domainwidedelegation.comStart free

Use cases → Email operations

Schedule and run phishing simulations using delegated Gmail API

Automate the scheduling and delivery of phishing simulation emails to users across the domain without manual coordination or risky shared access.

Who it is forSecurity teams running regular phishing awareness training campaigns.
APIsGmail API
Typical scopesgmail.send, gmail.readonly

The problem

Manual phishing tests are inconsistent and prone to leaks. Security teams want to automate delivery, avoid shared mail credentials, and ensure every user gets a realistic test without tipping off admins or IT.

How it works

  1. Maintain a list of target users and campaign templates.
  2. Impersonate each target user via domain-wide delegation.
  3. Schedule and send emails using the Gmail API as if sent by each user’s account.
  4. Log delivery status and responses for later reporting.

What changes

Phishing simulations can be reliably scheduled and delivered at scale, appearing authentic to recipients and without exposing real credentials.

The trap in this one. Gmail API’s send-as impersonation is subject to per-user sending limits, and errors are silent if you exceed the daily quota—affected messages simply vanish without a bounce or error in the API response. If you batch too many sends for a single account, some users will not get the simulated phish and you will not know unless you explicitly check sent mail folders per user.

Questions people ask

Can we use a single service account to send all simulation emails?

No—emails must be sent on behalf of each user via impersonation for realism and to avoid spam filters. This also prevents reply-to or delivery issues.

How do we confirm every simulated phish was delivered?

Query each user’s Sent mailbox after sending. Do not trust the API response alone, as quota overruns do not trigger explicit errors.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Draft replies automatically in a shared inbox

A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.

Triage and route inbound mail across a domain

Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.

Send mail as a shared alias from automation

Deliver notifications, confirmations and campaign replies from a branded address like support@ or updates@ without a human in the loop.