> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Safe Attachments

> Stop sandbox detonation registering as a false attachment open.

Safe Attachments detonates attachments in a sandbox. That detonation registers as an
attachment open in your results, crediting an interaction to a user who never touched the
file. A mail flow rule skips that processing for our mail.

<Info>
  Do [Domain & IP whitelisting](/whitelisting-ms-domains-ips) first. This is an addition to it,
  not a replacement.
</Info>

<Steps>
  <Step title="Create a mail flow rule">
    In the Exchange admin center, create a new rule named something like
    `Bypass Safe Attachments`, and click **More options**.
  </Step>

  <Step title="Set the condition">
    From **Apply this rule if**, select *The senders* then *IP address is in any of these
    ranges or exactly matches*, and enter our
    [sending IP addresses](/whitelisting-values#sending-ip-addresses).
  </Step>

  <Step title="Set the action">
    From **Do the following**, select *Modify the message properties* then *set a message
    header*.

    Click the first **Enter text** link and set the message header to
    `X-MS-Exchange-Organization-SkipSafeAttachmentProcessing`. Click the second **Enter text**
    link and set the value to `1`.
  </Step>

  <Step title="Save">
    Click **Save**.
  </Step>
</Steps>

<Tip>
  If your attachment-open figures look implausibly high across the whole organisation rather
  than for particular people, Safe Attachments is the usual cause.
</Tip>

## Then what

**Have other security products enabled? Whitelist them now.**

| Product | Where to go |
| - | - |
| Other Microsoft products: Safe Links, Safe Attachments, web protection, whitelisting by header | [Microsoft 365](/whitelisting-microsoft-365) |
| Third-party gateways and firewalls: Barracuda, FortiNet, Vade, WatchGuard | [Whitelisting](/whitelisting) |

Once everything that applies to your environment is whitelisted, send a test email from the
platform and confirm every interaction is recorded. See
[Testing your whitelisting](/whitelisting-testing).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.