new users are covered and changes propagate.

What changes

Blacklist updates reach every mailbox quickly, regardless of user discipline, and new accounts are protected from day one.

The trap in this one. When updating Gmail filters via the API, the service account must handle filter ID stability: modifying an existing filter in place is not supported, so the job must delete and recreate filters. This can trigger brief windows where no filter is present, and if a user is actively editing their filters at the same time, changes can silently overwrite each other — Gmail does not warn of concurrent modification, so deletions and recreations can race, causing missing or duplicated filters.

Questions people ask

Does this block mail at the server before delivery?

No, user-level filters only act after delivery, so mail may still appear in Spam or Trash. For true delivery blocking, use inbound gateway or routing rules at the admin level.

Can users change or remove these filters?

Yes, unless additional controls are enforced. Users can edit or delete filters, so the job should reapply the blacklist regularly to catch manual changes.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Bulk update user email signatures with a service account

Set consistent Gmail signatures across many users using domain-wide delegation, while handling update limits and propagation quirks.

Automate onboarding welcome emails via service account

Send onboarding emails as new users are created, directly from a real mailbox, without human intervention or missed recipients.

Send onboarding welcome emails as a delegated service

Automate welcome emails for new users by sending from a delegated account, ensuring consistency and timely delivery for every new joiner.