domainwidedelegation.comStart free

Use cases → Email operations

Manage phishing simulation campaigns across Workspace mailboxes

Coordinate, send, and track simulated phishing emails across the domain using delegated access for accurate reporting and incident response.

Who it is forSecurity teams running phishing awareness exercises at scale.
APIsGmail API, Admin SDK
Typical scopesgmail.send, gmail.readonly, admin.directory.user

The problem

Manual phishing tests are slow, error-prone, and hard to measure. Realistic results require campaigns to run as if from inside the organisation, with accurate tracking of opens, clicks, and user reporting behaviour.

How it works

  1. Use a delegated service account to impersonate real user mailboxes for sending simulation emails.
  2. Track delivery, opens, and replies using Gmail API message metadata.
  3. Monitor user-reported phishing via Gmail's reporting features.
  4. Aggregate and export campaign results for compliance and training follow-up.

What changes

Campaigns run from within the domain, bypassing most external sender filters and generating reliable user behaviour data for security training.

The trap in this one. Gmail API's message send endpoint does not guarantee immediate mailbox sync across devices, so users may receive simulation emails out of intended order if multiple are sent in quick succession. This can confuse recipients and invalidate staged campaign logic—throttle sends and do not assume ordering is preserved.

Questions people ask

Can the simulation emails be sent as if from any user?

Yes, when using domain-wide delegation, the service account can impersonate any mailbox with the correct scopes, but audit logs will show the true sender as the service account.

Is it possible to track who reported the phishing simulation?

Yes, by monitoring the 'report phishing' actions via the Gmail API, you can identify which users reported each simulated message.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Standardise email signatures for all users in bulk

Set consistent signatures across the domain by updating each user's Gmail settings via a delegated service account.

Enforce encryption for sensitive email content automatically

Detect sensitive data in outbound mail and apply encryption or block sending using a delegated service account.

Send a survey to every employee by mail merge

Deliver a company-wide survey by generating individual emails to all users via a delegated service account, avoiding mass recipient limits.