Docs
Documentation / Security and access

Security and access

Give each administrator the least access they need. Most of this is under Settings → Access & security and Settings → Domains & network.

Give each administrator the least access they need. Most of this is under Settings → Access & security and Settings → Domains & network.

  • Require MFA for administrators. Turn on the Two-factor authentication policy under Settings → Access & security. Each admin then sets up an authenticator app from Profile → Two-factor authentication. Once required, a sign-in with no registered factor is denied.
  • Keep the number of Company Admins small, and use separate accounts, not shared credentials. Add, edit, and remove Company Admins under Settings → Access & security → Accounts.
  • Review administrators regularly and remove access for anyone who no longer needs it. See Admin accounts below.
  • Turn on SSO (Microsoft Entra ID) if it fits your identity policy. Set the Tenant ID, Client ID, and Client secret under Settings → Access & security.
  • Once Entra SSO is verified, Phishtime stops enforcing its own MFA policy for admins. MFA becomes Entra's job. Enforce MFA or Conditional Access for admin sign-in in the Microsoft Entra admin center instead.
  • Set Event-log retention (1 to 60 months) to match your data-retention policy. It controls how long individual open, click, submission, and bounce rows are kept. Aggregated campaign results are kept separately.
  • Verify the domains your employees' addresses use, under Settings → Domains & network → Verified domains, before you target them or send from them.
  • In custom email templates and landing pages, only link to your own verified domains or the built-in tracking link. When you save one, Phishtime blocks hardcoded links to unverified domains, phone numbers, and a few other risky patterns, so a compromised or careless admin account cannot send real phishing links to your employees. See Link safety in templates and landing pages below.

Custom landing domains

By default, landing pages are served on a Phishtime host. On the Pro and Enterprise plans you can serve them from a domain you own, so the link a recipient sees is on your domain, not ours.

This takes two DNS records on the domain, each doing a different job:

  1. TXT proves you own it. Add the domain under Settings → Domains & network → Verified domains and create the TXT record shown. Verification alone already lets you send from the domain and target employees whose addresses use it.
  2. A or CNAME routes visitors to Phishtime. Once the domain is verified, a Configure DNS button appears next to it. Verification alone does not make landing links work; this second record does.

Which record you add depends on the host:

  • A subdomain (for example login.example.com): add a CNAME. The name is the left-most label (login); the value is the landing host shown in the dialog.
  • A root domain (for example example.com): add an A record. The name is @; the value is the Phishtime IP address shown in the dialog.

A root domain cannot use a CNAME. That is a DNS rule, not a Phishtime limit. Where you can choose, prefer a subdomain with a CNAME; it keeps working if our IP address changes.

The Configure DNS dialog shows both records, highlights the one for the domain you entered, and fills in the real values. Copy them from there, not from this page.

After the record is in place:

  • The HTTPS certificate is issued on the first visit. There is nothing to upload or renew.
  • DNS changes can take a few minutes to propagate.
  • The domain shows ✓ points to Phishtime infrastructure once routing is confirmed, and not pointed until then.

You then pick the domain in the campaign wizard's landing-page step. If you pick one that is not pointing yet, the wizard warns you and the campaign's links will not open for recipients. You can still save the draft and fix the DNS before you launch.

See Secure administrators and settings for the exact steps.