Allowlisting by IP address in Exchange 2013, 2016, or Microsoft 365 (formerly Office 365)

To ensure the effective delivery of our simulated phishing emails, you will need to allowlist our servers, we recommend allowlisting by either IP address or by hostname.

Sometimes allowlisting can require some trial and error, this article covers allowlisting by IP address, if you are unsuccessful with this method check out our guide on allowlisting by Hostname, which can be found here.

Another option is allowlisting by Email Headers, but this is usually only necessary if you use a cloud-based spam filter, see guide here.

NOTE:

The Process

The process is quite simple, there are just 4 steps:

The first thing you'll need to do is set up an IP Allow List which includes Phishing Tackle's IP addresses. Next, you add a mail flow rule which allows our emails to bypass your Clutter folder and Microsoft's Exchange Online Protection (EOP) filter. Lastly, if you're using Microsoft 365 (formerly Office 365), you'll need a connector to prevent deferments. All of these steps must be done to fully allowlist our servers.

Step 1 - IP Allow List

Step 2 - Bypass Clutter & Spam Filter

Step 3 - Bypass Junk Filter - Microsoft 365 (formerly Office 365) Only

Step 4 - Create connector to avoid deferments - Microsoft 365 (formerly Office 365) Only

Step 1 - Adding Phishing Tackle's IP addresses to the IP Allow List 

1. Log into the Microsoft 365 (formerly Office 365) portal and select  Admin centers > Exchange.
   
2. Hit Connection filter, under protection.
   
   
   
3. Select Edit to edit the default policy.
   
   
   
4. Hit Connection filtering, then the  + Sign.
   
   
   
5. Within the add allowed IP address screen, add Phishing Tackle's IP addresses, one at a time. A complete list of our IP addresses can be found here.
   
   
   
6. Hit OK > Save.
7. Move onto the mail flow rule in Step 2!

Step 2 - Bypass clutter and spam filtering

This step is crucial to avoiding Microsoft's EOP.

1. Back in the Exchange admin center, hit rules under mail flow.
   
   
   
2. Hit the + sign then Bypass spam filtering.
   
   
   
3. Give the rule a memorable and easy-to-understand name, then under *Apply this rule if... select The sender... > IP address is in any of these ranges or exactly matches.
   
   
   
4. Then enter each of Phishing Tackle's IP addresses, hitting the + sign for each. (A complete list of our IP addresses can be found here.) Then hit OK
   
   
   
5. Under *Do the following... hit Modify the message properties... > set a message header.
   
   
   
6. Edit the properties of this by selecting the Enter text buttons:
   
   
   Use the following entries:
   Set the message header to "X-MS-Exchange-Organization-BypassClutter" to the value "true"
   
   
   
7. Hit add action.
   
   
   
8. From the drop-down menu, select Modify the message properties... > set the spam confidence level (SCL).
   
   
   Set it to "Bypass spam filtering"
   
   
   
9. Leave all remaining settings as their default values and hit Save. 
   

If you're using Microsoft 365 (formerly Office 365), you will need to complete Steps 3&4 below, if you are just using Microsoft Exchange, you're done!

Make sure to run some test campaigns to a small group of recipients, checking both spoofed and external domain templates, before running an organisation-wide campaign.

Step 3 - Bypass the Junk Folder - Microsoft 365 (formerly Office 365) Only

1. Still within the Mail flow section, click the + sign > Bypass spam filtering...
   
   
   
2. Give the rule a memorable and easy-to-understand name, then under *Apply this rule if... select The sender... > IP address is in any of these ranges or exactly matches.
   
   
   
3. Then enter each of Phishing Tackle's IP addresses, hitting the + sign for each. (A complete list of our IP addresses can be found here.) Then hit OK
   
   
   
4. Under *Do the following... hit Modify the message properties... > set a message header.
   
   
   
5. Edit the properties of this by selecting the Enter text buttons:
   
   
   Use the following entries:
   Set the message header to "X-Forefront-Antispam-Report" to the value "SFV:SKI;"
   
   
   
6. Adjust the Priority (if necessary) to be directly after the Bypass clutter and spam filtering rule, created in step two. (Note, the priority may not be visible, if this is the case, save and reopen the rule). Hit Save.
   
   
   
7. Move onto create the connector in Step 4!

Step 4 - Create a Connector to Avoid Deferments - Microsoft 365 (formerly Office 365) Only

This step is crucial in avoiding Microsoft's rate limiting settings.

1. Still within the mail flow section, click connectors.
   
   
   
2. Hit the + sign to create a new connector.
   
   
   
3. In the From: and To: drop-down menus, select Partner organization and Office 365 respectively, then hit Next.
   
   
   
4. Give the connector a memorable and logical name, add a description if you like (it's optional) then hit Next.
   
   
   
5. On the next screen, hit Use the sender's IP address.
   
   
   
6. Use the + sign to add all Phishing Tackle's IP addresses one by one. (A complete list of our IP addresses can be found here.) Then hit Next.
   
   
   
7. Ensure Reject email messages if they aren't sent over TLS is selected.
   
   
   
8. Double-check the settings entered are correct, then hit Save.
   

That's it!

Allowlisting can sometimes require some trial and error, should the above guide not work, try allowlisting by Hostname instead.

Should you require any further assistance, please contact our support team by clicking here.