Configure SMTP for Email Delivery

Overview

Proper SMTP configuration is critical for successful phishing campaigns. This tutorial covers setup for popular email service providers including Amazon SES, SendGrid, and custom SMTP servers. You'll also learn how to configure SPF, DKIM, and DMARC records to ensure deliverability and avoid spam filters.

SMTP Basics

SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending emails. GoPhish requires SMTP credentials to deliver phishing simulation emails to your targets.

Option 1: Amazon SES Configuration

Amazon Simple Email Service (SES) is a cost-effective, scalable email service. It's ideal for high-volume campaigns and integrates seamlessly with AWS infrastructure.

Step 1: Verify Your Domain in SES

# Using AWS CLI to verify domain
aws ses verify-domain-identity --domain company.com

# Response includes verification token
{
  "VerificationToken": "abc123def456..."
}

Step 2: Add DNS Records

Add the verification records to your domain's DNS configuration:

# Domain Verification TXT Record
_amazonses.company.com TXT "abc123def456..."

# DKIM Records (3 CNAME records provided by SES)
token1._domainkey.company.com CNAME token1.dkim.amazonses.com
token2._domainkey.company.com CNAME token2.dkim.amazonses.com
token3._domainkey.company.com CNAME token3.dkim.amazonses.com

Step 3: Request Production Access

Step 4: Create SMTP Credentials

# Generate SMTP credentials in SES Console
# Navigate to: SMTP settings → Create SMTP credentials

# You'll receive:
SMTP Username: AKIAIOSFODNN7EXAMPLE
SMTP Password: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# SMTP Endpoint (varies by region)
# US East (N. Virginia):  email-smtp.us-east-1.amazonaws.com
# US West (Oregon):       email-smtp.us-west-2.amazonaws.com
# EU (Ireland):           email-smtp.eu-west-1.amazonaws.com

Step 5: Configure in GoPhish

POST /api/smtp/
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "name": "Amazon SES - Production",
  "host": "email-smtp.us-east-1.amazonaws.com:587",
  "username": "AKIAIOSFODNN7EXAMPLE",
  "password": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "from_address": "security@company.com",
  "ignore_cert_errors": false,
  "headers": [
    {
      "key": "X-SES-CONFIGURATION-SET",
      "value": "gophish-tracking"
    }
  ]
}

Option 2: SendGrid Configuration

SendGrid is a popular email delivery platform with excellent deliverability rates and detailed analytics.

Step 1: Create SendGrid Account

Step 2: Authenticate Your Domain

# SendGrid will provide DNS records to add:

# CNAME Records for DKIM
s1._domainkey.company.com CNAME s1.domainkey.u12345.wl.sendgrid.net
s2._domainkey.company.com CNAME s2.domainkey.u12345.wl.sendgrid.net

# CNAME for link branding (optional)
email.company.com CNAME u12345.wl.sendgrid.net

Step 3: Create API Key

Step 4: Configure in GoPhish

POST /api/smtp/
Authorization: Bearer YOUR_API_KEY

{
  "name": "SendGrid - Production",
  "host": "smtp.sendgrid.net:587",
  "username": "apikey",
  "password": "SG.abcdef123456789...",
  "from_address": "security@company.com",
  "ignore_cert_errors": false
}

# Note: Username is literally "apikey" - the API key goes in password field

Option 3: Custom SMTP Server

You can use your organization's existing mail server, but ensure it supports TLS and has proper authentication.

# Microsoft 365 Example
{
  "name": "Office 365 SMTP",
  "host": "smtp.office365.com:587",
  "username": "admin@company.com",
  "password": "YourPassword123",
  "from_address": "security@company.com",
  "ignore_cert_errors": false
}

DNS Configuration: SPF, DKIM, DMARC

Proper DNS authentication records are essential for email deliverability. These records prove your emails are legitimate and prevent spoofing.

SPF (Sender Policy Framework)

SPF specifies which mail servers are authorized to send email for your domain.

# SPF Record for Amazon SES
company.com TXT "v=spf1 include:amazonses.com ~all"

# SPF Record for SendGrid
company.com TXT "v=spf1 include:sendgrid.net ~all"

# SPF Record for Multiple Providers
company.com TXT "v=spf1 include:amazonses.com include:sendgrid.net ~all"

# SPF Record with your mail server
company.com TXT "v=spf1 include:amazonses.com ip4:203.0.113.0/24 ~all"

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails, verifying they haven't been modified in transit.

# DKIM records are provided by your email service provider
# Amazon SES provides 3 CNAME records
# SendGrid provides 2 CNAME records
# Add these exactly as provided by your ESP

DMARC (Domain-based Message Authentication)

DMARC tells receiving servers what to do with emails that fail SPF or DKIM checks.

# Basic DMARC Record (monitoring only)
_dmarc.company.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@company.com"

# Quarantine Policy (recommended for production)
_dmarc.company.com TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@company.com"

# Reject Policy (strictest - use after testing)
_dmarc.company.com TXT "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@company.com; ruf=mailto:forensics@company.com"

# DMARC Parameters:
# p=none       - Monitor only, don't take action
# p=quarantine - Mark as spam if authentication fails
# p=reject     - Reject emails that fail authentication
# pct=100      - Apply policy to 100% of messages
# rua          - Aggregate report email address
# ruf          - Forensic report email address

Testing SMTP Configuration

Always test your SMTP configuration before launching campaigns.

# Test SMTP from command line
openssl s_client -starttls smtp -connect email-smtp.us-east-1.amazonaws.com:587

# You should see successful TLS connection
# Then test authentication:
AUTH LOGIN
# Enter base64 encoded username
# Enter base64 encoded password

# Verify DNS records
dig TXT company.com       # Check SPF
dig TXT _dmarc.company.com # Check DMARC
dig CNAME s1._domainkey.company.com # Check DKIM

Troubleshooting Delivery Issues

Best Practices

Cost Comparison

Next Steps