Skip to content
Login to the app
  • There are no suggestions because the search field is empty.

Domain verification

Verify your organization's email domains to ensure your users are set up correctly for phishing simulations.

What is domain verification?

Domain verification confirms that an email domain belongs to your organization. CyberPilot uses this to ensure phishing simulations are only sent to users on trusted domains - not to personal email addresses or unintended recipients.

Each domain in your account has one of three statuses:

  • Verified - ownership has been confirmed
  • Pending verification - a verification email has been sent and is awaiting confirmation
  • Non-verified - the domain hasn't been verified yet

This status affects what your users can do in the platform.

Automatic verification for new accounts
When a new account is created, the email domain of the first user (the account's first admin) is automatically added and marked as Verified — no action needed from you. This applies to all new accounts, including paying customer accounts.

If you add users with additional domains later, those domains are automatically added to the list below as Non-verified — you can go ahead and verify them using the steps below whenever you're ready.

Note that this is a beta feature, so if you don't see the elements below, it's because it's not enabled on your account yet. If you would like to have it enabled, please contact your Customer Success Manager

Where to find it

Domain verification is managed under Settings → Account → Emails & Delivery.

How to verify a domain

  1. Go to Settings → Account → Emails & Delivery
  2. Find the domain you want to verify and click Verify
  3. Enter an email address on that domain - this is where the verification email will be sent
  4. Open the email and click the confirmation link
  5. The domain is now verified

If you add users with a new domain later, it's automatically added to this list as Non-verified — just come back here to verify it whenever you're ready.


What happens to users with non-verified domains?

Users whose email domain is not verified:

  • Cannot be assigned the Admin role - the option will be greyed out in the role selector
  • Are excluded from phishing simulations - they will not receive phishing emails, and are not counted as recipients when you set up a campaign

They can still receive awareness training and surveys as normal.

Personal email addresses

Domains like Gmail, Outlook, Hotmail, and Yahoo can never be verified. Users with personal email addresses are permanently excluded from phishing simulations and cannot be assigned admin roles.


How to see which users are non-verified

In your user list, you can enable the Domain status column to see the verification status of each user. You can also filter by Verified or Non-verified to identify users that need attention.