Safelisting by Email Header in Exchange 2013, 2016, or Office 365

Overview

Notice: The following method of safelisting has been deprecated as of 09/01/2021. You will want to implement the new advanced delivery rules here for Outlook clients. 

The following details the process of safelisting our simulated phishing email headers on your Exchange 2013, 2016, or Office 365 platforms.

Mail filters will sometimes block the emails our servers send, but there is a way to resolve this issue with safelisting. Safelisting allows for phishing emails sent from PhishingBox to bypass any mail filters or junk, spam and clutter folders. We do recommend however to safelist by IP if possible (for example if you are using a cloud security system). When safelisting by IP is not applicable, safelisting by header is an effective way to make sure that phishing emails are delivered. Below we will show you how to set up header rules for Spam and Clutter as well as the Junk folder. 

In addition to safelisting, we strongly recommend that you also set up a connector in Office 365. This will prevent PhishingBox emails from being blocked due to Microsoft greylisting.

• Bypassing Clutter and Spam Filtering
• Bypassing the Junk Folder

Bypassing Clutter and Spam Filtering

To ensure PhishingBox emails will bypass your Clutter folder as well as spam filtering in Microsoft's EOP, follow the steps below.

• Go to Admin > Mail > mail flow > rules

1. Click the  dropdown under the Rules tab. Select Create a new rule.
2. Give the rule a name, e.g. "Bypass Clutter and Spam Filtering by Header"
3. Click More options
4. For the condition Apply this rule if
   
   1. A message header > includes any of these words
   2. You will then see Enter text and Enter words...
      1. Click Enter text and type 'X-PHISHTEST'
      2. Click Enter words and type in 'PhishingBox'
      3. Click the icon.
5.  For Do the following
   
   1. Modify the message properties > Set a message header to this value
      1. Enter text for message header as: ‘X-MS-Exchange-Organization-BypassClutter’
      2. Enter text for value as ‘true’
6. Add an additional action under Do the following
   1. Modify the message properties > Set the spam confidence level (SCL) to... 
   2. Select Bypass Spam Filtering.
7. Click Save.

Completed Mail Flow Rule

Bypassing the Junk Folder

Setting this rule will permit only simulated phishing emails from PhishingBox to bypass the Junk folder to ensure users are receiving the simulated phishing emails in their inboxes.

NOTE: for Office 365 Environments, If you safelisted our email servers prior to February 2018, you must add an additional mail flow rule in your Office 365 Admin center. This rule can be found below.

1. Go to Admin > Mail > Mail Flow
2. Click the  dropdown under the Rules tab. Select Create a new rule.
3. Give the rule a name, e.g. "PhishingBox Skip Junk Filtering".
4. Click on More options.
5. For the condition Apply this rule if
   1. Click The message headers... > Matches these text patterns
   2. You will now see Enter text and Enter words...
      1. Click Enter text and type 'X-PHISHTEST'
      2. Click Enter words and type in 'PhishingBox'
      3. Click the  icon.
6. Under Do the following 
   1. Modify the message properties > Set a Message Header.
   2. Set the message header to this value: the header "X-Forefront-Antispam-Report" to the value "SFV:SKI;".

      NOTE: check the Anti-spam message headers article to learn more about this header.

7. Under Properties of this rule set the priority to directly follow the existing rule (see Bypassing Clutter and Spam Filtering) set up for PhishingBox safelisting.
8. Click Save.

Completed Mail Flow Rule

After following the instructions above, you will want to safelist by IP as well.

We also recommend that you set up a small test phishing campaign to ensure our simulated phishing emails can reach your users. If the phishing emails can reach your test inboxes, you will know you have successfully safelisted our servers.

Back to top