Email whitelisting guide

Overview

HumanSignal (a Secure Halo product) sends authorized security-awareness exercises — simulated phishing emails, training reminders and related notifications — on behalf of your organization. These messages are legitimate and are delivered so that your people can practice recognizing real threats.

Use this guide to make sure messages from the platform reach the inbox instead of the junk or quarantine folder. The sending identity and IP address shown above are the current values; the platform may change the sending IP over time, so re-check this page when delivery issues persist.

What uniquely identifies our mail

Give your mail-filtering products one or more of these stable identifiers rather than keyword or subject-based rules.

1. Sending domain: fairlyoffensive.com — all From addresses and Return-Path values end in this domain.
2. Sending IP address: 47.206.86.54 — all outbound mail is transmitted from this address.
3. Links in messages point at https://fairlyoffensive.com/ so clicks can be tracked and reported per recipient.
4. Authentication: SPF (v=spf1 ip4:47.206.86.54 ~all for fairlyoffensive.com), DKIM (signed with the platform selector under _domainkey of fairlyoffensive.com) and DMARC are published and enforced.
5. Human-readable From name: HumanSignal or your organization’s branded name; the Reply-To/From address always ends in @fairlyoffensive.com.

Microsoft 365 / Outlook / Exchange Online

For Microsoft 365 tenants (Exchange Online Protection), allow the sender domain and the sending IP so the platform’s messages bypass spam classification for authenticated mail.

1. Open the Microsoft 365 Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Anti-spam.
2. Edit the default Anti-spam inbound policy (or your organizational policy). Expand “Allow lists” and add fairlyoffensive.com to the Allowed domains and the address 47.206.86.54 as an Allowed IP address.
3. Confirm the policy applies to all recipients (or to the users receiving exercises). Save.
4. Optionally add fairlyoffensive.com to recipients’ Safe Senders in Outlook: Settings → Mail → Junk email → Safe senders and domains → Add.
5. If a connection filter policy is in use, add 47.206.86.54 to its IP allow list as a secondary control.

Google Workspace / Gmail

Gmail has no per-user allowlist for senders; the most effective path is to keep authentication passing and to tune Workspace’s spam controls at the tenant level.

1. In the Google Admin console go to Apps → Google Workspace → Gmail → Spam.
2. Under “Approved senders”, add fairlyoffensive.com so messages from the domain bypass spam filtering for all users.
3. Confirm SPF and DKIM pass for the domain; Gmail trusts properly authenticated mail.
4. For individual users, have them open one exercise message and click “Report not spam”, or add fairlyoffensive.com to Gmail Contacts so the address is treated as a frequent sender.

Yahoo / AOL

Yahoo and AOL rely on sender reputation and authentication; there is no per-domain allowlist.

1. Keep SPF and DKIM passing (already published for fairlyoffensive.com).
2. When a user first receives an exercise, have them move it from Spam to Inbox and click “Not Spam”; subsequent messages will be delivered normally.

Third-party and on-premises gateways

For appliances such as Barracuda, Proofpoint, Mimecast, SpamAssassin, or self-hosted Postfix/Exchange, add the sending identity to the product’s allow/whitelist settings.

1. Add the domain fairlyoffensive.com to the sender/domain allow list.
2. Add the IP address 47.206.86.54 to the IP allow list (note: use the /32 exactly, not a broader range).
3. If the gateway performs link rewriting, exempt https://fairlyoffensive.com/ so per-recipient tracking links are not rewritten.
4. Ensure quarantines are checked for the delivery window of each exercise; do not apply delivery delay or throttle policies to 47.206.86.54.

What to do if an exercise message is still missing

1. Check the recipients’ Junk Email, Spam, and the gateway’s quarantine for the delivery time of the campaign.
2. Confirm the recipient’s email address is active, valid, and covered by an authorized domain in the platform before re-running.
3. Confirm that the From domain shown in the platform is fairlyoffensive.com (or another verified phishing domain you configured) and that its SPF/DKIM/DMARC are current.
4. If everything above checks out, contact support@fairlyoffensive.com and reference the platform notification email you received.