If Proofpoint Essentials or Proofpoint Enterprise filters your inbound email, allowlist Right-Hand Cybersecurity so your phishing simulation emails and training notifications reach your end users.
Before you begin
Get the IP addresses. Use the IP addresses and hostnames listed in Whitelisting best practices.
Identify your Proofpoint product. Proofpoint Essentials and Proofpoint Enterprise (Proofpoint Protection Server or Proofpoint on Demand) use different consoles. Follow only the section for your product.
Check your Proofpoint Enterprise version. Release 8.21 moved Attachment Defense settings to a new Message Defense page and renamed URL Defense to URL Rewrite. Where the steps differ, both locations are shown.
Scope exceptions to Right-Hand Cybersecurity's IP addresses wherever Proofpoint allows it. Sender domains and From addresses can be spoofed. Where a setting only accepts sender addresses, add only the exact addresses your templates use.
Don't use Proofpoint's built-in PSAT or CLEAR policy routes. Release 8.21 added these routes for Proofpoint's own Security Awareness Training and CLEAR services. They don't match Right-Hand Cybersecurity traffic, so create the custom policy route described below instead.
Important note: Menu names can vary slightly between Proofpoint versions. If a setting isn't where these steps describe, contact Proofpoint Support for its location in your console.
Whitelisting in Proofpoint Essentials
Whitelisting in Proofpoint Essentials
Add IPs to Safe Senders
Log in to your Proofpoint Essentials admin console.
Go to Security Settings > Email > Sender Lists.
In the Safe Senders section, add Right-Hand Cybersecurity's IP addresses.
Click Save.
Exclude simulations from Attachment Defense (attachment-based simulations)
Complete this step if your phishing simulation emails include attachments. The exception list is available only when Attachment Defense Sandboxing is enabled on your account.
Go to Security Settings > Malicious Content > Attachment Defense.
In the Safe senders setting, add the sender email addresses used by your phishing simulation templates.
Click Save.
Exclude simulations from URL Defense (if links are rewritten)
Complete this step if Proofpoint rewrites the links in your phishing simulation emails.
Go to Security Settings > Malicious Content > URL Defense.
Under Sender Exclusions, add the sender email addresses used by your phishing simulation templates.
Click Save.
Important note: Add only the exact sender addresses your templates use. In Proofpoint Essentials, these exceptions match on sender address rather than sending IP, so keep the list as short as possible.
Whitelisting in Proofpoint Enterprise
Whitelisting in Proofpoint Enterprise
Step 1: Add IPs to the Organizational Safe List (required)
The Organizational Safe List stops the Spam module from quarantining phishing simulation emails. It doesn't bypass Message Defense, Virus Protection, or anti-spoofing rules.
Log in to the Proofpoint Enterprise admin console.
Go to Email Protection > Spam Detection > Organizational Safe List.
Click Add.
In the Global Safe List window, add one entry per IP address:
Filter Type: Sender IP Address
Operator: Equals
Value: a Right-Hand Cybersecurity IP address
Click Save Changes.
To add a hostname instead of an IP address, set Filter Type to Sender Hostname.
Step 2: Add IPs to URL Rewrite exceptions (if used)
If you use Targeted Attack Protection (TAP) and links are rewritten, add Right-Hand Cybersecurity's IP addresses as exceptions.
Go to the URL rewrite policies for your version:
Release 8.21 and later: Email Protection > Targeted Attack Protection > URL Rewrite > URL Rewrite Policies
Earlier releases: Email Protection > Targeted Attack Protection > URL Defense > URL Rewrite Policies
Scroll to the Exceptions section.
Click Save Changes.
Policy route configuration
The Organizational Safe List only affects spam filtering. To stop other Proofpoint modules from blocking phishing simulation emails, tag Right-Hand Cybersecurity traffic with a policy route. Then exclude that route from each module that needs it.
Steps 3 and 4 are required. Step 5 is required if your simulations include attachments.
Step 3: Create a custom policy route (required)
This identifies phishing simulation emails by sender IP address.
Go to System > Policy Routes.
Click Add (or New Route) and set the Route ID to
Right-Hand_Phishing. Route IDs can't contain spaces.Add a condition:
Sender IP Address equals Right-Hand Cybersecurity's IP addresses
Click Save Changes.
Step 4: Add custom spam and phish rules (required)
These rules stop phishing simulation emails from being classified as spam or phishing.
Go to Email Protection > Spam Detection > Custom Rules, click Add Rule (or New Rule), and create two separate rules.
Rule 1: Right-Hand_Spam_Safelist
Condition:
Policy Route equals Right-Hand_PhishingDisposition:
Classify as Not Spam
Rule 2: Right-Hand_Phish_Safelist
Condition:
Policy Route equals Right-Hand_PhishingDisposition: Set the phish classifier score to
0
Important note: The exact label for the phish score disposition can vary by version. If you can't find it, contact Proofpoint Support.
Step 5: Exclude the route from Message Defense (required for attachment-based simulations)
This stops Targeted Attack Protection from sandboxing and quarantining simulation attachments, such as PDFs or ZIP files.
Release 8.21 and later
Go to Email Protection > Targeted Attack Protection > Message Defense > Settings.
Make sure Disable processing for selected policy routes is enabled.
Move
Right-Hand_Phishinginto the Disable For Any Of list.Click Save Changes.
Earlier releases
Complete the same steps under Email Protection > Targeted Attack Protection > Attachment Defense > Settings.
Note: If you set up this exclusion under Attachment Defense before upgrading to release 8.21, open Message Defense > Settings and confirm Right-Hand_Phishing is still in the Disable For Any Of list. Message Defense scans attachments, URLs, and message content, so excluding the route skips all of these checks for matching emails. This is why the policy route must match only Right-Hand Cybersecurity's IP addresses.
Step 6: Skip IP reputation (PDR) checks (recommended)
This skips IP reputation checks for phishing simulation emails, preventing blocks like 554 Blocked. Other security filters still apply.
Go to Email Protection > Spam Detection > Reputation Service > Settings.
Under Disable For Any Of, add
Right-Hand_Phishing.Click Save Changes.
If you already have a pdrsafe policy route, you can add Right-Hand Cybersecurity's IP addresses to it instead. Make sure pdrsafe is in the Disable For Any Of list.
Step 7: Exclude the route from traffic statistics feedback (recommended)
This stops phishing simulation traffic from being sent to Proofpoint as threat feedback.
Go to System > Settings > System > System Settings.
Under Enable Traffic Statistics Feedback to Proofpoint > Send Feedback From Agent Directly, add
Right-Hand_Phishingto Disable processing for selected policy routes.Click Save Changes.
Step 8: Bypass SMTP rate limiting (optional)
This prevents delivery delays when large campaigns are sent.
Go to Email Firewall > SMTP Rate Control > Non-throttled Hosts.
Click Save Changes.
Important note: If your console manages more than one server, apply this setting on each one.
Step 9: Bypass anti-spoofing (only if simulations use your own domain)
Complete this step only if phishing simulation emails are blocked because they use your organization's domain as the sender.
Go to Email Protection > Email Firewall > Rules and open the
pp_antispoofrule.Make sure Disable processing for selected policy routes is enabled.
Move
Right-Hand_Phishinginto the Disable For Any Of list.Click Save Changes.
Alternatively, add Right-Hand Cybersecurity's IP addresses to the existing pp_spoofsafe policy route.
Step 10: Allowlist in downstream filters (if used)
If email passes through another filter after Proofpoint, such as Microsoft 365, allowlist Right-Hand Cybersecurity there too. Downstream filters can still scan or block phishing simulation emails that Proofpoint has delivered.
For Microsoft 365, see How do I whitelist in Microsoft Exchange and Microsoft Defender?
If phishing simulation emails are still blocked
In the Proofpoint Enterprise admin console, use Smart Search to find a blocked phishing simulation email. Check its quarantine folder, the rule that triggered, and the policy routes it matched.
What you see | Likely cause | What to check |
| The route condition doesn't match the sending IP | Step 3 |
Quarantined in the Message Defense or Attachment Defense folder | The route isn't excluded from Message Defense | Step 5 |
Quarantined by a spam rule | Spam filtering | Steps 1 and 4 |
Rejected with | IP reputation (PDR) | Step 6 |
Triggered by | Anti-spoofing | Step 9 |
Quarantined by a Virus Protection rule | Antivirus scanning | Contact Proofpoint Support before excluding the route |
If these steps are unclear or don't match your console, contact Proofpoint Support for guidance specific to your setup.