Docs
Documentation / SMTP and deliverability / Allowlist simulations in mail filters and browsers

Allowlist simulations in mail filters and browsers

Mail filters and browser protection exist to stop phishing, and a convincing simulation looks exactly like phishing. Allowlisting tells them which simulations are yours, without switching protection off for anything else.

These are organization-wide security settings, so they are usually made by your IT or security team. Share this page with them before your first campaign.

What to allowlist

  • Phishtime's default simulation domain: phishtimetraining.com. Every campaign on every plan uses it unless you give the campaign its own landing domain. Phishtime serves simulation links, landing pages and training pages from it (t.phishtimetraining.com and lp.phishtimetraining.com), and it hosts nothing else. Where a setting takes a domain, the entry covers its subdomains unless stated otherwise below.
    • Hello World plan: this is the only domain your campaigns use. Links always point to it, and mail is always sent through Phishtime managed mail from mg.phishtimetraining.com, because the plan has no own SMTP profiles or landing domains. You only need to allowlist this one domain, both for the links and as the sender domain. Some mail filters also ask for a sending IP address; see Find the sender details. During a free trial you can also use your own SMTP profile and landing domains; allowlist those as well if you do.
    • Paid plans: links use this domain unless the campaign has its own landing domain. Mail goes out either through managed mail, as on Hello World, or through your own SMTP profile, which you choose per campaign. If you use your own SMTP profile, allowlist that sender as well (see Find the sender details).
  • Your own landing domains (Pro and Enterprise): any domain you verified under Settings → Domains & network and use as a campaign's landing domain. A campaign with its own landing domain serves its links and pages from that domain instead of phishtimetraining.com.
  • Do not allowlist phishtime.com. It hosts the Phishtime website and your admin console, never simulation content, so allowlisting it changes nothing for your campaigns.

Find the sender details

Mail filters identify a simulation by who sent it, which depends on how the campaign is sent:

  • Phishtime managed mail (the only option on Hello World, available on every plan) is sent through a shared mail provider from mg.phishtimetraining.com. Its sending IP addresses are shared and can change without notice, so an allowlist entry based on a sending IP can stop matching at any time. With managed mail, allowlist by sender domain wherever your mail filter allows it.
  • Your own SMTP profile (paid plans and free trial) sends from your own mail server, with your own domain and IP addresses. Use this if your mail filter needs a fixed sending IP.

The reliable way to get the exact values is to read them from a real message. Send a test from the campaign wizard to your own mailbox, open the message headers, and find the Authentication-Results header. It contains the sending IP address, the envelope sender domain (smtp.mailfrom) and the DKIM signing domain (header.d).

Mail filters

Microsoft 365

Microsoft 365 has a dedicated setting for third-party phishing simulations, called the advanced delivery policy. Messages that match it are not filtered, links in them are not blocked when clicked, and an employee who reports one with the built-in Report button does not trigger an alert or incident.

  1. Open the Microsoft Defender portal at https://security.microsoft.com/advanceddelivery (Email & collaboration → Policies & rules → Threat policies → Advanced delivery). You need the Security Administrator role in Defender and Organization Management in Exchange Online.
  2. Open the Phishing simulation tab and select Add (or Edit if entries exist).
  3. Under Domain, add the smtp.mailfrom or the header.d domain from the test message.
  4. Under Sending IP, add the sending IP address from the same header.
  5. Leave Simulation URLs to allow empty. It is only needed for links in Teams messages or Office documents, not in email.
  6. Select Add, then send another test and check that it arrives in the inbox.

A message must match at least one domain and one sending IP. Do not also add simulation links to the Safe Links "Do not rewrite the following URLs" list; Microsoft notes this can cause unwanted click alerts.

Official documentation: Configure the advanced delivery policy for non-Microsoft phishing simulations (Microsoft Learn).

Google Workspace

Gmail has no setting dedicated to phishing simulations. In the Google Admin console, open Apps → Google Workspace → Gmail → Spam, phishing and malware at the top-level organizational unit, then:

  1. Send a test from the campaign wizard to a Gmail mailbox in your organization, open it, and select Show original. Note the sending IP address and the domain in the From address, and check that the message shows SPF: PASS or DKIM: PASS for that domain.
  2. If you send through your own SMTP profile with a fixed IP address, add that IP address to the Email allowlist. Skip this for Phishtime managed mail, whose sending IP addresses are shared and can change.
  3. If messages still land in spam, or you use managed mail, add a Spam rule that bypasses spam filters for messages from an approved senders list, and add the From domain to that list.
  4. Leave authentication required on for that entry. Gmail then bypasses spam filters only for messages that really come from that domain. With authentication turned off, anyone who puts that domain in the From address of a real phishing email gets past your spam filter.

Gmail settings can take up to 24 hours to apply. Send another test before you launch and check that it arrives in the inbox.

Official documentation: Add IP addresses to allowlists in Gmail; Allowlists, denylists, and approved senders; Customize spam filter settings (Google Workspace Help).

Other email security gateways

If mail passes through a separate security gateway before it reaches your mailboxes, allowlist the same sending IP and domain there as well, following your gateway's instructions for phishing simulations. Allowlisting only in Microsoft 365 or Gmail does not help if the gateway quarantines the message first.

Browser warnings

Browsers check every page against a list of known dangerous sites before they open it. Chrome, Firefox and Safari use Google Safe Browsing. Microsoft Edge uses Microsoft Defender SmartScreen. If a simulation domain ends up on one of these lists, employees see a full-page warning such as "Dangerous site" or "Deceptive site ahead" instead of the landing page.

Google Chrome

Use the policy SafeBrowsingAllowlistDomains ("Configure the list of domains on which Safe Browsing will not trigger warnings"). Add phishtimetraining.com and your own landing domains, one per entry. Subdomains are included; wildcards, paths and https:// are not used.

  • Windows: set it with Group Policy (Google Chrome administrative templates, Safe Browsing settings) or with your device management tool. Chrome applies it only on computers joined to Active Directory or Microsoft Entra ID, or with the browser enrolled in Chrome Enterprise Core.
  • macOS: deliver it through your MDM in the com.google.Chrome preference domain, as an array of domain strings.
  • Without a domain or MDM: Chrome Enterprise Core is free. Enrolling the browser makes Chrome treat it as managed, and you set the policy from the Google Admin console.

Open chrome://policy on a test device to confirm the policy shows with the status OK. Allowlisted domains are also skipped by Chrome's download and password reuse checks.

Official documentation: SafeBrowsingAllowlistDomains (Chrome Enterprise policy list); Chrome Enterprise Core and Enroll cloud-managed Chrome browsers (Chrome Enterprise Help).

Microsoft Edge

Use the policy SmartScreenAllowListDomains ("Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings"). Add phishtimetraining.com, t.phishtimetraining.com, lp.phishtimetraining.com and your own landing domains.

  • Windows: Group Policy under Administrative Templates → Microsoft Edge → SmartScreen settings, or the registry key HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains with one numbered string value per domain (1, 2, …), or your device management tool.
  • macOS: the preference key SmartScreenAllowListDomains, as an array, through your MDM.
  • Edge applies it only on Windows devices joined to Active Directory, Windows 10 or 11 Pro and Enterprise devices enrolled in device management, and macOS devices managed with MDM.

If your organization uses Microsoft Defender for Endpoint, Edge ignores this policy. Add the domains as allow indicators in the Microsoft Defender portal instead, under Settings → Endpoints → Indicators.

Open edge://policy on a test device to confirm the policy is applied.

Official documentation: SmartScreenAllowListDomains (Microsoft Learn); Create indicators for IPs and URLs/domains (Microsoft Defender for Endpoint).

Firefox

Firefox has no setting or policy that exempts a single domain from Safe Browsing. An employee who sees the warning can choose to continue for that visit, unless your organization has turned that option off with the DisableSecurityBypass policy. If simulation domains are flagged, run campaigns for groups that use Chrome or Edge on managed devices. Do not turn off Firefox's phishing protection to work around it.

Official documentation: DisableSecurityBypass (Firefox administrator reference).

Safari

Safari has no per-domain exception either. Its only control is the global Warn when visiting a fraudulent website setting (Safari → Settings → Security on a Mac), which switches the check off for every site. Leave it on.

Official documentation: Change Security settings in Safari on Mac (Apple Support).

If you cannot manage browsers centrally

Without browser policies there is no way to exempt a simulation domain, so choose scenarios that are less likely to be flagged. Avoid landing pages that imitate the sign-in pages of large providers such as Google, Microsoft or Apple. Browsers are strictest with pages that look like these logins: if an employee reports one, the domain can be flagged again, and the warning interrupts the simulation for everyone.

Scenarios that do not copy a well-known brand test the same behaviour with a much lower risk of being blocked. The library includes generic scenarios with their own landing pages, such as Tax report, Vehicle toll pass and Traffic notice, and internal notices such as Annual leave balance notice and Holiday bonus payout notice. The landing page is what the browser checks, so pair internal notices with one of these landing pages, not with a Google, Microsoft or Apple sign-in page. Before a company-wide campaign, use Send test and open the link in the browsers your employees use.

If a simulation domain is flagged anyway

  • Your own landing domain: request a review in Google Search Console under Security issues (or report the page to Google Safe Browsing if the domain is not in Search Console), and report the URL to Microsoft as a false positive through Submissions in the Microsoft Defender portal.
  • phishtimetraining.com: email support@phishtimetraining.com. We request the review with Google and Microsoft.

Allowlisting on managed devices keeps your campaigns working while a review is pending.

Official documentation: Security issues report (Search Console Help); Report a page to Google Safe Browsing; Submit messages, URLs, and attachments for analysis (Microsoft Defender portal).

Official documentation

Vendors change their consoles and policy names over time. If a step here no longer matches what you see, follow the vendor's page.