Safelisting in Sophos

Safelisting (whitelisting) our IPs and domains in your Sophos Email Appliance will allow your targets to receive emails from the PhishingBox platform.

Follow the instructions below to safelist in Sophos. The contents of this article contain information from the Allow/Block Lists and the SEA configuration guide article provided by Sophos. If you have problems safelisting Portal in Sophos, you can reach out to Sophos for specific instructions.

Modify the Allow/Block Lists

The Allow/Block lists let you specify hosts and senders which are trusted or untrusted. Emails from allowed hosts/senders will ignore Sophos antispam filtering.

Follow these steps to add Portal to the Allow list:

1. In your Sophos Email Appliance (SEA) manager, navigate to Configuration > Policy > Allow Lists.
2. Click the desired list to display the List Editor dialog box.
3. If you have a spam filter in front of SEA, select the Senders tab. If you do not have a spam filter in front of SEA, select the Hosts tab.
4. Enter each required item in the Add entries text field. Click Add.
5. Depending on what you selected in Step 3 (Hosts or Senders):
   • If Senders, enter the Portal domain names, one by one. You only have to add the domain names you are utilizing in the email templates with which you are testing.
   • If Hosts, enter Portal IPs, one by one.

Sophos Perimeter Protection

Sophos Perimeter Protection will block mail from any non-existent domains and we do not recommend turning this setting off. To workaround this, ensure not to spoof any of the from email addresses on the phishing templates. 

Sophos Firewalls

In order for your users to access our landing and training pages, you must safelist PhishingBox domains on your Sophos firewall. These instructions were created for Sophos XG firewalls. Other versions of Sophos firewalls may require different steps, contact Sophos for specific instructions.

1. Log in to the firewall's portal.
2. Click on Web
3. Click on Exceptions
4. If you don't already have a list of exceptions, click Add Exception.
5. Provide a name (Portal) and a description for the exception list.
6. Under Skip the selected checks or actions, check the boxes for the services you purchased.
7. Enter the domains utilized by your email templates one line at a time in the Search/Add box. Using the following format, insert the domain where XYZ is located and change top level domain if it's not .com:

   ^([A-Za-z0-9.-]‌*\.)?XYZ\.com\.?/

8. Click Save.