Whitelisting in Google Workspace

Whitelisting in Google Workspace involves creating rules in the Google Admin console to allow our emails to bypass spam filters and be trusted by your email system. This ensures that both system and phishing simulation messages reach your users’ inboxes, and that employees can access training content without disruption.

In this Article:

1. Set up an Allowlist
2. Add Spam Rule
3. Set up an Inbound Gateway
4. Test Campaign

Set up an Allowlist

1. Sign in to your Google Admin console.
2. In the Admin console, go to Menu > Apps> Google Workspace> Gmail> Spam, Phishing and Malware or navigate to https://admin.google.com/ac/apps/gmail/spam

2. Click Email allowlist and click Edit.
3. Enter our IP Addresses one-by-one, separating them with a comma and and click Save.

*Changes can take up to 24 hours to take effect. You can track updates in the Admin console audit log.

Add Spam Rule

This step ensures messages from our domains and senders bypass spam filters and warning banners.

1. In the Admin console, go to Menu > Apps> Google Workspace> Gmail> Spam, Phishing and Malware.
2. Scroll down to the Spam section.
3. Click Configure to add a new rule or Edit an existing one.

4. In the settings box, give the rule a name (e.g. Phishing Simulation).

5. Under Options to bypass filters and warning banners:

• Tick Bypass spam filters and hide warnings for messages from senders or domains in selected lists.
• Create or Edit list ( this opens a new tab ).

6. Select Add address list and enter a unique name, and select Bulk Upload Addresses.
7. Copy and paste the following and click Add.

Domains to Add

• mail.goldphish.com
• mail.emailsupport.me

Optional: Sender Mailboxes ( can also be included in the list if preferred)

• noreply@mail.goldphish.com
• noreply@mail.emailsupport.me

8. Return to the previous tab, choose Use Existing List, and select the list you created.
9. Confirm the new setting appears in the Spam settings table and is Enabled.

10. Click Save.

Set up an Inbound Gateway

Many phishing simulation templates closely resemble real-world phishing attacks. Without this step, Gmail may still display banners such as “Be careful with this message”.

1. In the Admin Console, go to Menu > Apps> Google Workspace> Gmail> Spam, Phishing and Malware.
2. Scroll to the Inbound Gateway settings and select Edit.
3. Tick Enable and configure with the following settings:

• Gateway IPs: Add our sender IP addresses.  
• Leave Reject all mail not from gateway IPs unchecked.
• Tick Require TLS for connections from the email gateways listed above.
• Tick Message is considered spam if the following header regexp matches.

*Enter a string of text that will, in all likelihood, not be contained in an actual email (e.g. uyrghskfeoafkgoeonghgh)

• Tick Disable Gmail spam evaluation on mail from this gateway; only use header value.

6. Click Save.

Test Campaign

Once all rules are in place, send a test phishing campaign to a small group (2–3 users). Check that:

• Emails land in inboxes without warnings.
• Clicks are recorded in the GoldPhish campaign dashboard.

Need help? If you have questions or run into issues, reach out to us at support@goldphish.com.