Every security awareness program eventually has the same conversation:

"We sent the campaign yesterday. The dashboard says it went out. But

nobody clicked, and three people on Slack are asking why they didn't get

the test email."

Then somebody opens their spam folder and finds the simulated phish

sitting next to a Nigerian prince. The campaign isn't broken. The

deliverability is.

I've spent enough time debugging this for HailBytes SAT customers that I

can write the post-mortem from memory. Here it is.

The core problem

A phishing simulation is, by construction, an email designed to look

suspicious.…