> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Whitelisting by header

> The fallback when whitelisting by IP and domain is not possible.

Every simulation we send carries a unique header value. If whitelisting by IP and domain
cannot be done in your environment, you can whitelist on that header instead.

<Warning>
  Use this only as a fallback.
  [Domain & IP whitelisting](/whitelisting-ms-domains-ips) is the recommended method and
  should be tried first.
</Warning>

## Find your header value

<Steps>
  <Step title="Open the platform">
    Sign in at [platform.outkept.com](https://platform.outkept.com/).
  </Step>

  <Step title="Go to the whitelisting tab">
    Open **Settings** and click the **Whitelisting** tab.
  </Step>

  <Step title="Reveal the header">
    Click **Reveal header** and copy the value.
  </Step>
</Steps>

## Create the rule in Microsoft 365

<Steps>
  <Step title="Open the Exchange admin center">
    Go to [admin.exchange.microsoft.com](https://admin.exchange.microsoft.com/) and sign in.
  </Step>

  <Step title="Create a new rule">
    In the left menu, go to **Mail flow** then **Rules**, and create a new rule.
  </Step>

  <Step title="Set the condition">
    Under **Apply this rule if**, choose *The message headers includes any of these words*.
    Set the header to `X-PHISHTEST` and the value to the one you copied from the platform.
  </Step>

  <Step title="Set the action">
    Under **Do the following**, choose *Modify the message properties* then *set the spam
    confidence level (SCL)*, and select **Bypass spam filtering**.
  </Step>

  <Step title="Enforce and finish">
    Make sure the rule is enforced, then review and click **Finish**.
  </Step>
</Steps>

## Set up the connector

Header whitelisting still needs a connector for stable mail flow. Follow
[Set up the connector](/whitelisting-ms-domains-ips#set-up-the-connector). The steps are
the same.

## Refreshing the header value

We advise refreshing the header value periodically, which reduces the risk of unauthorised
access through a compromised header value. Generate a new one under **Campaign settings** by
clicking **New**.

<Warning>
  Generate the new value and update your mail flow rule in the same sitting. Between those
  two actions, simulations may be filtered.
</Warning>

## Then what

**Have other security products enabled? Whitelist them now.**

| Product | Where to go |
| - | - |
| Other Microsoft products: Safe Links, Safe Attachments, web protection, whitelisting by header | [Microsoft 365](/whitelisting-microsoft-365) |
| Third-party gateways and firewalls: Barracuda, FortiNet, Vade, WatchGuard | [Whitelisting](/whitelisting) |

Once everything that applies to your environment is whitelisted, send a test email from the
platform and confirm every interaction is recorded. See
[Testing your whitelisting](/whitelisting-testing).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.