domainwidedelegation.comStart free

Use cases → Email operations

Send phishing simulation emails via delegated service account

Deliver controlled phishing tests by sending campaign emails as end users using domain-wide delegation and the Gmail API.

Who it is forSecurity teams running phishing simulation campaigns across Workspace tenants.
APIsGmail API
Typical scopesgmail.send

The problem

Phishing testing tools often require the ability to send emails as users, but manual methods do not scale and can trigger security events. Delegation allows automation, but requires careful handling to avoid false positives or user disruption.

How it works

  1. Prepare a list of target accounts and craft individualised simulation messages.
  2. Use a delegated service account with the gmail.send scope to impersonate each user.
  3. Send emails using the Gmail API's 'send as' feature, matching the envelope to the real sender.
  4. Log message IDs and delivery status for tracking who received the simulation.
  5. Monitor for delivery failures or unexpected bounces in real time.

What changes

Phishing simulations are delivered at scale with auditability, and users experience realistic test conditions.

The trap in this one. When sending as a user with a delegated service account, Gmail's internal spam filters are still applied. If the simulation content is too close to known phishing patterns, Gmail may silently junk or quarantine the message even though the API returns success. This leads to incomplete coverage, as some users never see the simulation and reporting is skewed unless you explicitly check the recipient's mailbox for actual delivery.

Questions people ask

Does this require end-user consent?

No, domain-wide delegation allows sending as users without individual consent, but it must be explicitly granted by an admin.

Will these messages appear in the Sent folder?

Yes, messages sent via the Gmail API as the user will appear in their Sent folder by default unless you specify otherwise.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Draft replies automatically in a shared inbox

A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.

Triage and route inbound mail across a domain

Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.

Send mail as a shared alias from automation

Deliver notifications, confirmations and campaign replies from a branded address like support@ or updates@ without a human in the loop.