Gophish: [Question]: Which mail-platform is recommend to use for big campaigns?

[vincentcox]

During planned phishing-campaigns for testing the awareness among employees, it happens that there are more than 1000 recipients. When using consumer platforms like Zoho, you are faced with rate-limiting so you can only send batches of 50 emails/3 hours/emailaccount. This is understandable, because they have this measure for preventing actual phishingcampaings.

I was looking into Mandrill, but I wanted to check here which platforms you guys use during assessments.

[jordan-wright]

Any third-party provider will likely see these campaigns and block them quickly unless you take additional measures to be transparent about running approved phishing campaigns or work directly with the provider.

Most people will likely just run a local mail server for their fake domain and set up the appropriate email authentication standards (spf, dkim, and dmarc) to help ensure their emails are received. You can find some more information about that here.

Hope this helps! I'll give this a week or so to let other community members give their feedback before closing this one out. Thanks for getting this discussion started!

[vincentcox]

Meanwhile I discoverd this: https://github.com/tomav/docker-mailserver. This might also be interesting to quickly setup an SMTP server.

But other suggestions are still welcome!

I am curious what others have to say in this discussion.

[S0larflare]

I do mine internally using exchange, so can’t help I’m afraid. Just posting as currently there’s a huge amount of mailchimp (especially mandrill) phish and spam campaigns doing the rounds lately. I probably wouldn’t use them as a result, reasons being:

• Their response hasn’t been great so far from what I’ve seen

• If there is a response your (legitimate) campaigns could get caught in the crossfire

• I wouldn’t be surprised if mailchimp as a whole get a bit of a black mark for a while and emails sent using for them become more likely to get caught in filters

[snori74]

Using postfix on the same (Linux) server as our gophish. Have set this up with valid domains, SFF etc, so it works well. The modest volumes we're doing - and the fact that they're all for companies that have 'signed up' for it - mean that we haven't had the server IP blacklisted.

[jordan-wright]

@S0larflare is correct about third-party providers. I've had great experiences with them, but what I will encourage is that if you're going with a third-party mailing provider, transparency is _everything_. Remember- to them what you're doing looks malicious. They are well within their right to ban your account immediately and take action to protect their platform and their customers.

Instead, here are just a few things you can do to to be more transparent to help them understand that you're running authorized phishing campaigns:

• Make the WHOIS for each domain public and point the contact information to a dedicated abuse inbox (and respond to any inquiries promptly!)
• Use a dedicated IP address from the service provider. Most offer this for a higher price, but it lets you segment out your fake phishing emails from their other transactional email, protecting their infrastructure and IP reputation
• Contact the mail provider before any new campaigns are launched. How this happens will be up to the provider, but many times they will be appreciative of the heads-up in case they get any friction.
• Host a landing page at the root of the domain to explain that the server is running Gophish and provide any contact information. This will be a feature in Gophish soon (my plans are to make it optional, but on by default).

Remember, we're the good guys here. There's absolutely 0 harm in being transparent about what you're doing. Worst case, a savvy user figures out your using Gophish and reaches out- what a great outcome! Clearly they have some good investigative skills. If you decide to take the route that makes you look like an attacker, you simply can't blame anyone if they treat you like one 😄

[jordan-wright]

Going ahead and closing this one out. Thanks again for getting this discussion going @vincentcox!

[vincentcox]

Thanks all for the replies! It's great to see how you guys handle these kind of situations. 👍