domainwidedelegation.comStart free

Use cases → Email operations

Run phishing simulation campaigns by impersonating users

Test user vigilance by sending realistic phishing simulations through their actual mailboxes using a delegated service account.

Who it is forIT security teams running phishing awareness training at scale.
APIsGmail API
Typical scopesgmail.send

The problem

Sending simulations from outside addresses is often filtered or flagged, and users learn to spot them by sender. Sending as the user themselves is the only way to test real behaviour.

How it works

  1. Prepare the simulation content and recipient list.
  2. Use a delegated service account to impersonate each user and send the simulation from their mailbox.
  3. Track delivery and user interaction for reporting.
  4. Aggregate responses to measure susceptibility and training outcomes.

What changes

Simulations accurately reflect inbox experience and bypass superficial sender checks, revealing true user response rates.

The trap in this one. Gmail’s automated protections can silently delay or drop messages sent via the API on behalf of users, especially if the message resembles known phishing templates or is sent in bulk. There is no explicit error: the send call may succeed, but the message never appears in the user’s sent mail or recipient’s inbox. The only way to detect this is by reconciling sent message IDs against mailbox contents after sending.

Questions people ask

Can you avoid the silent drops by slowing down sends?

Rate limiting helps but does not eliminate the risk. Gmail’s backend anti-abuse logic also considers content, similarity, and historical patterns.

Will these messages appear in the user's Sent folder?

Only if the send is actually processed—silent drops mean nothing is recorded, so auditing must check both API responses and mailbox state.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Draft replies automatically in a shared inbox

A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.

Triage and route inbound mail across a domain

Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.

Send mail as a shared alias from automation

Deliver notifications, confirmations and campaign replies from a branded address like support@ or updates@ without a human in the loop.