Let OutPhish emails through

OutPhish’s practice emails are designed to look like real phishing. That means your email filters may block them, send them to junk, or add a warning banner. Some filters also open links automatically to check them. OutPhish would record that as a staff member clicking, which makes your reports wrong.

Whitelisting (also called allowlisting) tells your email system to let these emails through untouched. Do it before you start sending tests.

Who can do this

• In OutPhish, you need the Organization Admin role to see Whitelisting in the menu. IT providers can also see it while working in a client.
• In your email system, you need admin access. For Microsoft 365, that’s Security Administrator rights.

If an IT provider looks after your email, send them the values from the Whitelisting page and a link to this article.

Find the values to allow

1. In OutPhish, click Whitelisting in the menu.
2. Look at the What to allow box. It has three lists:
   • Sending IP addresses: the mail servers that send OutPhish’s practice emails. (An IP address is the numeric address of a server on the internet.)
   • Sending domains: practice emails come from addresses at these domains. (A domain is the part of an email address after the @.)
   • Simulation link address: where links in practice emails point. Exclude it from link scanning so scanners don’t record false clicks.
3. Use Copy with commas or Copy one per line to copy a whole list, ready to paste into your email system.

The values are the same for every organisation. Always copy them from the page, because the sending IP addresses can change. The page shows when they were last checked.

Note

If the page says “The sending IP addresses aren’t available right now”, contact OutPhish support for the current list. See Get help.

Under Setup guides, the page has instructions for each email system. They’re repeated below.

Microsoft 365

Set up an Advanced Delivery policy

This is Microsoft’s supported way to let phishing tests from other companies through. Microsoft’s filters won’t block or junk these emails. Safe Links still wraps the links but won’t block or scan them, and Safe Attachments won’t open attachments to test them. Malware checks still apply.

Caution

Microsoft accepts up to 10 sending IP entries. If the Whitelisting page shows a warning that there are more than 10 addresses, contact OutPhish support before you set this up.

1. Open security.microsoft.com/advanceddelivery. You need Security Administrator rights. (In the Defender portal menu, this is Email & collaboration > Policies & rules > Threat policies > Advanced delivery.)
2. Select the Phishing simulation tab, then click Add (or Edit if there are already entries).
3. Under Domain, add each sending domain listed on the Whitelisting page.
4. Under Sending IP, add each sending IP address listed on the Whitelisting page.
5. Leave Simulation URLs to allow empty. Microsoft only needs it for Teams or document simulations, not email.
6. Click Add (or Save), then Close.

If another filter sits in front of Microsoft 365

For example, if Mimecast, Proofpoint or Barracuda receives your mail first:

1. Complete the steps in Other email security services for that service.
2. Turn on Enhanced Filtering for Connectors for the inbound connector from that service. This lets Microsoft see the original sending IP address. Without it, the Advanced Delivery policy won’t recognise OutPhish emails.

Caution

Don’t use an Exchange mail flow rule that sets the spam confidence level (SCL) to -1 instead. Microsoft advises against this for phishing simulations, and it doesn’t stop high-confidence phishing verdicts.

Google Workspace

Add the email allowlist

This stops Gmail marking OutPhish emails as spam.

1. In the Google Admin console, go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware.
2. Select your top-level organisational unit.
3. Under Email allowlist, paste the sending IP addresses (use Copy with commas on the Whitelisting page), then click Save.

Hide spam warnings

The allowlist alone can still leave a warning banner on practice emails.

1. On the same page, under Spam, click Configure (or Add another rule).
2. Tick Bypass spam filters and hide warnings for messages from senders or domains in selected lists.
3. Create an address list containing the sending domains, with Require sender authentication turned on, and select it.
4. Click Save.

Changes can take up to 24 hours.

Gmail’s Safety settings (link warnings, spoofing and attachment protection) still apply. If staff see link warnings, review Gmail > Safety.

Caution

Don’t add OutPhish’s IP addresses under Inbound gateway. That setting is only for your own mail filtering servers, and it cancels the allowlist above.

Other email security services

For Mimecast, Proofpoint, Barracuda and similar services:

1. In your service’s admin console, add the sending IP addresses and sending domains to its allow list or permitted senders policy.
2. Turn off link rewriting, link scanning and attachment sandboxing for these senders, and exclude the simulation link address. Otherwise automated scanners can open links and record false clicks.
3. If the service passes mail on to Microsoft 365, also complete the Microsoft 365 steps, including Enhanced Filtering for Connectors.
4. If the service passes mail on to Google Workspace, list your service’s own IP addresses (not OutPhish’s) under Gmail’s Inbound gateway setting. Then complete the Google Workspace steps.

Check it’s working

1. Add yourself as a staff member, if you haven’t already. See Add and manage staff.
2. Send yourself a test from the Staff page. See Send a test now.
3. Check that it lands in your inbox with no warning banner.

In Microsoft 365, Threat Explorer shows the message with a system override of Phishing simulation.

If tests stop arriving later, check the Whitelisting page again. The sending IP addresses may have changed.