Allowlist Managed SAT Emails in Google

Allowlisting SAT Phishing and Training Server IP Addresses

1. Sign in to your Google Admin Console with an Administrator Account
2. Navigate to Apps > Google Workspace > Gmail > Spam, Phishing, and Malware
3. On the left, select the appropriate Organizational Unit
4. Navigate to the Email allowlist section and enter the following IP addresses:
   • 18.205.140.116 (Phishing Server)
   • 168.245.36.66 (Training Server)
5. Click Save

Allowlisting Phishing Simulation Domains 

It's also important to add the SAT phishing domains to your allowlist to reduce the risk of your phishing campaigns being blocked by spam filters. 

You can access the full list of domains by viewing our Generic Mail Server Allowlisting Guide

1. Navigate to Apps > Google Workspace > Gmail > Spam, Phishing, and Malware
2. On the left, select the appropriate Organizational Unit
3. Scroll down to the Spam section and click Configure
   • If Spam Rules already exist, click Add Another
4. Enter a short description about the rule that could help you identify the setting easily
5. Leave these options UNCHECKED:
   • Be more aggressive when filtering spam
   • Put spam in administrative quarantine options
6. Make sure these Options to bypass filters and warning banners are CHECKED:
   • Bypass spam filters for messages from senders or domains in selected lists
     • Click on Create or edit list > Add Address List > Bulk Add Addresses
       • Copy/paste the list of SAT Phishing Domains into the Bulk Add Addresses box
         • UNCHECK the Require sender authentication option, as this bypasses SPF and DKIM authentication
           • Click "Add"
             • Provide a name for your address list
               • Click "Save"

   • Bypass spam filters and hide warnings for messages from senders or domains in selected lists

     • Click on Use existing list

       • Add the list you just created

         
         

      

7. Click "Save"

• Your changes may not take effect for up to 24 hours
• You can track changes in your Google Admin console audit log(s):
  • admin.google.com > Reporting > Audit and Investigation > Admin Log Events