Whitelisting Jericho Security in Google Workspace

Google Workspace applies spam and phishing filters that may block or alter Jericho Security simulation emails. You have two options for ensuring accurate delivery: traditional whitelisting, which involves adding Jericho’s IP ranges and sending domains to your Google Admin settings, or Direct Mail Injection, which delivers simulation emails directly to employee mailboxes without passing through Google’s filtering layer. Test the chosen method with a pilot group before relying on campaign metrics.

Tip

If your organization cannot or does not want to disable Google’s built-in security features, use Direct Mail Injection instead of traditional whitelisting. See the Direct Mail Injection guide for setup instructions.

Option 1: Traditional whitelisting

Use this approach if you prefer to configure allow rules directly in Google Workspace rather than changing how simulation emails are delivered.

Step 1: Whitelist Jericho IP ranges in spam filters

Open the Google Admin console

Sign in to admin.google.com with an administrator account.

Navigate to spam filter settings

Go to Apps > Google Workspace > Gmail > Spam, phishing, and malware.

Add approved IP ranges

Under Email allowlist, add the confirmed sending IPs or CIDRs.

For standard Jericho email delivered through Amazon SES, use 24.110.88.85 and 24.110.88.86. See the allowlisting overview for verification date, scope, and CIDR equivalents.

Save your changes.

Step 2: Add sending domains as approved senders

Open approved senders settings

In the Google Admin console, go to Apps > Google Workspace > Gmail > Spam, phishing, and malware > Spam > Manage approved senders.

Add Jericho sending domains

Use the campaign-specific domains confirmed by Jericho Support. In Spam, create or edit a rule and select the approved-sender address list for that rule; adding addresses to a list alone does not configure the rule. Keep sender authentication enabled unless your mail administrator has verified a specific exception.

Save and verify

Save your changes and send a test simulation email to confirm delivery.

Option 2: Direct Mail Injection

Direct Mail Injection inserts simulation emails directly into employee mailboxes using the Gmail API, using the Gmail API rather than normal SMTP delivery. It requires an administrator to authorize domain-wide delegation; it does not eliminate all security configuration or guarantee that every message will remain in the inbox.

See the Direct Mail Injection guide for full setup instructions.

Vendor reference

Google’s email allowlist instructions require the Gmail Settings administrator privilege. The IP allowlist applies to the whole domain, not an individual organizational unit. Changes can require propagation time; verify with a test message.