# Allow and block lists

URL: https://iblockspam.com/features/allow-block-lists
Last updated: 2026-10-09

> Approve or block senders for your domain, with sender verification so spoofed mail can't ride on an allow list entry. Best practices included.

Tell the filter which senders you trust and which you never want to hear from. Sender verification stops attackers from borrowing a trusted name.

## What the lists do

- **Approved (allow) list:** mail from these senders is treated as wanted.
- **Blocked list:** mail from these senders is treated as unwanted.

Lists are useful for fixing the filter's occasional mistakes. A supplier whose invoices keep getting held can be approved. A persistent marketer who ignores unsubscribe requests can be blocked.

## The problem with plain allow lists

An allow list entry says "trust mail from this address". But the sender address in an email is easy to forge. If you approve `accounts@yoursupplier.example` without any checks, an attacker can send a fake invoice "from" that address and it may skip filtering. That's exactly the kind of message you most need filtered.

### Sender verification

iBlockSpam lets approved and blocked sender entries **require sender verification**. With verification on, an approved entry only applies when the message authenticates as genuinely coming from that sender. Forged mail using the same address doesn't get the approval.

Authentication relies on standards the sender publishes in DNS:

| Standard | What it proves | Specification |
|---|---|---|
| SPF | The sending server is authorized to send for the domain | [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208) |
| DKIM | The message was signed by the domain and not altered | [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376) |
| DMARC | The visible From domain aligns with SPF or DKIM, and the domain's policy | [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) |

If a sender's own SPF or DKIM is misconfigured, verification may fail even for their genuine mail. You can check their setup with our [SPF Checker](https://iblockspam.com/tools/spf-checker), [DKIM Checker](https://iblockspam.com/tools/dkim-checker) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), then ask them to fix it.

## Best practices

### For approved senders

- **Prefer single addresses** over whole domains.
- **Turn on sender verification** for every approved entry unless you have a specific reason not to.
- **Never approve public mail domains** such as free webmail providers. Anyone can register an address there.
- **Never approve your own domain.** Attackers often spoof the recipient's own domain. Your own mail should pass on its own merits.
- **Review the list** a few times a year and remove suppliers you no longer work with.

### For blocked senders

- **Block what you're sure about.** A blocked entry stops mail you might one day want.
- **Don't try to block spam by hand.** Spammers change addresses constantly. Leave that to filtering, and use the block list for specific, persistent senders.
- **Block domains, not just addresses,** when a whole domain is clearly unwanted.

## Lists, quarantine and filters together

| Situation | Best tool |
|---|---|
| One legitimate message was held | Release it from the [quarantine](https://iblockspam.com/features/quarantine-and-digests) |
| The same trusted sender keeps being held | Approved entry with sender verification |
| One sender won't stop mailing you | Blocked entry |
| You never want a file type, such as executables | Attachment-type filter |
| You don't do business with certain countries | Geographic filter |

## Inspecting a message

If you're not sure why a message was treated a certain way, paste its headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). It runs in your browser, uploads nothing, and shows the SPF, DKIM and DMARC results recorded along the way.

## Related

- [Quarantine and digests](https://iblockspam.com/features/quarantine-and-digests)
- [All features](https://iblockspam.com/features)

## Frequently asked questions

### What is sender verification?

When an approved sender entry requires verification, mail claiming to come from that sender is only treated as approved if it passes authentication checks. This matters because the From address is easy to forge. Without verification, an attacker could send mail pretending to be a trusted supplier and skip filtering.

### Should I allow-list a whole domain or a single address?

Use the narrowest entry that solves the problem. A single address is safer than a whole domain. Never allow-list large public mail domains, because anyone can create an address there. Allow-list a domain only when you trust everything that domain sends.

### Why is a sender I allow-listed still being held?

If the entry requires sender verification and the message fails authentication, it isn't treated as approved. That's usually a problem with the sender's SPF or DKIM setup. Check their records with our SPF and DKIM checkers, and ask them to fix their configuration.

---

Source: iBlockSpam, https://iblockspam.com/features/allow-block-lists (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt