> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WatchGuard

> Firebox policy, WebBlocker, DNSWatch and SpamBlocker.

WatchGuard filters at several layers, so email delivery and landing page access each need
their own allowance.

<Note>
  This guide was assembled from publicly available WatchGuard documentation and may contain
  inaccuracies. Where it disagrees with WatchGuard's own documentation, follow theirs.
</Note>

## Configure the firewall policy

<Steps>
  <Step title="Open Policy Manager">
    Open Policy Manager on your WatchGuard Firebox and go to **Firewall Policies**.
  </Step>

  <Step title="Add a policy">
    Click **Add Policy** and select the appropriate type: SMTP, HTTPS or Any. Name it
    something like `Allow OutKept IPs`.
  </Step>

  <Step title="Set the endpoints">
    Under **From**, add our
    [sending IP addresses](/whitelisting-values#sending-ip-addresses). Under **To**, select
    **Any**, or specify your internal servers such as your mail server.
  </Step>

  <Step title="Allow and prioritise">
    Set the action to **Allow**, and move the policy above any general deny rules.
  </Step>

  <Step title="Save">
    Click **OK**, then save the configuration.
  </Step>
</Steps>

## Allow our domains in WebBlocker and DNSWatch

Our simulations use a set of domains that must pass WatchGuard's filtering.

<Tabs>
  <Tab title="WebBlocker">
    Go to **Subscription Services** then **WebBlocker**, edit your current policy, and add
    our [phishing domains](/whitelisting-values#domains) to the **Allowed
    Sites** list. Wildcards are recommended where the field supports them.
  </Tab>

  <Tab title="DNSWatch">
    Open **WatchGuard Cloud** then **DNSWatch**, go to **Policy Management** then **Allow
    List**, add each of our
    [phishing domains](/whitelisting-values#domains), and save the policy.
  </Tab>
</Tabs>

## Allow our sending domains in SpamBlocker

<Steps>
  <Step title="Open SpamBlocker">
    Go to **Subscription Services** then **SpamBlocker**, and select the email proxy
    service, usually SMTP.
  </Step>

  <Step title="Add the senders">
    Add our domains to the **Allowed Senders** list in the
    [sender address form](#sender-address-form) described below. Repeat for every domain.
  </Step>

  <Step title="Save">
    Click **Save** to apply the changes.
  </Step>
</Steps>

### Sender address form

SpamBlocker allows senders rather than domains, so take each entry from the
[full domain list](/whitelisting-values#domains) and enter it as an address with
a wildcard local part:

```
*@communicationmail.com
*@securemailinfo.com
*@com-mails.com
```

## Then what

**Have other security products enabled? Whitelist them now.**

| Product | Where to go |
| - | - |
| Microsoft 365: domain & IP whitelisting, Safe Links, Safe Attachments, web protection | [Microsoft 365](/whitelisting-microsoft-365) |
| Google Workspace: Direct Message Injection | [Google Workspace](/whitelisting-google-workspace) |
| Other gateways and firewalls: Barracuda, FortiNet, Vade | [Whitelisting](/whitelisting) |

Once everything that applies to your environment is whitelisted, send a test email from the
platform and confirm every interaction is recorded. See
[Testing your whitelisting](/whitelisting-testing).

On WatchGuard specifically, confirm that:

* Emails are delivered without quarantine or delay.
* Landing pages and links are not blocked by WebBlocker or DNSWatch.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.