Google Workspace Email Not Being Routed To Spam

[linde]

I am getting reports that users are seeing this error and spam that was once being routed into the user's spam folder is instead now going into the user's inbox with this message:

Google support says that it is because "the spam classification has been removed for the email due to because the sender IP is added in the Inbound gateway setting in your domain”; however, that is what I was instructed to complete per the instructions here: https://www.cisco.com/c/en/us/support/docs/security/cloud-email-security/214736-configuring-g-suite-gmail-with-cisco-c.html
I also completed the instructions here - https://www.cisco.com/c/en/us/support/docs/security/cloud-email-security/214736-configuring-g-suite-gmail-with-cisco-c.html#anc14 -  that state they will route email to the spam folder but I just received word that spam is still being delivered to the user's inbox and not the spam folder.  

I have confirmed that emails coming through have their subject pre-pended with [SUSPECTED SPAM] and I'm seeing the x-ipas-suspect in the header but the emails are still not being routed to spam.  

 

Any ideas?  Thanks!

[UdupiKrishna]

Did you also complete the following steps?

1. Enter the information as required provided from the information in your welcome letter:
   1. Select Enable
   2. For Gateway IPs, click Add, enter all of the IP addresses in your welcome letter, and click Save.
   3. Select Automatically detect external IP (recommended)
   4. Select Message is considered spam if the following header regexp matches and enter x-ipas-suspect for the Regexp

      • Configuration for Message Tagging is optional but recommended, as we can make use of the Spam folder in Gmail with an x-header

      • See "Send Suspect Spam to Gmail Spam Folder [Optional]" later in this document

   5. Click Save in the lower right-hand corner of your browser

This step on your Google workspace ensures the email go to SPAM folder. If this completed, yet not sent to SPAM folder, you need to work with Google support again by providing them the header values and configuration reference from workspace