Set up Gmail to Forward Phishing Emails to Radiant Security

Auto-forward Gmail phishing emails to Radiant Security.

In this guide, you will configure Gmail to automatically forward suspected phishing emails to Radiant Security.

The following guide has 3 options you can choose from, depending on how your phishing reporting mailbox is set up. Choose the method that best matches your environment:

• If you currently use a Google Workspace group to receive phishing reports.

• If you currently use a dedicated phishing inbox to receive phishing reports.

• If you either have the group-based or full-account based method of receiving phishing reports.

Add the Radiant Security alerts alias to a Google Workspace group

If you use a phishing group to process phishing emails, the Radiant Security alerts alias can be added to this group in order to receive a copy of the user report. To do this:

1. Open the Google Workspace admin portal.

2. Click Directory, then Groups.

3. Find the phishing group in the list.

4. Click Add members.

5. Add the Radiant Security alias: [email protected] to the group.

Add a forwarding rule to the phishing email account

Use this method if you have a dedicated Google Workspace phishing account with its own inbox.

Note: This method requires you to have access to the phishing account inbox and settings.

1. Sign in to the phishing account and open the Gmail inbox.

2. Click the settings icon, then click See all settings.

3. Select Forwarding and POP/IMAP.

4. Use the Add a forwarding address to add the Radiant Security alias: [email protected].

5. Set up Forward a copy of incoming mail to send a copy to the added email address and click Save.

Note: If you are already forwarding a copy to another destination, you may have to add this second destination as a mail rule instead.

Add a default route with an additional recipient

This method should work for both groups and dedicated phishing users. It works by adding a Gmail default route that then adds the Radiant Security reporting email as an additional recipient of the emails sent to the phishing alias.

1. Open the Google Workspace admin portal.

2. Navigate to Apps > Google Workspace > Gmail.

3. Open the Default routing page.

4. Click Add another rule.

5. In the Specify envelope recipients to match section, enter the Email address of your phishing inbox.

1. In the If the envelope recipient matches the above, do the following section, select the Also deliver to > Add more recipients checkbox.

1. In the Envelope recipient section, click Replace recipient and enter the Radiant Security email: [email protected].

Important note: It is important to unselect the Do not deliver spam to this recipient option, as it may prevent phishing emails from being properly forwarded.

1. Under Options, select Perform this action on non-recognized and recognized addresses.

1. Click Save.