Domain verification
Verify your organization's email domains to ensure your users are set up correctly for phishing simulations.
What is domain verification?
Domain verification confirms that an email domain belongs to your organization. CyberPilot uses this to ensure phishing simulations are only sent to users on trusted domains - not to personal email addresses or unintended recipients.
Each domain in your account is either Verified or Non-verified. This status affects what your users can do in the platform.
Note that this is a beta feature, so if you don't see the elements below, it's because it's not enabled on your account yet. If you would like to have it enabled, please contact your Customer Success Manager
Where to find it
Domain verification is managed under Settings → Account → Emails & Delivery.
How to verify a domain
- Go to Settings → Account → Emails & Delivery
- Find the domain you want to verify and click Verify
- Enter an email address on that domain - this is where the verification email will be sent
- Open the email and click the confirmation link
- The domain is now verified
If you add users with a new domain later, you can return to this section to verify it.
What happens to users with non-verified domains?
Users whose email domain is not verified:
- Cannot be assigned the Admin role - the option will be greyed out in the role selector
- Are excluded from phishing simulations - they will not receive phishing emails, and are not counted as recipients when you set up a campaign
They can still receive awareness training and surveys as normal.
Personal email addresses
Domains like Gmail, Outlook, Hotmail, and Yahoo can never be verified. Users with personal email addresses are permanently excluded from phishing simulations and cannot be assigned admin roles.
How to see which users are non-verified
In your user list, you can enable the Domain status column to see the verification status of each user. You can also filter by Verified or Non-verified to identify users that need attention.