Set Up Direct Mail Injection for Google Workspace

Direct Mail Injection lets Jericho Security insert phishing simulation emails directly into employees’ Gmail inboxes through the Gmail API. This avoids depending on normal SMTP delivery for simulations and reduces the amount of Google Workspace security bypassing required.

Prerequisites

• Google Workspace super administrator access.
• Access to Security → Access and data control → API controls → Manage Domain Wide Delegation in Google Admin.
• Jericho Security manager or administrator access.
• A Google Workspace Email Server configured in Jericho for the domain you want to test.

Caution

Use click, credential submission, report, and failure-rate metrics to assess simulation outcomes. Open tracking depends on whether the recipient’s email client loads tracking images, so an open rate alone does not establish that employees read a message.

Setup steps

Log in to Google Admin

Go to admin.google.com and sign in with a Google Workspace super administrator account.

Open Domain-Wide Delegation

Navigate to Security → Access and data control → API controls → Manage Domain Wide Delegation, then click Add new.

Add the Jericho API client

Confirm the current DMI client ID with Jericho Support before authorizing access. The client ID previously documented for DMI is 103403442276232723996; do not substitute the Triage Center client ID.

Enter the confirmed client ID and both scopes in the OAuth Scopes field, separated by a comma:

Field	Value
Client ID	DMI client ID confirmed by Jericho Support
OAuth scopes	https://www.googleapis.com/auth/gmail.insert
OAuth scopes	https://www.googleapis.com/auth/gmail.readonly

Click Authorize to save the delegation.

Open the Google Workspace Email Server in Jericho

In Jericho Security, go to Integrations and open the Google Workspace Email Server for the domain you are configuring. If the Email Server does not exist yet, create one first and associate the appropriate domain.

Set the phishing simulation delivery method

On the Email Server form, set Phishing Simulation Delivery Method to Google DMI.

This setting belongs to the Email Server/domain configuration. It is not a single global Direct Mail Injection toggle.

Save the Email Server

Save the Email Server after selecting Google DMI. In the Email Servers list, enable Active for this server. Campaign delivery uses active servers associated with the recipient’s domain; saving the delivery method alone is not enough.

Test the DMI connection

After saving, find Test your DMI Connection on the Email Server form. Enter one employee email address from the associated domain in An email address to test, then click Test Connection.

A successful test confirms that Jericho can insert simulation mail into that Google Workspace domain through the configured delegation.

Note

Authorize the client in each separate Google Workspace organization you use. Within an organization, verify each sending configuration’s domain association and test a mailbox in each domain. Adding a secondary domain does not necessarily require authorizing the same client again.

Google notes that delegation changes can take up to 24 hours and may require a second super administrator’s approval when multi-party approval is enabled. See Google’s domain-wide delegation instructions.