Whitelist by Email Header in Google Workspace

If your organization uses Google Workspace, you can ensure delivery of Threatcop’s simulated phishing emails by whitelisting them using email headers. This is done by applying a Content Compliance rule that identifies Threatcop’s unique email header, allowing our simulation emails to reach users’ inboxes successfully.

⚠ Recommendation:

We suggest using this method only if your organization relies on a cloud-based spam filter in combination with Google Workspace.

If you are using Google Workspace alone (without an additional spam filter), we recommend whitelisting by IP address instead. Refer to our Whitelisting by IP Address in Google Workspace guide for detailed instructions.

Additionally, if you use a third-party cloud spam filter, you will need to whitelist Threatcop’s IP addresses or hostnames in that filter as well. This ensures complete and uninterrupted delivery of our simulated phishing emails.

🔎 Important Note:

This article reflects Threatcop’s latest best practices for whitelisting. However, email providers may update their filtering mechanisms over time. If you face any difficulties applying these settings, please reach out to the Threatcop Support Team for assistance.

To whitelist Threatcop by email header in Google Workspace, follow the steps below:

Step 1: Log in to your Google Admin account and click Apps -> Google Workspace -> Gmail -> Compliance

Step 2: Navigate to the Content Compliance section.

Step 3: In the Email messages to affect field, select the Inbound checkbox and the Internal - receiving check box.

Step 4: Under the Expressions tab, click the first drop-down menu.

From the first drop-down menu, select if ANY of the following match the message.

Click Add.

Step 6: Under the settings in the Add expressions that describe the content you want to search for in each message area. For more information about these settings, see the screenshot and list below:

1. From the first drop-down menu, select Advanced content match.
2. In Location field, select Full headers.
3. In the Match type field, select Contains text.
4. In the Content field, enter the header text. The default Threatcop header is "X-Threatcop". 
   

1. Click SAVE.
   

Step 7: In the If the above expressions match, do the following field, select the Bypass spam filter for this message check box under Spam and click Save.