domainwidedelegation.comStart free

Use cases → Email operations

Run phishing simulation campaigns via delegated accounts

Simulate phishing attacks at scale using delegated service accounts to test user awareness and email defences without third-party tools.

Who it is forSecurity and compliance teams running phishing awareness programmes across Workspace tenants.
APIsGmail API
Typical scopesgmail.send

The problem

Phishing drills are essential, but sending at scale from a single account gets flagged by Google’s internal anti-abuse systems or blocked by per-user limits. Using a delegated service account allows sending as users, but introduces operational and audit complexities.

How it works

  1. Prepare the simulated phishing email content and ensure it is clearly marked as a test internally.
  2. Enumerate target users and authenticate as a service account with domain-wide delegation.
  3. Iterate over targets, using the Gmail API to send the simulation from each user's mailbox.
  4. Log message-ids, timestamps, and recipient for each attempt for later audit and follow-up.
  5. Monitor for delivery failures or rate limiting responses from the API.

What changes

Campaigns reach inboxes as if sent by real users, bypassing bulk sender restrictions and allowing realistic testing without external apps.

The trap in this one. The Gmail API's send-as-user method can trigger Google’s internal spam heuristics if identical content is sent in rapid succession, resulting in silent drops (no error, no delivery, no log in Sent Mail). The only reliable way to detect this is by cross-checking the message-id against the recipient’s mailbox — a 200 response does not guarantee delivery or visibility.

Questions people ask

How can I avoid triggering spam detection?

Vary the content slightly per user and throttle sends to mimic human behaviour. Monitor for missing message-ids in recipient mailboxes as a sign of silent drops.

Is it possible to simulate external phishing sources?

Not directly — sending as the user places the mail in their Sent folder and lacks external headers. For outside-in simulation, you must use an external relay and accept lower deliverability.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Draft replies automatically in a shared inbox

A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.

Triage and route inbound mail across a domain

Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.

Send mail as a shared alias from automation

Deliver notifications, confirmations and campaign replies from a branded address like support@ or updates@ without a human in the loop.