Allowlisting by Email Headers in Exchange 2013, 2016, or Microsoft 365 (formerly Office 365)

Support Desk
  • Updated
Follow

IMPORTANT NOTICE: Since Microsoft rolled out the "Secure by Default" standard in October 2021, the required method of allowlisting has changed. To correctly allowlist in Exchange and Office 365 environments, please see our article Allowlisting via Microsoft Advanced Delivery.

This article covers how to allowlist your simulated phishing test emails by header in you Exchange 2013, 2016 or Office 365 environment (the process is the same for all 3 servers).

  • For allowlisting by email header in exchange 2010, see this article.
  • For allowlisting by hostname in Exchange 2013, 2016 or Microsoft 365 (formerly Office 365), see this article.

 

Allowlisting is necessary for our simulated phishing emails to bypass your organisation's mail filters. We recommend allowlisting by IP address or hostname but your organisation may require you to allowlist by headers for emails to deliver correctly.

This filter will allow simulated emails to bypass your filter by allowlisting our email headers. We also make sure to bypass the Clutter folder in Microsoft's Exchange Online Protection (EOP) mail filter with this rule.

We recommend waiting 1-2 hours after enabling allowlisting before setting up your first phishing campaigns as the settings can take some time to propagate.

 

Jump to:

Bypassing Clutter and Spam Filtering by Email Header (Exchange 2013, 2016, and Microsoft 365 (formerly Office 365))

Bypass Junk Folder (Microsoft 365 (formerly Office 365) mail servers only)

 

Bypassing Clutter and Spam Filtering by Email Header (Exchange 2013, 2016, and Microsoft 365 (formerly Office 365))

NOTE:
When allowlisting for Microsoft 365 (formerly Office 365), we STRONGLY recommend implementing the ATP bypass steps to avoid potential false-positives in your campaigns. 
  1. Log into your mail server admin portal and select Admin centers > Exchange.
    2019-06-19_17_10_00-Microsoft_365_admin_center_-_Home.png

  2. Select mail flow
  3. Click the (+)
  4. Select Bypass spam filtering...
    2019-06-19_17_19_43-rules_-_Microsoft_Exchange.png

  5. Name the rule, e.g. Bypass Clutter & Spam Filtering by Email Header.
  6. Select Apply this rule if... > A message header > Includes any of these words.
  7. To the right of that rule, you will see Enter text and Enter words...
    • Click Enter text and type in the header X-PhishingTackle
    • Click Enter words and type PhishingTackle.com, then click the (+)

      Whitelist_Headers_Bypass_Clutter.png
  8. Ensure under Do the following... it is set to the following:
    • Set the spam confidence level (SCL) to...
    • Bypass spam filtering
  9. Click Add action > Modify the message properties...set a message header 
  10. To the right of that rule, you will see Enter text and Enter words...
    • Click Enter text and type X-MS-Exchange-Organization-BypassClutter
    • Click Enter words and type true
  11. Hit Save

Note: We recommend leaving the other options at their default settings.

 

 

 

Bypassing the Junk Folder (Microsoft 365 (formerly Office 365) mail servers only)

NOTE:
When allowlisting for Microsoft 365 (formerly Office 365), we STRONGLY recommend implementing the ATP bypass steps to avoid potential false-positives in your campaigns. 

This rule allows our simulated phishing emails to bypass the junk folder, thus ensuring your recipients are receiving your phishing campaigns correctly.

Within the Exchange admin center:
2019-06-19_15_34_14-rules_-_Microsoft_Exchange.png

  1. Select Mail Flow
  2. Click the (+)
  3. Bypass spam filtering...

    2019-06-19_15_36_57-new_rule.png
  4. Name the rule, e.g. Phishing Tackle - Skip Junk Folder
  5. Add the condition Apply this rule if... > A message header > includes any of these words.
  6. On the right side of that rule, you will see Enter text and Enter words...
    • Click the Enter text and type in the header X-PhishingTackle then click Enter words... and type in PhishingTackle.com then click the (+) and OK
  7. Beneath Do the following, click Modify the message properties then Set a Message Header.
  8. Set the message header as below:
    • Set the message header X-Forefront-Antispam-Report to the value SFV:SKI;.
  9. Beneath Properties of this rule set the priority to directly follow the existing rule (Outlined in this article)
    2019-06-19_15_55_47-Rule.png
    • NOTE: you may need to save the rule, then re-open it to access the Priority setting.
  10. Hit SAVE

 

Should you require any further assistance, please contact our support team by clicking here.

Related articles