Whitelisting Email Addresses & Domain Names for Exchange Online

Microsoft 365 contains multiple security features for email communication managed by Exchange Online. Sometimes you will need to whitelist a domain or email address to guarantee that important emails do not go in the Junk folder.

Note: Generally, you should not turn off or ignore security and threat protection, however, you can allow exceptions when to the Exchange spam filters to guarantee that important email will be delivered to your users. This article only covers making exceptions in Exchange Online. If you are using another Mail protection service such as Appriver or Barracuda, please consult with them to provide proper whitelisting documentation.

How-To Use Exchange Online Whitelisting

Microsoft 365 provides multiple email security features, like spam filters and phishing protection functionalities in Exchange Online.

Implemented in Exchange Online filters sometimes could mark emails from valid senders or online services as spam. To guarantee that important email messages will not be marked as spam and moved to the Junk folder you can bypass spam filters by whitelisting a specific domain or online service

Why whitelist domain in Office 365?
In general, you should not turn off or ignore security and threat protection but you can meet the situation when you need to bypass Exchange spam filters to guarantee that important email will be delivered to your users.

Login to the Microsoft 365 Admin portal
Select [Security] under the Admin Centers
Under [Email & Collaboration] section, select [Policies & rules].
In the main page, select [Threat policies].
Select [Anti-spam]
It takes about 20 to 30 seconds to load the policies. It will show "Loading" on the screen.
Select [Anti-spam inbound policy (Default)]
Scroll down to the bottom of the policy. Select [Edit allowed and blocked senders and domains].
Here you can either whitelist a domain or an email address. Under the Allowed section, select [Manage Sender] or [Manage Domain]

Manage Allowed Senders

In the Manage Sender section, it will show any existing email addresses that have been whitelisted.
Add your senders email address, then select [Add Senders] at the bottom of the page.
Select [Done] and exit.

Manage Allowed Domains

In the Manage allowed domains section, it will show any existing domains that have been whitelisted.
Add your senders domain, then select [Add domains] at the bottom of the page.

You never want to unblock a public domain such as gmail.com or outlook.com. For public domains, you only want to a specify the exact email address.
Select [Done] and exit.