Phin Security

Google DMI

Google DMI enables Phin to inject messages directly into Google Workspace inboxes by using Domain Wide Delegation with super admin permissions to authorize the integration's client ID and Gmail insert scope, allowing bypass of traditional firewalls and spam filters, and includes options to verify the connection and add custom email banners to DMI messages.

Overview

Google DMI allows Phin to directly inject messages into Google Workspace inboxes, bypassing traditional firewalls and spam filters that would otherwise require manual allowlisting.

Connecting Phin's Google DMI Integration

To connect the integration to your tenant, you need to allow the connection via Domain Wide Delegation. This enables the integration to use Google APIs to create messages in user inboxes directly.

Required Permissions

  • You must have a super admin role to set up Domain Wide Delegation.
  • Only a super admin can view the required pages.
  • For more information, refer to Google's documentation on connecting APIs to Google Workspace.

Grant Domain Wide Delegation

To enable Google DMI, add the integration's client ID and respective scopes to your Google Workspace Admin console:

  1. 1.Go to your Google Workspace Admin page.
  2. 2.Select Security.
  3. 3.Click Overview.
  4. 4.Select API Controls.
  5. 5.Under Domain Wide Delegation, click Manage Domain Wide Delegation.
  6. 6.Click Add New.
  7. 7.For Client ID, input 113120203488986354688.
  8. 8.For OAuth Scopes, add https://www.googleapis.com/auth/gmail.insert.
  9. 9.Click Authorize and save your changes.

Enable Phin's Google DMI Integration

After granting the required permissions:

  1. 1.Navigate to the integration page at the company level in the Phin admin portal.
  2. 2.Click the Google DMI tile.
  3. 3.Click Connect to Google.
  4. 4.After connecting, a section will appear to verify your integration. Input an email in your workspace to send a test email.
  5. 5.Once the test email is successfully sent, your integration is fully set up.

Custom Email Banner

In some configurations, an "external sender" warning banner is applied to all messages from outside your organization. DMI messages typically lack this banner since they come from within your organization via API. You can enable a custom banner via Google DMI to mimic this behavior:

  1. 1.Go to the Google DMI integration page.
  2. 2.Under Email Banner Settings, enable one or both toggles.
  3. 3.Input your banner text or HTML to be added to outgoing messages.
  4. 4.Click Save Changes.

After saving, the banner will be applied to enabled message types. You can send a test message to verify the banner's appearance.

Custom Email Domain

If Google DMI is enabled for a company, that company can receive training reminder emails from a custom domain.

  • Before adding a custom domain, ensure any third-party tools (Mimecast, INKY, Ironscales, etc.) have the domain included in their allowlist.
  • Enabling a custom domain applies to training-related emails, reminders, and welcome emails.

To enable a custom domain:

  • For a single custom domain across all companies using Google DMI (or Microsoft DMI): Go to Branding > Additional Email Customization at the partner level and set a custom domain.
  • For a unique custom domain per company: Go to Branding > Additional Email Customization at the company level and set a custom domain. If the field is disabled and says "noreply@phinsecurity.com", neither DMI integration is enabled.