> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains-microsoft-365.md).

# Whitelisting Email Domains (Microsoft 365)

Allowlist Herd's phishing simulations in Microsoft 365 with a Microsoft Defender Advanced Delivery policy — the sending domains AND the sending IP — so simulations reach the inbox instead of being qua

When Herd sends a phishing simulation, the message comes from one of Herd's verified sending domains rather than your own, and it is deliberately built to look like a real phishing attempt. Microsoft Defender for Office 365 rates it exactly that way. Without an allowlist, simulations are quarantined, sent to Junk, stripped of links by Safe Links, or pulled from the inbox after delivery by zero-hour auto purge (ZAP), all of which skews your results.

The **only** allowlist that works is the **Advanced Delivery** policy for third-party phishing simulations. Microsoft built it for exactly this case: messages that match it skip spam and phishing filtering, Safe Links and Safe Attachments leave them intact, ZAP does not remove them, and no alert or investigation is raised. Every other allowlist in Microsoft 365 (the Tenant Allow/Block List, "allowed senders and domains" in an anti-spam policy, a mail flow rule that sets the spam confidence level) is overridden by Microsoft's *secure by default* behaviour for messages rated high-confidence phishing, which simulations routinely are.

{% hint style="warning" %}
An Advanced Delivery entry needs **both** a sending **domain** and a sending **IP**, and a message must match one of each. A domain-only entry never matches. Simulations that are quarantined despite an Advanced Delivery entry are almost always missing the IP.
{% endhint %}

{% hint style="info" %}
Using Google Workspace instead? See [Whitelisting Email Domains in Google Workspace](/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains.md). Running Mimecast in front of Microsoft 365? See [Whitelisting Email Domains in Mimecast](/herd-security-docs/simulations/phishing-simulations/whitelisting-email-domains-mimecast.md). This guide is about **deliverability**; to credit users who **report** a simulation from Outlook, see [Detecting Phishing Reports From Outlook](/herd-security-docs/email-providers/email-providers/outlook.md).
{% endhint %}

## What you need from Herd

In the Herd admin console, go to **Settings → Integrations → Outlook** and open **Allow-list Herd simulation mail**. It shows the three values below with copy buttons, read live from Herd's mail infrastructure, so it is always current. The values at the time of writing:

**Sending domains.** Microsoft matches the domain of the envelope sender (`MAIL FROM`, which for Herd is `mail.<domain>`) or the DKIM signing domain (`<domain>`). Add **both forms** of every domain; Advanced Delivery accepts up to 50.

```
x7k2m.net
mail.x7k2m.net
okta-auth-verify.com
mail.okta-auth-verify.com
claude-auth-verify.com
mail.claude-auth-verify.com
anthropic-portal.com
mail.anthropic-portal.com
cursor-services.com
mail.cursor-services.com
codex-support.com
mail.codex-support.com
chatgpt-customer-care.com
mail.chatgpt-customer-care.com
google-status-update.com
mail.google-status-update.com
salesforce-customer-care.com
mail.salesforce-customer-care.com
netsuite-account-confirm.com
mail.netsuite-account-confirm.com
oracle-portal.com
mail.oracle-portal.com
github-status-update.com
mail.github-status-update.com
aws-account-portal.com
mail.aws-account-portal.com
slack-customer-care.com
mail.slack-customer-care.com
calendly-support.com
mail.calendly-support.com
zip-portal-verify.com
mail.zip-portal-verify.com
amazon-account-team.com
mail.amazon-account-team.com
whatnot-customer-team.com
mail.whatnot-customer-team.com
```

**Sending IP.** Herd sends every simulation from a fixed, dedicated address:

```
206.55.148.199
```

**Simulation URLs.** Not needed. Microsoft only uses this field for links in Teams messages or Office documents; links in email simulations are allowed automatically once the domain and IP match.

{% hint style="info" %}
Herd adds sending domains over time. The in-app panel is the source of truth; if a simulation from a new domain is filtered, compare the panel against your policy and add what is missing.
{% endhint %}

## Prerequisites

* **Microsoft Defender for Office 365** (Plan 1 or Plan 2). Advanced Delivery is part of Defender for Office 365.
* A role that can manage threat policies: **Security Administrator** (or Global Administrator).
* The sending domains and sending IP from the Herd panel above.

## Configure Advanced Delivery

1. Open the Microsoft Defender portal at `https://security.microsoft.com`, then **Email & collaboration → Policies & rules → Threat policies**, and under **Rules** select **Advanced delivery**. The direct link is `https://security.microsoft.com/advanceddelivery`.
2. Open the **Phishing simulation** tab and click **Add** (or **Edit** if an entry already exists).
3. **Domain**: paste the full list from Herd, one entry per line.
4. **Sending IP**: paste the IP from Herd.
5. Leave **Simulation URLs to allow** empty.
6. Click **Add** (or **Save**), then **Close**.

Allow up to 30 minutes for the policy to take effect.

{% hint style="warning" %}
If your MX record does **not** point at Microsoft 365 (a gateway such as Mimecast or Proofpoint sits in front), Microsoft sees the gateway's IP, not Herd's, and the entry will not match. Turn on **Enhanced Filtering for Connectors** on the inbound connector so the true source IP reaches the policy, and allowlist Herd on the gateway as well.
{% endhint %}

## Verify the allowlist

1. In Herd, send a phishing simulation that includes your own mailbox.
2. Confirm it arrives in your **Inbox** with links intact.
3. Open the message in **Threat Explorer** (Defender for Office 365 Plan 2) or from **Email & collaboration → Explorer**. On the email entity page, the **Override(s)** section shows **Phishing simulation** under **Tenant override** when the policy matched.

The message headers show the same three values the policy needs. In a delivered simulation, `Authentication-Results` reads like:

```
Authentication-Results: spf=pass (sender IP is 206.55.148.199)
 smtp.mailfrom=mail.okta-auth-verify.com; dkim=pass (signature was verified)
 header.d=okta-auth-verify.com; dmarc=pass action=none header.from=okta-auth-verify.com;
```

The sender IP, the `smtp.mailfrom` domain and the `header.d` domain are exactly what Advanced Delivery checks.

## Still not arriving?

Where to look, in order:

1. **Exchange admin center → Mail flow → Message trace** (all plans) or **Threat Explorer** (Plan 2). Search by sender domain or `Message-ID`. The trace states whether the message was delivered, quarantined or filtered, and which policy acted.
2. **Email & collaboration → Review → Quarantine**, filtered by sender. A message quarantined before the policy was in place can be released from here; once the policy matches, ZAP will not remove it again.
3. The recipient's **Junk Email** folder.
4. If the message was in the inbox and then disappeared, ZAP moved it after delivery. Explorer shows the ZAP action.

Which control to change:

* **Advanced delivery** is the fix for spam, phishing, Safe Links, Safe Attachments and ZAP. Check that **every** domain from the Herd panel is present in both forms and that the sending IP is present.
* **Tenant Allow/Block List**: check the sending domain was not block-listed by an earlier user report or admin submission.
* **Mail flow rules** that quarantine or redirect external mail with links, or that match on headers such as `X-Mailer`.
* **A gateway in front of Exchange Online**: see the Mimecast guide, and enable Enhanced Filtering for Connectors.

Herd shows a **Delivered** status for a recipient once your mail server accepted the message. From that moment the message is inside your tenant, and anything that happens next is a policy on your side. Every simulation email also carries an **`X-Campaign-ID`** header you can search for in Message trace.