What the lists do
- Approved (allow) list: mail from these senders is treated as wanted.
- Blocked list: mail from these senders is treated as unwanted.
Lists are useful for fixing the filter's occasional mistakes. A supplier whose invoices keep getting held can be approved. A persistent marketer who ignores unsubscribe requests can be blocked.
The problem with plain allow lists
An allow list entry says "trust mail from this address". But the sender address in an email is easy to forge. If you approve accounts@yoursupplier.example without any checks, an attacker can send a fake invoice "from" that address and it may skip filtering. That's exactly the kind of message you most need filtered.
Sender verification
iBlockSpam lets approved and blocked sender entries require sender verification. With verification on, an approved entry only applies when the message authenticates as genuinely coming from that sender. Forged mail using the same address doesn't get the approval.
Authentication relies on standards the sender publishes in DNS:
| Standard | What it proves | Specification |
|---|---|---|
| SPF | The sending server is authorized to send for the domain | RFC 7208 |
| DKIM | The message was signed by the domain and not altered | RFC 6376 |
| DMARC | The visible From domain aligns with SPF or DKIM, and the domain's policy | RFC 9989 |
If a sender's own SPF or DKIM is misconfigured, verification may fail even for their genuine mail. You can check their setup with our SPF Checker, DKIM Checker and DMARC Checker, then ask them to fix it.
Best practices
For approved senders
- Prefer single addresses over whole domains.
- Turn on sender verification for every approved entry unless you have a specific reason not to.
- Never approve public mail domains such as free webmail providers. Anyone can register an address there.
- Never approve your own domain. Attackers often spoof the recipient's own domain. Your own mail should pass on its own merits.
- Review the list a few times a year and remove suppliers you no longer work with.
For blocked senders
- Block what you're sure about. A blocked entry stops mail you might one day want.
- Don't try to block spam by hand. Spammers change addresses constantly. Leave that to filtering, and use the block list for specific, persistent senders.
- Block domains, not just addresses, when a whole domain is clearly unwanted.
Lists, quarantine and filters together
| Situation | Best tool |
|---|---|
| One legitimate message was held | Release it from the quarantine |
| The same trusted sender keeps being held | Approved entry with sender verification |
| One sender won't stop mailing you | Blocked entry |
| You never want a file type, such as executables | Attachment-type filter |
| You don't do business with certain countries | Geographic filter |
Inspecting a message
If you're not sure why a message was treated a certain way, paste its headers into our Email Header Analyzer. It runs in your browser, uploads nothing, and shows the SPF, DKIM and DMARC results recorded along the way.
Related
Frequently asked questions
What is sender verification?
When an approved sender entry requires verification, mail claiming to come from that sender is only treated as approved if it passes authentication checks. This matters because the From address is easy to forge. Without verification, an attacker could send mail pretending to be a trusted supplier and skip filtering.
Should I allow-list a whole domain or a single address?
Use the narrowest entry that solves the problem. A single address is safer than a whole domain. Never allow-list large public mail domains, because anyone can create an address there. Allow-list a domain only when you trust everything that domain sends.
Why is a sender I allow-listed still being held?
If the entry requires sender verification and the message fails authentication, it isn't treated as approved. That's usually a problem with the sender's SPF or DKIM setup. Check their records with our SPF and DKIM checkers, and ask them to fix their configuration.
Related guides
How do you safely whitelist a sender in Microsoft 365 and Google Workspace?
Safely allow (whitelist) a sender in Microsoft 365 and Google Workspace without opening a spoofing hole: Tenant Allow/Block List, approved senders and gateways.
9 min read Running email day to dayLegitimate email flagged as spam: why false positives happen and how to fix them safely
Why real business email gets quarantined or junked, how to release it safely, and how to allowlist senders without opening a door for spoofed mail.
8 min read Phishing & threatsWhat is email spoofing?
Email spoofing explained: display-name, exact-domain and lookalike spoofing with examples, what SPF, DKIM and DMARC catch, and how to spot a spoofed email.
9 min readLast updated: