3 min read
Let training messages reach the inbox
How to allowlist Gradefort Academy simulations in Microsoft 365 and Google Workspace without weakening the rest of the filter.
A phishing simulation that never arrives does not teach anyone. Mail filters are supposed to catch messages that look like lures, so a training message needs a narrow exception.
Allow the sending domain, not the whole internet. The domain Gradefort sends from is shown on the signed-in Academy page for your company. Copy it from there. Do not invent an address, and do not turn the filter off for every external message.
In Microsoft 365, an admin adds the sending domain to the anti-spam allowed list, or creates a mail-flow rule that sets the spam confidence a step lower for that domain only. Keep the rule limited to messages from that domain. Review it once a year.
In Google Workspace, an admin adds the sending domain under spam, phishing, and malware settings as an inbound allow. Again, the domain only. Staff should still be able to report the message with Report phishing. Allowlisting is about delivery, not about hiding the report button.
Tell the team the simulations are real-looking on purpose, and that the page after a click will identify itself as training. Ask them to report the message the same way they would report a real one. That report is the behavior you are measuring.
If a simulation lands in junk, do not train people to fish every lure out of junk and click it. Fix the allowlist, then send the next one. Clicking through junk is the opposite of the habit you want.