We recommend waiting 1-2 hours after enabling allowlisting before setting up your first phishing campaigns as the settings can take some time to propagate. We also make sure to bypass the Clutter folder in Microsoft's Exchange Online Protection (EOP) mail filter with this rule. This filter will allow simulated emails to bypass your filter by allowlisting our email headers. We recommend allowlisting by IP address or hostname but your organisation may require you to allowlist by headers for emails to deliver correctly. For allowlisting by hostname in Exchange 2013, 2016 or Microsoft 365 (formerly Office 365), see this article.Īllowlisting is necessary for our simulated phishing emails to bypass your organisation's mail filters.For allowlisting by email header in exchange 2010, see this article.This article covers how to allowlist your simulated phishing test emails by header in you Exchange 2013, 2016 or Office 365 environment (the process is the same for all 3 servers). To correctly allowlist in Exchange and Office 365 environments, please see our article Allowlisting via Microsoft Advanced Delivery. IMPORTANT NOTICE: Since Microsoft rolled out the 'Secure by Default' standard in October 2021, the required method of allowlisting has changed.

Outlook 365 exchange 2013