Configuring Gmail for Secure Schools Phishing Simulations

Critical configuration information to ensure the successful implementation of our Phishing Simulations

To ensure that Secure Schools Phishing Simulations are successful and safe, your organisation's email environment must be configured to recognise the emails as trusted phishing simulations.

• Gmail takes no action for Secure Schools Phishing Simulations
• Keep SPF, DKIM and DMARC controls in place
• Keep malware controls in place.

Sections:

• Email Allowlist

• Inbound Gateway
• Approved Senders List
• Image URL Proxy List

Email Allowlist

Step 3: From the Gmail settings, scroll down and click on 'Spam, Phishing and Malware'.

Inbound Gateway

Step 1: Now scroll down to Inbound Gateway and click on it to edit.

Step 2: Enable the Gateway IPs option and add the IP address from the previous step, 185.250.239.80, by clicking Add, and then Save

Step 3: Both Automatically detect external IP (recommended) and Reject all mail not from gateway IPs should not be selected:

Ensure that Require TLS for connections from the email gateways listed above is selected.

Step 4:  In 2. Message Tagging, tick the box and enter a random, long alphanumeric string. This should be unique and different from the example, as it will be used to bypass spam checking. 

Approved Senders List

Next, you'll need to create an approved senders list containing the domains used by Secure Schools' phishing simulations. 

Step 1: Scroll to the Spam section and click on Configure (or Add another rule if you have existing rules) to edit

Step 2: Add a descriptive name and leave the Options unticked

Step 3: Ensure Bypass spam filters for internal senders, Bypass spam filters for messages from senders or domains in selected lists, and Bypass spam filters and hide warnings for messages from senders or domains in selected lists are all selected, but not the last option:

Step 4: If you haven't created a list yet, you'll need to select Create or edit list on one of the above options. In the new tab, select Add Address List 

Step 5: Add the Secure Schools Domains, ensuring the Authentication required toggle is off for each domain, and click Save.

Step 6: Return to the previous tab with the Add setting pop-up open and add the domain list you created to the Bypass spam filters options and click Save

Image URL Proxy

Finally, you'll need to ensure images are displayed within the messages for accurate tracking and a more realistic experience.

Step 1: In the Settings for Gmail menu, scroll down and select End User Access

Step 2: Select the Image URL proxy allowlist

Step 3: Enter the domains below and click Save.

secure-schools-production.s3.eu-west-1.amazonaws.com/
secure-schools-production-us-east.s3.amazonaws.com/
secure-schools-production-ap-southeast.s3.ap-southeast-2.amazonaws.com/

This should complete the process and allow phishing simulations to run successfully.