Whitelisting and Blacklisting Best Practices

An important tool in controlling incoming emails is the whitelisting and blacklisting setting in your dashboard.  

You can prevent future emails from spammers (blacklisting) or you can ensure that important and valued email arrives in your inbox (whitelisting).

Whitelisting and blacklisting are considered heavy handed tools which should be used sparingly. Incorrect blacklisting can inadvertently block important emails.  Whitelisting can allow forged emails to bypass our filters, no matter how spammy the email looks.

How They Work

Whitelisting 

Tells us that you would like all future emails to bypass our spam filters (we still will check for viruses and malware).  By whitelisting you are trusting that this sending domain or address is safe for the foreseeable future.  If that domain becomes compromised in the future your domain will also be vulnerable to these emails.

It's important to note that spammers count on major and popular domains being whitelisted. 

Blacklisting 

Tells us you no longer want to receive any mail from a domain or email address.  All future emails will be blocked and emails from that sender will be quarantined.  

Tips for safe Whitelisting

- Do not whitelist entire domains. Whitelist specific email addresses rather than the entire domain

- A domain-based whitelist isn't as secure as an IP address-based list, because domains can be spoofed.

- Do not whitelist major or popular domains.  No banks, merchants, credit card companies, mobile carriers,  Amazon or Microsoft (the two most often impersonated in the world)

- Ideally, whitelist by sending IP/Server AND the email address for a more secure method. 

- If you wish to whitelist a major and/or popular domain, you can whitelist the combination of IP/Server and domain in the Whitelist by IP/Server tab by adding the main domain and adding the main domain as the IP/Server. That will ensure email from that domain only comes from the block of servers.

- Review your whitelistings regularly and update/edit. When they pile up they can build gaps in email security.

- Review your user's whitelistings to ensure they're following safe practices

- If your domain or user has hundreds or thousands of whitelistings, they should all be reviewed and edited.  This causes a major conflict with safe and efficient mail flow for the user or domain by not allowing our filters to do their job.

Tips for effective Blacklisting

- Add a domain/IP/Server to your domain-wide or user blacklist setting. 

- In the case of bulk, opt-in marketing emails, which we consider 'ham', blacklisting will largely be ineffective.  In most cases blacklisting sending domains such as Amazonses or Mail Chimp will block other important emails from other services you regularly subscribe to.

• The sending email address changes with each opt-in marketing email making it impossible to blacklist
• Best method to no longer receive emails is to unsubscribe. Many opt-in mailings have safe and rigorous unsubscribe policies.

- Review your blacklistings regularly and update/edit. When they pile up they can build gaps in email security.

- Review your user's blacklistings to ensure they haven't inadvertently blacklisted an valid sender

- If your domain or user has hundreds or thousands of blacklistings, they should all be reviewed and edited.  This causes a major conflict with safe and efficient mail flow for the user or domain. 

Additional Whitelisting Security

As a result of the large volume of phishing emails and forgeries received from these domains, we no longer allow whitelisting of freemail domains such yahoo.com, gmail.com, hotmail.com.

You can still whitelist user@freemail.com but you will not be able to whitelist freemail.com

- whitelisting of major or popular domains is not permitted due to security concerns however you can still whitelist email users from such domains.  ????? Is this true?

Tips

• For false-positives in quarantine the best method is to 'Recover' rather than just whitelist the sender.  This will provide feedback for our Bayesian filters telling us it's not spam but legitimate mail.
•  If your domain has hundreds or thousands of whitelistings and blacklistings and you're experiencing high volumes of false-positives and/or forgeries, it might be wise to delete all entries and start over.  This will allow our filters to work as they were intended. 

*Ask our Support team if you would like a review of your current listings and make any security recommendations.  Contact support@mailroute.net.