Whitelisting Guide: Allow Jericho Security Emails

Jericho Security sends realistic phishing simulation emails that are intentionally crafted to resemble threats. Because of this, your email provider and security tools may block, quarantine, or silently alter these messages before they reach your employees. When security tools rewrite links or sandbox attachments, they can falsely trigger a “click” or “failure” result even when no employee interacted with the email. Provider-specific allow rules reduce this interference, but do not guarantee delivery or perfect metrics. For example, Microsoft Advanced Delivery can still wrap links. Verify behavior with a pilot campaign.

Why whitelisting matters

Without proper whitelisting, your email security systems may:

• Block or quarantine simulation emails before they reach employees
• Rewrite or pre-click tracking links, creating false positive click events
• Open attachments in a sandbox environment, triggering false attachment-open results

All three behaviors skew your simulation data and reduce the value of your security awareness program.

How to whitelist

You can whitelist Jericho Security using any combination of the three approaches below.

Note

Prefer rules that match confirmed sending IPs together with campaign-specific identities where your provider supports this. Separate IP and domain allowlists do not necessarily enforce an AND condition. Shared sending IPs alone do not identify a Jericho campaign.

By IP range

For standard email delivered through Jericho’s Amazon SES sending pool, allow these dedicated IP addresses:

IP address	CIDR equivalent
24.110.88.85	24.110.88.85/32
24.110.88.86	24.110.88.86/32

These addresses were verified against the production SES sending pool on October 19, 2026. Apply them with the sender/domain conditions required by your email security provider. Direct Mail Injection uses a different delivery path and does not depend on these SMTP sending IPs.

For a campaign using another delivery provider, confirm its sending values with Jericho Support.

By email header

If Jericho Support confirms a campaign-specific header for your delivery method, use the supplied key and value according to your provider’s instructions. Do not assume every simulation includes a unique organization header.

By domain

Confirm the sending domains for your selected campaign with Jericho Support. Ask for the envelope sender (MAIL FROM), DKIM signing domain, and any link/redirect domains needed by your email security provider. The visible From address alone may not be the value required by that provider.

Keep the list with your campaign setup records and recheck it when delivery methods or campaign domains change.

Where to whitelist

Configure whitelisting in each of the following locations:

• Email provider (Microsoft 365 or Google Workspace) — for both Spam and Phishing categories
• Email security tools — ProofPoint, Mimecast, Abnormal Security, Microsoft Defender, and similar products
• Web application firewalls — only needed in rare cases where firewalls interfere with link tracking

What to whitelist for

Review each of the following with the instructions for your provider; one allow rule may not cover all three:

1. Email delivery — ensure simulation messages are not blocked or quarantined
2. URL inspection bypass — prevent link rewriting or pre-clicking by security scanners
3. Attachment scan bypass — prevent sandbox scanning of simulation attachments

Platform-specific guides

Select your email provider or security tool for step-by-step whitelisting instructions.

• Microsoft 365 — Configure Advanced Delivery for third-party phishing simulations.
• Google Workspace — Configure Gmail allow rules, or configure Direct Mail Injection.
• Mimecast — Configure permitted senders, URL protection bypass, and attachment bypass policies.
• Proofpoint — Create a safe sender filter in Proofpoint Essentials to allow simulation emails.
• Barracuda — Add Jericho IP ranges and sending domains to Barracuda Email Gateway Defense.