Skip to main content
Every simulation we send carries a unique header value. If whitelisting by IP and domain cannot be done in your environment, you can whitelist on that header instead.
Use this only as a fallback. Domain & IP whitelisting is the recommended method and should be tried first.

​
Find your header value

1

Open the platform

Sign in at platform.outkept.com.
2

Go to the whitelisting tab

Open Settings and click the Whitelisting tab.
3

Reveal the header

Click Reveal header and copy the value.

​
Create the rule in Microsoft 365

1

Open the Exchange admin center

Go to admin.exchange.microsoft.com and sign in.
2

Create a new rule

In the left menu, go to Mail flow then Rules, and create a new rule.
3

Set the condition

Under Apply this rule if, choose The message headers includes any of these words. Set the header to X-PHISHTEST and the value to the one you copied from the platform.
4

Set the action

Under Do the following, choose Modify the message properties then set the spam confidence level (SCL), and select Bypass spam filtering.
5

Enforce and finish

Make sure the rule is enforced, then review and click Finish.

​
Set up the connector

Header whitelisting still needs a connector for stable mail flow. Follow Set up the connector. The steps are the same.

​
Refreshing the header value

We advise refreshing the header value periodically, which reduces the risk of unauthorised access through a compromised header value. Generate a new one under Campaign settings by clicking New.
Generate the new value and update your mail flow rule in the same sitting. Between those two actions, simulations may be filtered.

​
Then what

Have other security products enabled? Whitelist them now. Once everything that applies to your environment is whitelisted, send a test email from the platform and confirm every interaction is recorded. See Testing your whitelisting.