Your team uses Basecamp. Basecamp sends emails using your employees’ names. Google freaks out because the emails come from @app.basecamp.com, not your domain.
This is Google doing its job, flagging external senders who look like internal staff. But it’s creating noise that buries legitimate project updates.
Here’s how to fix it in 5 minutes without weakening your actual security.
The core problem
Google Workspace sees a Basecamp notification with “John Smith” as the sender name, same name as your employee John Smith. But it’s coming from an external server. So Google flags it as spoofing or phishing.
This happens across all your company domains, @blitzmetrics.com, @yourcontentfactory.com, @localservicespotlight.com, multiplying the problem.
The fix is a specific rule in your Admin Console that tells Gmail “these senders are legit, stop flagging them.”
Step 1: Build your trusted sender list
Log into Google Admin Console.
Search “Spam, Phishing and Malware.”
Find Manage Address Lists.
Create a new list called Basecamp Senders.
Add these domains one by one with authentication enabled:
- app.basecamp.com
- Your company domains that trigger the alerts
Save it.
Step 2: Create the bypass rule
Go to Apps > Google Workspace > Gmail > Spam, Phishing, and Malware.
Select your org unit, pick the top-level root if you want this across all domains.
Click Configure under Spam. Name it Basecamp Global Spoof Bypass.
Check the box for “Bypass spam filters and hide warnings for messages from senders or domains in selected lists.” Link your Basecamp Senders list.
Save. Then look for the blue Save Changes banner at the top of the Admin screen and click it. People miss this step and wonder why nothing changed.
Timeline
Most changes take effect in minutes. Full propagation across complex orgs with multiple domains can take up to 24 hours.
Once live, Basecamp notifications land clean in inboxes. Your actual phishing protection stays fully intact for everything else.
The marginal cost of doing this right is near zero. Just do it.