Open dashboard →

Sending

Sending profiles define how simulation emails are delivered. Configure Gmail, Microsoft 365, or local Mailpit, then send a test before your first campaign.

Mailpit (local development)

Catch all outbound test mail locally without delivering to the internet. Ideal for dev and dry runs.

Phish fieldWhat to enter
SMTP host:portlocalhost:1025
Username / PasswordLeave blank
From emailAny address (e.g. it@example.com)
Ignore TLS errorsCheck this for local Mailpit
  1. Step 1. Install and run Mailpit (mailpit.axllent.org). Default SMTP listens on port 1025.
  2. Step 2. Open the web UI at http://localhost:8025 to read captured messages.
  3. Step 3. Save the Mailpit preset in Phish, send a test, then confirm the message appears in Mailpit.
  • • No credentials required. Messages never leave your machine.

Troubleshooting

Connection refused on localhost:1025
Start Mailpit first. On macOS: brew install mailpit && mailpit

Gmail SMTP

Personal Gmail and most Google Workspace mailboxes send through smtp.gmail.com on port 587 with STARTTLS. You cannot use your normal Gmail password — Google requires a 16-character App Password after 2-Step Verification is enabled.

Phish fieldWhat to enter
SMTP host:portsmtp.gmail.com:587
UsernameYour full Gmail address (you@gmail.com)
Password16-character Google App Password (not your login password)
From emailSame Gmail address (or an alias you’re allowed to send as)
Ignore TLS errorsLeave unchecked
  1. Step 1. Sign in at myaccount.google.com and open Security.
  2. Step 2. Turn on 2-Step Verification if it is not already enabled.
  3. Step 3. Open App passwords (myaccount.google.com/apppasswords). You may need to sign in again.
  4. Step 4. Create a new app password: App = Mail, Device = Other, name it “PandaONE Phish”.
  5. Step 5. Copy the 16-character code Google shows once. Paste it into Phish without spaces (abcd efgh ijkl mnop → abcdefghijklmnop).
  6. Step 6. In Phish → Sending, choose the Gmail preset, paste your address and app password, save, then Send test.
  • • Google removed “Less secure app access” in 2024–2025. App Passwords (with 2-Step Verification) are the supported password-based SMTP path for personal Gmail.
  • • Google Workspace admins can disable app passwords. If App passwords is missing, ask your admin or use Mailpit for local testing.
  • • Sending limits: roughly 500 messages/day for personal Gmail; Workspace limits vary by plan.

Troubleshooting

535 Username and Password not accepted
Regenerate the App Password. Use the full @gmail.com address as username and the 16-character code with spaces removed.
534 Application-specific password required
2-Step Verification is on but you used your normal password. Create an App Password instead.
App passwords option is missing
Enable 2-Step Verification first. Workspace accounts may need an admin to allow app passwords.

Microsoft 365 / Outlook

Exchange Online client submission uses smtp.office365.com on port 587 with STARTTLS (TLS 1.2+). Authenticate with the mailbox’s full email address and password. SMTP AUTH must be enabled for that mailbox — it is off by default on many tenants.

Phish fieldWhat to enter
SMTP host:portsmtp.office365.com:587
UsernameFull mailbox email (you@company.com)
PasswordMailbox password, or an app password if MFA blocks basic auth
From emailSame mailbox address (must match authenticated sender)
Ignore TLS errorsLeave unchecked
  1. Step 1. Confirm your mailbox can send via SMTP AUTH. In Microsoft 365 admin: Users → select mailbox → Mail → Manage email apps → ensure Authenticated SMTP is checked.
  2. Step 2. If you use MFA, create an app password in Microsoft account security (or ask your admin for SMTP AUTH / modern auth exceptions).
  3. Step 3. In Phish → Sending, choose the Microsoft 365 preset.
  4. Step 4. Set Username and From email to the same mailbox address. Enter the mailbox or app password.
  5. Step 5. Save the profile, then Send test to your own inbox before launching a campaign.
  • • Use smtp.office365.com — not outlook.office365.com and not your MX record (mail.protection.outlook.com). Those are different services.
  • • Port 587 with STARTTLS is recommended. Port 465 is not supported for Microsoft 365 client submission.
  • • Limits: about 30 messages/minute and 10,000 recipients/day per mailbox.
  • • Microsoft is deprecating basic auth for SMTP in favor of OAuth. If password auth fails, your tenant may require OAuth or connector relay — contact your Exchange admin.

Troubleshooting

535 / authentication failed
Enable Authenticated SMTP on the mailbox in Microsoft 365 admin. Verify username is the full email address.
SMTP AUTH disabled for tenant
An admin must enable SMTP AUTH org-wide or per mailbox: Set-CASMailbox -Identity user@domain.com -SmtpClientAuthenticationDisabled $false
Works in Outlook but not in Phish
Outlook uses Modern Auth (OAuth), not SMTP AUTH. Phish uses SMTP submission — the mailbox must allow Authenticated SMTP separately.

Example API payload

POST /api/v1/smtp
{
  "name": "Gmail",
  "host": "smtp.gmail.com:587",
  "username": "you@gmail.com",
  "password": "your-16-char-app-password",
  "from_name": "IT Helpdesk",
  "from_email": "you@gmail.com",
  "ignore_tls": false
}

API reference

List sending profiles

GET/api/v1/smtp

Returns configured SMTP / sending profiles for your org.

Headers

NameTypeDescription
X-API-KeyrequiredstringOrg API key

Responses

[{ "id": "…", "name": "Corporate", "from_email": "security@example.com" }]

Example

terminal
curl -s -X GET \
  -H "X-API-Key: YOUR_KEY" \
  https://app-fish.pandaone.dev/api/v1/smtp

Create sending profile

POST/api/v1/smtp

Creates or updates a sending profile used by campaigns.

Headers

NameTypeDescription
X-API-KeyrequiredstringOrg API key

Request body

NameTypeDescription
namerequiredstringProfile name
hostrequiredstringSMTP host:port
from_emailrequiredstringFrom email
from_namestringDisplay name
ignore_tlsbooleanSkip TLS verification (dev only)

Responses

{ "id": "…", "name": "Corporate" }

Example

terminal
curl -s -X POST \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  https://app-fish.pandaone.dev/api/v1/smtp
  -d ''{"name":"Corporate","host":"smtp.example.com:587","from_email":"security@example.com","from_name":"IT Security"}''

Send test email

POST/api/v1/smtp/{id}/test

Sends a test message through a sending profile.

Headers

NameTypeDescription
X-API-KeyrequiredstringOrg API key

Path parameters

NameTypeDescription
idrequiredstringSMTP profile ID

Request body

NameTypeDescription
torequiredstringRecipient email

Responses

{ "ok": true }

Example

terminal
curl -s -X POST \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  https://app-fish.pandaone.dev/api/v1/smtp/SMTP_ID/test
  -d ''{"to":"you@example.com"}''