HowTo: Allow-List CyberHoot’s Domain Name and IP Addresses – Google Workspace

Complete Steps 1 to 4 so CyberHoot training assignments, quiz results and phishing simulations reach your users’ inboxes without spam warnings or admin quarantine. All settings are in the Google Admin console under Apps > Google Workspace > Gmail, and changes can take up to 24 hours to apply.

You will need CyberHoot’s current domains and IP addresses, including the Training Assignments Relay addresses, from CyberHoot’s Email IP Addresses and Hostnames. To allow-list CyberHoot in a personal Gmail account instead, see HowTo: Allow-List CyberHoot in your Own Personal Gmail Account.

Using a third-party email filter? If a service such as Proofpoint, Mimecast or Microsoft Defender filters mail before it reaches Google, allow-list CyberHoot’s domains and IP addresses there as well.

Step 1: Add CyberHoot’s domains as approved senders

This spam rule lets mail from CyberHoot’s domains bypass Gmail spam filtering and, with the recommended option, hides Gmail warning banners. Spam rules apply per organizational unit, so create it on the top-level unit unless you only want it for specific users.

1. Go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware.

2. On the left, select your top-level organizational unit.

3. Scroll to Spam and click Configure or Add another rule. Name it CyberHoot.

4. Under Options, leave both of these unchecked:

• Be more aggressive when filtering spam
• Put spam in administrative quarantine

5. Check Bypass spam filters and hide warnings for messages from senders or domains in selected lists.

6. Click Create or edit list, then Add address list. Name the list CyberHoot.

7, Click Add address and enter each CyberHoot domain (domains only, not IP addresses). You can bulk-add them as a comma-separated list.

8. Turn off the authentication requirement slider for each entry (it turns grey).

9. Save the list, select it in the rule, and click Save.

Why the two unchecked options matter: Google applies Put spam in administrative quarantine and Be more aggressive when filtering spam to the whole organizational unit, and they override other spam rules that leave them off. If either is on in any rule for the unit, CyberHoot mail can still be quarantined or filtered.

Prefer to keep Gmail warning banners? Check Bypass spam filters for messages from senders or domains in selected lists instead of the hide-warnings option in step 5. Phishing simulations may then show a warning banner.

Step 2:  Add CyberHoot’s IP addresses to the email allowlist

The email allowlist keeps mail from CyberHoot’s sending servers from being marked as spam. It accepts individual IP addresses separated by commas, or ranges in CIDR notation, and it always applies to your whole domain.

1. Go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware.

2. On the left, select your top-level organizational unit.

3. Scroll to Email allowlist (or type email allowlist in the search field) and click Edit.

4. Enter every CyberHoot IP address from the IP address list, including the Training Assignments Relay addresses, separated by commas.

5. Click Save.

Missing the Training Assignments Relay addresses is the most common cause of training emails and quiz results being filtered. Phishing simulations and training assignments are sent from different servers, so both sets are required.

Note: If an IP address is also listed as an Inbound gateway IP (Step 3), Google ignores its email allowlist entry. Keep the IPs in both places anyway: the allowlist covers you if the gateway is later removed.

 

Step 3: Add CyberHoot’s IP addresses as an inbound gateway

This step stops Gmail’s own spam evaluation on CyberHoot mail and prevents warning banners such as This message seems dangerous on phishing simulations. Google designed this setting for mail servers that process your mail before Gmail, so treat it as a workaround that CyberHoot has tested, not a Google-documented allow-list method.

This message seems dangerous

Be careful with this message

We have found that this process exempts CyberHoot simulated phishing emails from the Gmail banner warnings. However, this is not documented by Google as an allow-list recommendation.

1. Go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware and select your top-level organizational unit.
2. Scroll to Inbound gateway and click Edit.
3. Under Gateway IPs, click Add and enter each CyberHoot IP address from the IP address list, including the Training Assignments Relay addresses.
4. Leave Automatically detect external IP unchecked.
5. Leave Reject all mail not from gateway IPs unchecked. If this is checked, all other inbound email to your organization will be rejected.
6. Check Require TLS for connections from the email gateways listed above.
7. Under Message tagging, check Message is considered spam if the following header regexp matches, enter a random string that will never appear in a real header (for example kzndsfgklinjvsdnfioasmnfroipdsmfs), and select Message is spam if regexp matches.
8. Check Disable Gmail spam evaluation on mail from this gateway; only use header value.
9. Click Save.

If you already have an inbound gateway (for example, a third-party filter your MX records point to), skip this step. Changing an existing gateway affects all inbound mail. Allow-list CyberHoot in that filter instead, and rely on Step 1 to hide Gmail warning banners.

Step 4: Check Safety settings that can quarantine CyberHoot mail

Gmail’s Safety settings run separately from spam settings, and Google states that allowlists do not override a Quarantine action. If any Safety protection is set to Quarantine, Steps 1 to 3 will not stop it from catching CyberHoot mail.

1. Go to Apps > Google Workspace > Gmail > Safety.
2. Select the organizational unit your CyberHoot users belong to.
3. Review each protection in these sections and note any set to Quarantine:
   • Attachments
   • Spoofing and authentication, especially Protect against spoofing of employee names and Protect against domain spoofing based on similar domain names
4. If a protection set to Quarantine is catching CyberHoot mail (confirm with Email Log Search below), change its action to Keep email in inbox and show warning for the affected organizational unit. The hide-warnings spam rule from Step 1 removes the warning banner from CyberHoot mail. Other mail caught by that protection will also reach the inbox, with a warning instead of quarantine. Do not choose Move email to spam, which sends mail to the Spam folder instead of the inbox.

You can apply a different action to a smaller organizational unit, so you can keep Quarantine for most of your organization if needed.

Display names to watch: CyberHoot emails use your company name as the sender display name. If a user or group in your directory has that same name, Protect against spoofing of employee names can flag CyberHoot mail.

Troubleshooting: CyberHoot mail is still quarantined or filtered

Email Log Search tells you exactly which setting acted on a message, so start there before changing anything.

1. In the Admin console, open Reporting > Email Log Search and search for the affected message by recipient, sender or Message ID.
2. Click the message subject, then click the recipient’s address under Recipient details.
3. Review the delivery steps, which show whether the message was quarantined. If a content compliance or other compliance rule caused it, Matched rules names that rule. A quarantine with no matched rule points to a spam rule (Step 1) or a Safety protection (Step 4).

If non-CyberHoot mail is also landing in quarantine, the cause is likely a broad setting, such as a content compliance rule, Put spam in administrative quarantine in a spam rule (Step 1) or a Safety protection set to Quarantine (Step 4).

Still stuck? Contact CyberHoot Support with the Email Log Search result and the full headers from Show original on the affected message.

---

Sources

Google Workspace Admin Help, last updated October 9, 2026:

• Add custom spam filters to Gmail
• Add IP addresses to allowlists in Gmail
• Set up an inbound mail gateway
• Advanced phishing and malware protection
• Understand Email Log Search results