Good programmes are boring under the bonnet: a domain bought for training and owned forever, a sending setup that cannot hurt the real domain's reputation, and a mail gateway that lets the test through by deliberate, time-boxed exception - not by accident. This page is that setup.
Three mistakes account for most technical embarrassment in this field: sending from the real domain, letting the test get silently eaten by the spam filter, and discovering the landing page mis-records data after launch. The setup below avoids all three, in that order.
v=spf1 mx a -allBuy a look-alike of your own company domain - the kind of near-miss spelling real attackers use against you - and register it to the organisation permanently. It exists for training only. Two firm boundaries: never register a domain imitating a bank, a courier or any other company; and never let the training domain lapse, because an expired look-alike of your own domain is a gift to real attackers. Put its renewal on the same calendar as the real domain.
Send simulations only from the training domain, through the platform's sending profile, with its DNS records - SPF and, where your platform supports it, DKIM - configured for that domain, like the SPF line in the panel above. Your real domain's reputation, deliverability and DMARC reports stay completely untouched by the exercise. Keep the platform's admin console fenced - GoPhish, for example, serves its admin interface on port 3333 by default; that interface belongs behind a VPN or an IP allowlist, never published openly.
Your mail security will, correctly, try to block the simulation. Coordinate with whoever runs it: an allowlist entry scoped to the specific sending address and the approved launch window, logged, and removed when the round closes. A permanent, broad bypass is not a testing convenience - it is a hole in your real defences with your name on it. And take the compliment hidden in the block: if the filter stops your test cold, that is evidence it stops real phish too.
See the sending profile and campaign settings configured in the video, step by step.
▶️ Watch Full VideoThree reasons: a mishap damages the real domain's mail reputation and deliverability; staff can no longer trust genuine internal mail during tests; and if any part leaks, it looks like a real compromise. The training domain gives all the realism the lesson needs.
No - it is your defences working, and worth saying so to management. Allowlist narrowly for the approved window, run the round, then close the exception. The filter's behaviour is data, not defeat.
Many organisations do exactly that. Treat it like any internet-facing system: patched, with the admin console restricted to your own access route, and the sending side confined to the training domain - never a shared box that also carries real company services.