1. Purpose

This document explains the email delivery flow for phishing simulation emails sent to users hosted on Zoho Mail, the different points at which an email can be blocked or delayed, what needs to be whitelisted, and how to troubleshoot delivery issues.

The objective is to ensure that authorized phishing simulation emails are delivered to the intended users' inboxes reliably and with minimum delay while keeping the simulation limited to the approved sender, domain, IP and recipient scope.

Important: Whitelisting can significantly improve deliverability, but it does not guarantee instant Inbox delivery. Other security, authentication, reputation, policy and rate-limiting checks can still affect delivery.

2. What Needs to Be Whitelisted

Before starting a phishing simulation campaign, obtain the following information from the simulation platform.

A. Sending Domain

Example: securebankupdate.com

If multiple sending domains are used, all approved domains should be reviewed.

B. Sending IP Address

The actual public IP address used by the simulation platform to send the email should be identified and reviewed for allowlisting.

Example: 82.25.108.185 

The required IP is the mail-sending server IP, not the user's IP address after clicking the phishing link.

C. Simulation URLs / Tracking Domains

If the simulation contains:

• tracking links
• phishing landing pages
• redirect URLs
• image-hosting domains
• click-tracking domains

the relevant approved domains should also be reviewed with the customer's security/network team.

3. Zoho Mail - Allowed List and Trusted List

Zoho provides organization-level controls for managing email addresses, domains and IP addresses.

3.1 Allowed List

The Allowed List can be used to allow specific:

• Email addresses
• Domains
• IP addresses

Being on the Allowed List does not guarantee Inbox delivery by itself - the email is still processed per the organization's Delivery Action settings, and if there is an SPF failure with no defined action for it, allow-listed senders will still not automatically be marked "Not Spam."

4. Trusted List

Zoho also provides a Trusted List.

Trusted entities receive stronger treatment than normal allowed entries: the Trusted List completely bypasses the usual spam checks, including SPF, DKIM, and blocklist validation, for the entities added to it.

Because trusted entities can bypass important security checks, this should be used carefully.

For controlled simulations, temporary exceptions should preferably be removed after the campaign if they are no longer required.

Caution: Zoho explicitly advises against adding your own organization's domain to the Trusted List, since this can let spoofed emails using that domain bypass authentication checks and reach mailboxes directly. Zoho's admin console shows a confirmation warning before this action is allowed. For phishing-simulation whitelisting, only the simulation vendor's sender/domain/IP should be added - not the organization's own domain.

5. Detailed Zoho Whitelisting Steps

This section expands each whitelisting action into a full click-by-click procedure. Exact menu labels can shift slightly between Zoho Mail plans/interface versions - if a label has moved, the underlying setting is still under Admin Console → Security & Compliance → Spam Control or → Phishing & Malware.

Step 1 - Log in to the Zoho Admin Console

1. Go to the Zoho Mail Admin Console (mailadmin.zoho.com, or the admin console link from the Zoho Mail app switcher).
2. Sign in with an account that has Organization Administrator or Mail Administrator privileges. A non-admin user cannot edit organization-wide Allowed/Trusted/Blocked Lists.
3. Open Security & Compliance in the left-hand navigation.
4. Click Spam Control.
5. You will see tabs/sections for Allowed List, Blocked List, Trusted List, and (on paid plans) Internationalized Spam Control.

Step 2 - Whitelist the Simulation Sending Domain

1. In Allowed List, select the Domains tab.

2. Click Add.

3. Enter only the domain - e.g. securebankupdate.com - not a full email address.

   1. Correct: securebankupdate.com
   2. Incorrect: [email protected] (this belongs in the Emails tab, not the Domains tab)
   3. Save the entry and confirm it appears in the list.

4. If the vendor sends from more than one domain (common with platforms that separate a "sending domain" from a "tracking/landing domain"), add each sending domain separately.Tracking/landing domains are handled under Section 3-D and Section 13 (Proxy), not the mail Allowed List.

Step 3 - Whitelist the Simulation Sending IP Address

1. In Allowed List, select the IP Address tab.
2. Click Add.
3. Enter the base IP address provided by the vendor. From the IP Mask dropdown, select the corresponding subnet mask (or range).
4. If the vendor documents multiple sending IP ranges (many platforms rotate across a pool),  add every published range - a missing IP causes partial delivery failures .
5. Save and confirm the IP appears in the list.

Step 4 - Configure the Trusted List (only if Steps 2-4 are insufficient)

1. If, after Steps 2-4 and a test send, the simulation is still landing in Spam or Quarantine, open Trusted List.
2. Add the verified simulation sender email/domain here instead of (or in addition to) the Allowed List.
3. Acknowledge the confirmation warning Zoho shows, since Trusted List entries skip SPF/DKIM/blocklist checks entirely.
4. Save, then re-run a small test campaign to confirm the change resolved the issue.
5. Do not add the organization's own domain here (see Section 4 caution above).

Step 5 - Check the Blocked List for Conflicts

1. Open Blocked List.
2. Search for the simulation sender's email, domain, and IP.
3. A Blocked List entry always overrides an Allowed/Trusted List entry for the same sender if the simulation address is present here, delivery will fail regardless of Steps 2-5.
4. Remove or modify the conflicting block only with the customer's approval, then re-test.

Step 6 - Review Incoming Rules and Email Policies

1. Go to Mail Settings → Rules → Incoming Rules at the organization, group, and user level.
2. Look for rules that move to spam, reject, quarantine, or otherwise process messages based on sender, domain, subject keywords, or content patterns - phishing-style subject lines and links are exactly what many such rules are built to catch.
3. Also check Email Policies for receiving restrictions, attachment restrictions, or content restrictions that could apply to the simulation email.
4. Add a scoped, approved exception (e.g., limited to the simulation sender and the pilot recipient group) rather than disabling a rule org-wide.
5. For Incoming Rules to work, ensure that Organization Rules is enabled under Security & Compliance → Spam Control → Spam Processing. If it is disabled, enable it before configuring or testing the Incoming Rules.

Step 7 - Check Quarantine

1. Go to Security & Compliance → Quarantine → Incoming Quarantine.
2. Search by sender, recipient, or subject.
3. Review the quarantine reason shown (e.g., SPF failure, content pattern match, attachment type).
4. If confirmed as the authorized simulation, use the "Deliver"/"Release" option, and adjust the underlying setting (Steps 2-8) so future sends do not need manual release.

6. Zoho Blocking Methods

A phishing simulation email can be blocked or delayed through multiple mechanisms.

1. IP / Reputation Blocking

The sending IP may have poor reputation or be present on a blocklist.

Symptom: email rejected, email not received, SMTP error, delayed delivery.

Action: Check the actual sending IP and the relevant Zoho allow/block configuration.

2. Domain Blocking

The sending domain may be blocked or considered suspicious.

Symptom: Spam placement, quarantine, rejection.

Action: Review the Allowed/Trusted and Blocked Lists.

3. Sender-Level Blocking

The exact email address may be blocked.

Symptom: Other emails may work, but the specific simulation sender does not.

Action: Review sender-level Allowed/Blocked configuration.

4. Spam Filtering

Zoho's spam controls can classify the message based on various characteristics.

Symptoms: email goes to Spam, email is quarantined, delivery is delayed.

5. Phishing / Malware Filtering

Because phishing simulation emails intentionally resemble phishing attacks, security controls may identify: suspicious URLs, impersonation, suspicious content, malicious-looking attachments, spoofing behavior.

Symptoms: quarantine, warning, rejection, security banner.

6. Authentication Checks

SPF, DKIM and DMARC can affect delivery.

Symptoms: Spam, quarantine, rejection, authentication failure.

7. Incoming Rules

An organization rule may move or reject the message.

Symptoms: email never appears in Inbox, email appears in Spam/Quarantine, email is automatically deleted.

8. Email Policy Restrictions

Organization policies can restrict incoming emails or specific types of content.

Symptoms: rejection, delay, quarantine.

9. Firewall / Gateway / Proxy

The customer may have additional security infrastructure before or around Zoho.

Symptoms: connection failure, email rejected, URL blocked, landing page unavailable

7. SPF

SPF verifies whether the sending server is authorized to send email for the domain.

Symptoms of SPF problems

• Spam placement
• Quarantine
• Authentication failure
• DMARC failure
• Rejection

If the simulation platform sends using a dedicated simulation domain, the domain should have the appropriate SPF configuration.

8. DKIM

DKIM adds a cryptographic signature to the email.

Symptoms of DKIM problems

• Authentication failure
• Spam placement
• Quarantine
• DMARC failure

If supported by the simulation platform, configure DKIM correctly.

9. DMARC

DMARC works with SPF and DKIM to validate whether the email is authorized and aligned with the domain.

DMARC policies can instruct receiving systems to: monitor, quarantine, reject.

10. Display Name Spoofing / Impersonation

Zoho can identify emails where the display name appears to impersonate an internal user or executive.

Example: From: CEO Name [email protected]

The actual sender is external, but the display name matches an internal employee.

Zoho's Phishing & Malware controls can identify this behavior.

Symptoms

The user may see: impersonation warning, caution/security banner, external sender warning, sender-name mismatch warning, other anti-phishing indicators.

What to check

1. Log in to the Zoho Admin Console.
2. Navigate to Security & Compliance → Phishing & Malware.
3. Review the display-name spoofing/impersonation controls.
4. Check whether the simulation sender is being identified as an impersonation attempt.
5. Review the available exception/exclusion options.
6. If the simulation is authorized, configure a scoped exception where supported.
7. Run a test campaign.

Important

Do not disable impersonation protection globally just to make the phishing simulation look realistic.

The objective should be to create a controlled exception for the authorized simulation while keeping normal anti-impersonation protection active.

11. Mail Server / Secure Email Gateway

Zoho may not be the only email-security layer.

A typical customer environment may look like:

Possible controls include: email security gateways, firewall, DNS filtering, secure web gateways, third-party anti-spam systems, endpoint security.

What to check

Confirm that the simulation sender/domain/IP is not blocked by: firewall, email gateway, DNS security, URL filtering, attachment scanning, endpoint security.

12. Proxy Settings

Proxy or secure web gateway settings can affect the phishing simulation landing page.

The email may reach the Inbox correctly but the user may be unable to open the simulation link.

Symptoms

• email received
• link does not open
• security warning
• redirect fails
• landing page does not load

Solution

Review and, if approved, allow: simulation landing-page domain, tracking domain, redirect domain, required HTTPS URLs.

Do not disable proxy security globally.

13. Browser Plugins / Endpoint Security

Browser security extensions, antivirus and EDR can interfere with the simulation.

Possible controls: browser security, antivirus, EDR, anti-phishing extensions, web filtering, DNS protection.

Symptoms

• link blocked
• landing page blocked
• browser phishing warning
• redirect blocked
• tracking not working

Solution

Create a scoped exception for the authorized simulation where required.

Do not disable antivirus, EDR or browser security globally.

14. Malware / Attachment Filtering

Security controls can inspect attachments for malicious content.

This is especially relevant when a simulation contains: executable files, scripts, macros, suspicious archives, unusual file types.

Symptoms

• attachment removed
• email quarantined
• warning shown
• email rejected

Recommended approach

Use safe simulation content wherever possible.

If an attachment is required, confirm the approved file type and security handling with the customer.

15. "Mark as External"

Some organizations display an External label/banner for messages received from outside the organization.

How to handle it

If the customer wants to remove or customize the external label, the organization's email administrator needs to review its external-email policy.

Only modify it if the customer has explicitly approved the change.

16. External Images

Zoho may block automatic loading of external images.

Symptoms

The email reaches Inbox but: logo does not appear, tracking pixel does not load, images are hidden, user sees "External images are not displayed."

Solution

This is an individual setting and not admin setting but we can do the below steps to ensure that global rules don’t block images

• Log in to the Admin Console

  Go to admin.zoho.com and log in with Super Admin or Admin credentials.

• Navigate to Email Policies

  In the left-hand navigation panel, click Email Administration (or Services), then select Email Policies.

• Select or Create a Policy

  Click on the default organization policy (e.g., Default Policy) or create a targeted policy applied to your test group/users.

• Adjust Security & Restriction Settings

  • Under the policy configuration, go to Restrictions / Security Options.
  • Locate settings related to HTML / Remote Media Content.
  • Ensure that options like Block Remote Images or Strip External HTML Links/Media are Disabled / Turned Off.

• Apply & Save

  Ensure the policy is assigned to the target user accounts or the entire organization domain.

17. Symptoms When Whitelisting Is Not Done Properly

Issue	Possible Symptom
Sending IP not allowed	Rejection / delay / SMTP error
Domain not allowed	Spam / quarantine
Sender not allowed	Spam / quarantine
Trusted configuration missing	Additional spam/security checks
SPF failure	Authentication issue / Spam
DKIM failure	Authentication issue / Spam
DMARC failure	Quarantine / rejection
Impersonation detected	Warning / caution banner
Incoming Rule	Spam / quarantine / rejection
Email Policy	Rejection / restriction
Rate limiting	Partial delivery / delay
Firewall block	Connection failure
Email Gateway block	Quarantine / rejection
Proxy block	Link does not open
EDR/AV block	Link or attachment blocked
Browser plugin	Phishing warning / page blocked
External images disabled	Images not displayed
External sender policy	External banner/label

18. Recommended Customer-Side Checklist

Sender Configuration

☐  Simulation sender email identified

☐  Sending domain identified

☐  Sending IP identified

☐  Tracking domain identified

☐  Landing page domain identified

Zoho Configuration

☐  Sender added to Allowed List

☐  Sending domain added to Allowed List

☐  Sending IP added to Allowed List

☐  Trusted List reviewed

☐  Blocked List reviewed

☐  Incoming Rules reviewed

☐  Email Policies reviewed

☐  Quarantine reviewed

☐  Phishing & Malware settings reviewed

☐  Display-name impersonation reviewed

Network

☐  Firewall checked

☐  Secure Email Gateway checked

☐  Proxy checked

☐  DNS filtering checked

☐  URL filtering checked

Endpoint

☐  Antivirus checked

☐  EDR checked

☐  Browser security checked

☐  Browser plugins checked

Simulation

☐  Test campaign completed

☐  Inbox delivery confirmed

☐  Spam checked

☐  Quarantine checked

☐  External label checked

☐  External images checked

☐  Links tested

☐  Landing page tested

☐  Tracking tested

☐  Large-campaign sending rate reviewed

19. Troubleshooting

Case 1 – Email Does Not Arrive. Check: simulation platform delivery status, SMTP response, sending IP, sending domain, Zoho quarantine, Zoho blocklists, firewall/email gateway, DNS/authentication.

Case 2 – Email Arrives in Spam. Check: sender allowlist, domain allowlist, IP allowlist, Trusted List, user-level spam list, sender/IP/domain reputation, SPF/DKIM/DMARC, Incoming Rules. An Allowed List entry does not necessarily guarantee Inbox placement in every situation.

Case 3 – Email Is Quarantined. Check: quarantine reason, authentication failure, blocklist match, content/security rule, organization policy.

Case 4 – Some Users Receive the Email and Others Do Not. Check: user-specific policies, group policies, user-level spam lists, incoming rules, mailbox configuration, endpoint/security controls.

Case 5 – First Batch Arrives but Later Emails Are Delayed. Check: rate limiting, temporary 4xx responses, receiving-side throttling, campaign sending speed, retry behavior.

Case 6 – Email Reaches Inbox but Link Does Not Work. Check: proxy, DNS filtering, firewall, web security gateway, browser security, EDR, landing-page domain.

Case 7 – Email Reaches Inbox but Images Do Not Appear. Check: Zoho Mail → Settings → Mail → Mail View Options → Load External Images.

Case 8 – Email Reaches Inbox but Shows an Impersonation Warning. Check: Zoho Admin Console → Security & Compliance → Phishing & Malware. Review display-name spoofing/impersonation controls and configure an approved scoped exception where supported.

20. Zoho Mail Reports & Delivery Logs

This section supports Section D (Delivery Logs & Evidence) of the Diagnostic Questionnaire, which the core whitelisting steps in Section 5 did not previously cover.

1. Log in to the Zoho Mail Admin Console.

2. Select Reports in the left-hand navigation. The Admin Reports page opens in a new tab.

3. Select Logs, then choose Mail Logs.

4. Under Mail Logs there are two relevant reports:

   1. Delivery Logs - the log of emails for a chosen date range, searchable by sender address, recipient address, or Message-ID. Use this to confirm whether a simulation email actually left/entered the system and what its final status was.
   2. Rejection Logs - incoming emails sent to the organization's domain that were rejected before reaching a mailbox, including the rejection reason and sender IP. This is the most direct way to confirm whether a simulation email was rejected at the gateway and why. Rejection Logs roll out on paid plans; contact Zoho support if the option is not visible.

5. Use a date filter and the search bar to narrow results to the simulation sender, domain, or campaign window.

6. Compare the headers/logs of one affected (blocked/delayed) message against one successfully delivered message, per Section D of the questionnaire - this is usually the fastest way to isolate which control point diverged.

21. URL Rewriting, Time-of-Click Sandboxing & Attachment Sandboxing (Zoho eProtect)

This section supports Section C (Proxy, URL Rewriting & Sandboxing) and the related items in Section E (Whitelisting Checklist) of the Diagnostic Questionnaire.

Core Zoho Mail (the Spam Control / Phishing & Malware features described throughout this guide) does not natively rewrite links or run time-of-click sandboxing the way Microsoft Safe Links, Proofpoint URL Defense, or Mimecast URL Protect do. If a Zoho Mail customer needs that capability, it is provided by Zoho eProtect, a separate add-on email-security product, which:

• rewrites and inspects inbound email URLs in real time and at time-of-click, using dynamic link analysis and sandboxing to block malicious, cloaked, or compromised links;
• performs deep content inspection and phishing/malware scanning on attachments;
• applies SPF/DKIM/DMARC-based authentication and spoofed-domain/display-name detection on top of the underlying mailbox platform.

Practical implication for simulation whitelisting: if the organization has Zoho eProtect deployed in front of Zoho Mail (or in front of another mailbox platform), the simulation sender/domain/IP and its tracking/landing-page URLs may need a separate exclusion inside eProtect, in addition to (not instead of) the Zoho Mail Allowed/Trusted List steps in Section 5. If the organization does not use eProtect, the URL-rewriting and attachment-sandboxing checklist items in the questionnaire are not applicable to the Zoho Mail layer and should be answered accordingly (e.g., "N/A - no eProtect/SEG in use").

\n