Safe sender and blocked sender lists FAQ
Applies to: Exchange Online, Exchange Online Protection
Topic Last Modified: 2015-06-08
This topic provides frequently asked questions and answers about safe sender and blocked sender lists. Answers are applicable for Microsoft Exchange Online and Exchange Online Protection customers.
Q. What is a safe sender list?
A. An email safe sender list, or safe list for short, is a list of contacts who are considered safe senders and whose messages therefore do not need to be spam filtered by the service.
Q. What is a blocked sender list?
A. An email blocked sender list is a list of contacts who are considered unsafe senders and whose messages are blocked by the service.
Q. How can I include a sender in a safe sender or a blocked sender list?
A. There are several options available:
Connection filter: If you know the IP address from which the user is sending messages, you can add their IP address to a connection filter IP Allow list or an IP Block list. For more information about how to do this, see Configure the connection filter policy. This topic also describes how you can create an Exchange Transport rule to specify a CIDR range that falls outside of the recommended range (/32 to /24), and how you can create a Transport rule to create an IP Allow list exception for a specific domain.
For more spam settings that apply to the whole organization, take a look at How to help ensure that a message isn't marked as spam or Block email spam with the Office 365 spam filter to prevent false negative issues. These are helpful if you have administrator-level control and you want to prevent false positives or false negatives.
Spam filter block lists and allow lists: You can also add sender addresses or domains to a Block list or Allow list in a spam filter policy:
Allows messages through and bypasses spam filtering for specific domains or for specific sender addresses.
Mark as spam messages sent from specific domains or from specific sender addresses.
Tip: Adding an IP to an IP allow list or an IP block list by using the connection filter is typically preferred to adding a sender or domain to a spam filter block list or allow list since sender addresses and domains can be spoofed. Also, an IP added to an IP allow list or an IP block list will skip filtering or be blocked, regardless if the sender or domain is on a spam filter block list or allow list.
For more information, see Configure your spam filter policies.
Microsoft Outlook and Outlook Web App (OWA): End users can add specific users or domains to a safe sender list or a blocked sender list by configuring their junk email settings. Note that messages that are sent from blocked senders are marked as spam, not rejected, meaning that they can be retrieved from the Junk Email folder or quarantine (depending on your configuration.) For more information, see the following links:
If your company has existing user accounts in an on-premises Active Directory environment, you can synchronize the account information to the service. For example, when you run directory synchronization, any safe sender or blocked sender lists created and managed using Outlook or OWA are propagated to the service. By using the directory synchronization tool, the service uses your user’s safe sender list or blocked sender lists the same way as if they were being managed directly on-premises. What this means is that messages sent from Outlook or OWA synced safe senders will pass through the service without being spam filtered, whereas messages sent from synced blocked senders will be marked as spam. Note that it may take up to 3 hours for any changes to your synced safe or blocked senders lists to take effect. For more information about setting up directory synchronization, see “Use directory synchronization to manage mail users” in Manage mail users in EOP.
If your company is configuring safe sender or blocked sender lists using Outlook or OWA in conjunction with Exchange Online, any updates to your user’s lists are automatically picked up and implemented by the service.