Engage - SMTP and URL Guide

This article contains information on configuring domains and SMTP addresses for Engage phishing simulations, including required allowlisting steps to ensure successful email delivery and proper functioning of phishing campaigns.

Also see: Managing Phishing Templates

Introduction

When you are configuring your Engage environment, certain domains and SMTP addresses must be allowed, to ensure that your end users successfully receive phishing simulation Emails. 

This is because phishing simulation emails are sent from specific SMTP addresses and contain specific domain URLs in the Email content.
All of the domains and SMTP addresses listed below are available for you to choose from when configuring phishing templates for use in your phishing campaigns.

Trusted Sites Configuration

Click here to learn how to configure a Safe Senders list for Engage emails, ensuring that images display properly.

Step 1: Add Mimecast Sending Addresses to the Safe Senders List using GPO

1. Create a Safe Senders List File:
2. Create a .txt file containing the sending address(es) you would like to add as Safe Senders (in this case, this would be whichever address you are sending the Training Modules from)

@domain.com
[e-mail]

3. If you wish to do the same for Phishing Campaigns, ensure that you add the sending addresses listed in the article below to the text file as well:

https://mimecastsupport.zendesk.com/hc/en-us/articles/34000445739027-Engage-SMTP-and-URL-Guide#h_01JC0JYXB6TMDBBYWBEB1168E7

4. Save this file in a shared network location accessible to all users.

Configure the GPO

1. Open the Group Policy Management Console (GPMC).
2. Navigate to:

• • User Configuration | Administrative Templates | Microsoft Outlook | Outlook Options | Preferences | Junk Email
  • Enable the policy Specify path to Safe Senders list.
  • Enter the UNC path to the .txt file (e.g.,\\ServerName\Share\SafeSenders.txt).

3. Deploy the GPO:

• • Link the GPO to the appropriate Organizational Unit (OU) containing the users.
  • Run gpupdate /force on client machines to apply the policy.

Using Intune

Prepare the Safe Senders List:

1. Create the same .txt file as above.
2. Create a Configuration Profile:

• • Log in to the Microsoft Endpoint Manager Admin Center.
  • Go to Devices | Configuration profiles | Create profile.
  • Select Windows 10 and later as the platform and Templates | Administrative Templates.

3. Configure the Policy:

• • Search for "Specify path to Safe Senders list".
  • Enable the policy and provide the path to the .txt file.
  • Assign the Profile. (Assign the configuration profile to the appropriate user or device groups.)

Step 2: Enable Automatic Image Downloads for Safe Senders using GPO

Configure the GPO

1. Open the Group Policy Management Console (GPMC).
2. Navigate to:

• • User Configuration | Administrative Templates | Microsoft Outlook | Outlook Options | Mail Format | HTML Options
  • Enable the policy Automatic Picture Download Settings.
  • Configure the setting to Permit downloads in email messages from Safe Senders and Safe Recipients.

3. Deploy the GPO:

• • Link the GPO to the appropriate OU and apply it.

Using Intune

1. Create a Configuration Profile:

• • Log in to the Microsoft Endpoint Manager Admin Center.
  • Go to Devices | Configuration profiles | Create profile.
  • Select Windows 10 and later as the platform and Templates | Administrative Templates.

2. Configure the Policy:

• • Search for Automatic Picture Download Settings.
  • Enable the policy and configure it to Permit downloads in email messages from Safe Senders and Safe Recipients.
  • Assign the Profile. (Assign the configuration profile to the appropriate user or device groups.)

Step 3: Verify the Configuration

On a Client Machine:

1. Open Outlook and navigate to:

• • Home | Junk | Junk Email Options | Safe Senders
  • Confirm that Mimecast's sending addresses are listed.

2. Test Automatic Image Downloads:

• • Send a test email from a Mimecast address and verify that images are downloaded automatically without user intervention.

Domains

See the Listing Managed URLs section of Managed URLs for steps on how to specify the URLs and / or domains to be added to the managed URLs list.

The same configuration for Domains needs to be carried out by all Engage customers, regardless of your license type, the API security solutions you're using, or whether Secure Email Gateway has been set up.

You need to add the following to your Managed URLs list:

• https://*.therelayservice.com/ is the Engage phishing landing page, and the domain is owned by Mimecast.
• https://s3.amazonaws.com is needed to enable automatic downloads of inserted images and [videoposter] in your Engage Email Notifications.

The following domains, used in Engage Phishing Campaigns, also needed to be allowlisted. This is to ensure phishing simulations pass seamlessly through your email provider and are not blocked. 
Domains that our phishing platform sends from are:

KB Domains	In Platform Domains
account-renewals.com	account-renewals.com
accountsecuritynotices.com	accountsecuritynotices.com
benefits-bulletin.com	benefits-bulletin.com
ceo-update.com	ceo-update.com
company-updates.com	company-updates.com
corp-accounts.com	corp-accounts.com
corp-news.com	corp-news.com
corp-update.com	corp-update.com
corporate-payroll.com	corporate-payroll.com
corporate-updates.com	corporate-updates.com
cy-se.com	cy-se.com
employee-news.com	employee-news.com
info-needed.com	info-needed.com
instant-promos.com	instant-promos.com
our-account.com	payroll-news.com
payroll-news.com	payroll-updates.com
payroll-updates.com	relaysvc.com
relaysvc.com	salary-info.com
salary-info.com	secure-corporate-communications.com
secure-corporate-communications.com	secure-corporate-news.com
secure-corporate-news.com	secure-corporate-updates.com
secure-corporate-updates.com	secureceocommunications.com
secureceocommunications.com	securesecuritysolutions.com
securesecuritysolutions.com	security-bulletin.com
security-bulletin.com	subscriptionrenewalnotices.com
subscriptionrenewalnotices.com	subscriptionrenewalservices.com
subscriptionrenewalservices.com	sysgen-cash.com
sysgen-cash.com	sysgen-payroll.com
sysgen-payroll.com	worldwidenewsupdates.com
worldwidenewsupdates.com

SMTP Email Addresses

See Permitted Senders Policy - Configuration on how to set up Permitted Senders policies, to ensure the successful delivery of inbound messages from trusted sources, and Policy Basics for more information on configuring policies.

You need to ensure the following email addresses are permitted, as they are used for Engage Phishing Campaigns. Emails are sent from these envelope addresses as the phishing domain.

• [e-mail]
• [e-mail]
• [e-mail] ‐ FOR TEST SYSTEM ONLY

The following  SMTP addresses also need to be permitted, as these are used for Engage Phishing Campaign Simulations:

This list of values / sending addresses is the same for all customers.
It’s up to you to choose which of the sending addresses to use from those available to you, which will then need to be allowlisted.

Template Name	SMTP Address	Template Location
Sign-In Notification	[e-mail]	System Template
OneDrive	[e-mail]	System Template
Free Promotions	[e-mail]	System Template
Shipping	[e-mail]	System Template
Dropbox Sharing	[e-mail]	System Template
Amazon Shipping	[e-mail]	System Template
File Sharing	[e-mail]	System Template
Tracking Package	[e-mail]	System Template
ALL COMMUNITY TEMPLATES HAVE THE SAME SMTP ADDRESS BY DEFAULT
Access Restricted	[e-mail]	Community template
Account Compromised	[e-mail]	Community template
Grubhub Gift Card Acceptance	[e-mail]	Community template
Microsoft Task Approval Request	[e-mail]	Community template
Signature Request	[e-mail]	Community template
Statement of Account	[e-mail]	Community template
Product Marketing	[e-mail]	Community template
Login Confirmation	[e-mail]	Community template
Docusign Contract	[e-mail]	Community template
Account Verification	[e-mail]	Community template
Incoming Fax	[e-mail]	Community template
Login Attempt	[e-mail]	Community template
Adobe Subscription	[e-mail]	Community template
Microsoft Authenticator	[e-mail]	Community template
Invalid Payment	[e-mail]	Community template
BBC Licensing	[e-mail]	Community template
Netflix Payment	[e-mail]	Community template
Payroll Department	[e-mail]	Community template
Account Expiration	[e-mail]	Community template
Account Verification	[e-mail]	Community template
Document Share	[e-mail]	Community template
FedEx Delivery	[e-mail]	Community template
Marketing Advertisement	[e-mail]	Community template
Microsoft Task Assignment	[e-mail]	Community template
Microsoft Teams Outreach	[e-mail]	Community template
Unlock Apple ID	[e-mail]	Community template
View Pay Slip	[e-mail]	Community template
Access Restricted	[e-mail]	Community template
Account Compromised	[e-mail]	Community template
Teams Project Outreach	[e-mail]	Community template
OneDrive Invoice	[e-mail]	Community template
Pending Payment	[e-mail]	Community template
Deposit Confirmation	[e-mail]	Community template
Signed Contract	[e-mail]	Community template
Send Data	[e-mail]	Community template
Login Attempt 3	[e-mail]	Community template
Microsoft Teams	[e-mail]	Community template
Microsoft Planner	[e-mail]	Community template
Payment Processed	[e-mail]	Community template
Capital One	[e-mail]	Community template
401k Information	[e-mail]	Community template
Maritime London Payment	[e-mail]	Community template
OpenAI Password Reset	[e-mail]	Community template
Auto Enrolment	[e-mail]	Community template