Whitelisting Guide
Whitelisting tells your mail security to trust PhishGrid's simulation email so it reaches inboxes instead of being filtered, quarantined, or stripped of links. Skip it and your results are meaningless — low delivery, inflated "safe" numbers, and untested users.
This guide is the starting point: the three steps, how to pick a method, and the exact guide for your mail system.
The 3-step flow
- Get your values → open Sending Domains & IPs and note your account's current sending domains, IPs, and simulation header. These are dynamic — always start here.
- Choose your method(s) → pick what your mail stack supports (table below). Combine at least two.
- Apply it in your mail system → follow the matching guide, then verify.
Step 2 — choose your method
| Method | Use when | Strength |
|---|---|---|
| By IP address | Your gateway supports connection/IP allow rules | most reliable |
| By message header | Your account exposes a simulation header | survives domain/IP changes |
| Advanced Delivery (Microsoft 365) | You're on Microsoft 365 | Microsoft's sanctioned path (also covers URLs) |
| By sending domain | Any system with sender allow lists | good second layer |
| Disable URL/link rewriting | You use Safe Links / URL protection / click-time scanning | required to avoid bot-clicks |
| Bypass attachment sandboxing | Your simulations use attachments | only if needed |
Rule of thumb: IP + one more (header or Advanced Delivery), plus disable link rewriting so scanners don't register as clicks.
Step 3 — pick your platform guide
| Your mail system | Guide |
|---|---|
| Microsoft 365 / Defender for Office 365 | Microsoft/Office 365 Whitelisting |
| Google Workspace | Google Workspace (GSuite) Whitelisting |
| Mimecast | Mimecast Whitelisting |
| Proofpoint | Proofpoint Whitelisting |
| Barracuda | Barracuda Whitelisting |
| Cisco Secure Email (IronPort) | Cisco Secure Email (IronPort) Whitelisting |
| Fortinet (FortiGate / FortiMail) | Fortinet Whitelisting |
| Forcepoint (Websense) | Forcepoint Whitelisting |
| Symantec.cloud / MessageLabs | Symantec Whitelisting |
| McAfee / MX Logic | McAfee / MX Logic Whitelisting |
| SonicWall | SonicWall Whitelisting |
| VIPRE | VIPRE Whitelisting |
| AppRiver | AppRiver Whitelisting |
| IceWarp | IceWarp Whitelisting |
Using two gateways in a chain (e.g. a SEG in front of Microsoft 365)? Whitelist in both — the perimeter gateway and the mailbox provider.
Pre-campaign checklist
- Pulled current values from Settings → IP & Domains
- Whitelisted all sending IPs
- Whitelisted all sending domains (and awareness domain, if used)
- Applied a header / Advanced Delivery rule where available
- Disabled URL rewriting for simulation domains
- Whitelisted in every gateway in the mail path
- Informed IT / SOC of the campaign window
- Sent a 5–10 user test and confirmed inbox delivery + click tracking
Verify
Send a small test campaign before launching org-wide. Confirm emails land in the Inbox, links load, and a click records correctly in PhishGrid. If not, see Common Problems During Campaigns and Emails Not Being Received.
Tell IT and SOC first
Before every campaign, share your sending IPs/domains and the date range with your security team so simulation traffic isn't blocked or raised as an incident.