📚 Step 2 of Your Riot activation journey.
⬅️ Back to the previous step: 1️⃣ Sync your employees
To send phishing simulations to your employees, Riot needs two things: proof that your domains belong to you (for example your-company.com), and permission from your email system so that its emails are not blocked. This article guides you through both, then shows you how to check that everything works.
💡 Prerequisites:
Administrator access to Riot, and being signed in to hub.tryriot.com;
access to your email admin console (Microsoft 365 or Google Workspace) and, if you choose the DNS method, to your domain's DNS management. If you don't have this access, complete this step with your IT team.
❶ Why validate your domains?
To prove they belong to you. Riot checks the ownership of each domain so that nobody can send simulations to your employees by pretending to be you.
So that your simulations reach their destination. Without the right settings, your email system's spam filter may block Riot's emails. Your employees would not receive them, and your results would be distorted.
👍 Good to know: validate all the domains used by your employees. If some have an @subsidiary.com address and others an @group.com address, both domains must be validated.
❷ Prove the domain belongs to you
👉 Step 1: Open the Domains tab
In the left-hand column of your screen, click Settings. At the top of the page, click the Domains tab. The list of your domains appears.
👉 Step 2: Start the verification
On the row of the domain to validate, click Verify.
👉 Step 3: Choose your verification method
Two methods to choose from:
By generic email address (the simplest): select a generic address of your domain from the list, for example admin@ or it@.
By DNS: add the record shown on screen to your domain's DNS management, then come back to Riot to start the verification. This method requires access to the DNS configuration, which is usually held by your IT team.
❸ Allow Riot's emails in your email system
Riot can send its simulations in two ways. The method depends on your email system.
👉 API method (preferred)
Riot places the simulations directly in your employees' inboxes, without going through the spam filter. It is the most reliable method and the quickest to set up.
If you are offered the manual method in the orange box as above, you are using the API method
⚠️ Important: even with the API method, a few settings are still needed in your email system, especially so that simulation links are not blocked when clicked. Follow your email system's guide: it sets out exactly which steps to take depending on your sending method.
👉 Manual method (all other email systems)
If you use neither Microsoft 365 nor Google Workspace, Riot sends its simulations the standard way. You then need to add Riot to the allow list of your email system and your spam filter.
If you are offered the API method in the orange box as above, you are using the manual method
👉 The guides to follow
👉 Do you also use an email gateway or a web proxy?
If your emails go through a security tool before reaching your inbox (Barracuda, Sophos, Trend Micro, Libraesva…), or if your network filters web pages (Zscaler…), also allow Riot in that tool. Otherwise, it may block the simulations or the pages your employees click on.
All the guides: configuration guides collection
❹ Test your configuration
Once the settings are done in your email system, come back to Riot to check that the simulations arrive.
👉 Step 1: Open the test
In Settings > Domains, click Verify configuration.
👉 Step 2: Send a test email
Choose a Riot administrator from the list, then send them the test email. Then check that it has arrived in their inbox, and not in the junk folder.
💡 Prerequisite: the chosen administrator must have an email address on the domain being tested. To test your-company.com, you need an administrator with [email protected]. If the list is empty, add an administrator from Settings > Members: see Manage my Admins.
👍 Good to know: your email settings may take a few minutes to apply. If the test email doesn't arrive even though everything seems correct, wait about ten minutes and try again.
🛠️ A problem?
The test email doesn't arrive or lands in the junk folder: go through your email system's guide step by step again, then check that no gateway or web proxy is blocking Riot.
Still stuck? Contact our team via the chat in the platform.
Key takeaways
Everything happens in Settings > Domains: validate each of the domains used by your employees.
Prove ownership by generic email address or by DNS.
Allow Riot in your email system by following its guide, and in your security tools if you have any.
Always finish with a test email to an administrator of the domain.