> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains.md).

# Whitelisting Email Domains (Google Workspace)

Learn how to quickly and easily allowlist Herd's email domains so email simulations are delivered right to your inbox.

When Herd sends a phishing simulation, the message comes from one of Herd's verified sending domains rather than your own. If Google Workspace spam filtering isn't expecting those domains, simulations can be marked as spam instead of reaching the inbox — which skews your results. This guide shows a Google Workspace **admin** how to allowlist Herd's domains for the whole organization so simulations land in every user's inbox.

{% hint style="info" %}
Using Microsoft 365 instead? See [Whitelisting Email Domains in Microsoft 365](/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains-microsoft-365.md). Running Mimecast in front of your mail platform? See [Whitelisting Email Domains in Mimecast](/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains-mimecast.md).
{% endhint %}

## Herd sending domains

Herd sends phishing simulations from a shared pool of verified domains. Each is styled to impersonate a familiar brand or service; the generic `x7k2m.net` is used when a simulation isn't tied to a specific brand. **You only need to allowlist the domains relevant to your organization** — for example, you can skip `salesforce-customer-care.com` if your team never uses Salesforce.

| Domain                         | Impersonates                          |
| ------------------------------ | ------------------------------------- |
| `x7k2m.net`                    | Generic — no specific brand (default) |
| `okta-auth-verify.com`         | Okta                                  |
| `claude-auth-verify.com`       | Claude (Anthropic)                    |
| `anthropic-portal.com`         | Anthropic                             |
| `chatgpt-customer-care.com`    | ChatGPT (OpenAI)                      |
| `codex-support.com`            | Codex (OpenAI)                        |
| `cursor-services.com`          | Cursor                                |
| `github-status-update.com`     | GitHub                                |
| `aws-account-portal.com`       | Amazon Web Services                   |
| `amazon-account-team.com`      | Amazon                                |
| `google-status-update.com`     | Google                                |
| `slack-customer-care.com`      | Slack                                 |
| `salesforce-customer-care.com` | Salesforce                            |
| `oracle-portal.com`            | Oracle                                |
| `netsuite-account-confirm.com` | NetSuite                              |
| `calendly-support.com`         | Calendly                              |
| `zip-portal-verify.com`        | Zip                                   |
| `whatnot-customer-team.com`    | Whatnot                               |

{% hint style="info" %}
Herd adds sending domains over time, so this list grows. The current set is always shown in the Herd admin console under **Settings → Integrations → Gmail → Allow-list Herd simulation mail**, with copy buttons. The username portion of an address can vary (for example, `security@` or `no-reply@`); allowlisting the **domain** covers every address on it.
{% endhint %}

### Prerequisites

* You are a Google Workspace administrator with permission to manage Gmail settings.
* You know which Herd sending domains apply to your organization (see [Herd sending domains](#herd-sending-domains) above).

### Step 1 – Open the Admin console

1. In a browser, go to `https://admin.google.com`.
2. Sign in with your administrator account (for example, `admin@yourcompany.com` ).

### Step 2 – Go to Gmail settings

1. From the Admin console home page, click **Apps**.
2. Click **Google Workspace**.
3. Click **Gmail** to open the service-level settings.

### Step 3 – Open spam and allowlist settings

1. In the Gmail settings page, look for **Security** or **Spam, phishing and malware** (the exact section name may vary slightly).
2. Click **Spam, phishing and malware** to see advanced spam configuration options.
3. Locate the **Email allowlist**, **Approved senders**, or similarly named setting (this is where you add trusted senders or domains).

### Step 4 – Add the domain or address to the allowlist

1. In the allowlist / approved senders section, click **Edit**, **Configure**, or **Add** (the label may differ depending on your environment).
2. Enter one or more of the following:
   * A full domain, such as `x7k2m.net`, to allow all senders from that domain.
   * A specific email address, such as `it-support@okta-auth-verify.com`, to allow just that sender.
3. Review any notes or warnings in the UI so you understand how broadly the rule applies.

### Step 5 – Save and apply the policy

1. Click **Save** or **Add** to confirm the new allowlist entries.
2. If prompted, confirm that these settings should apply to your chosen organizational unit(s) (for example, the entire domain or a specific OU).
3. Note that changes can take several minutes to propagate across all user accounts.

### Verify the allowlist

1. In Herd, send a phishing simulation that includes your own mailbox.
2. Confirm it arrives in your **Inbox** (not Spam) with links intact.

### Still not arriving?

Where to look, in order:

1. **Admin console → Reporting → Email Log Search.** Search by sender (`@<sending domain>`) or Message-ID for the last 30 days. The post-delivery message details state exactly what Gmail did: delivered to Inbox, delivered to Spam, quarantined (and which quarantine), or rejected with the SMTP reply.
2. **Admin console → Apps → Google Workspace → Gmail → Manage quarantines**, if the log says quarantined.
3. The recipient's **Spam** folder.

Which control to change:

* **Email allowlist** (Gmail → Spam, phishing and malware): this is what the steps above configure. It is set per **organizational unit**; a domain allowlisted at the top level can be overridden below.
* **Spam policy → Bypass spam filters for messages from senders or domains in selected lists**: covers cases the Email allowlist alone does not.
* **Enhanced pre-delivery message scanning** delays delivery rather than blocking it; a simulation that arrives late, not never, is usually this.

Herd shows a **Delivered** status for a recipient once Google accepted the message. From that moment the message is inside your Workspace, and anything that happens next is a policy on your side. Every simulation email also carries an **`X-Campaign-ID`** header you can search for.