How do I whitelist phishing sendouts in Mimecast?

If your organization uses Mimecast, you need to create five policies in the Mimecast Administration Console so that Holm Security phishing simulations and awareness training emails reach your recipients' inboxes. Without them, Mimecast may block, delay, rewrite or flag the emails, and the assessment cannot run as intended.

The policies are:

1. Permitted Senders: lets the sendouts past Mimecast's spam checks.
2. Greylisting: stops Mimecast from delaying the first delivery attempt.
3. Impersonation Protection Bypass: needed when simulations appear to come from people or domains inside your organization.
4. Anti-Spoofing: needed when simulations use your own domain as the sender.
5. URL Protection Bypass: stops Mimecast from rewriting or pre-scanning the links in simulation emails, which can register false clicks.

For the general whitelisting requirements that apply to all mail filters, see How do I whitelist assessment send-outs?

Before you start

• You need administrator access to the Mimecast Administration Console.
• Get the sender domains from Security Center. Open your assessment and look under the Phishing Sendout headline. Copy every domain listed under Domains to whitelist. You will enter these in every policy below.
• Always create new policies. Do not edit Mimecast's default policies, since that changes how all other mail is handled.
• Holm Security sends from the networks 185.163.84.0/22 (IPv4) and 2a0b:6800::/29 (IPv6). Also whitelist these in any web filter or proxy so recipients can reach the simulation landing pages.

Settings shared by all five policies

Each policy is created from Administration Toolbar > Gateway > Policies, then the policy type, then New Policy. Unless a policy below says otherwise, use these settings:

Section:	Option:	Setting:
Emails From	Addresses Based On	Both
Emails From	Applies From	Email Domain
Emails From	Specifically	The Holm Security domains from Domains to whitelist
Emails To	Applies To	Internal Addresses
Validity	All options	Leave as default

1. Create a Permitted Senders policy

1. Log in to the Mimecast Administration Console.
2. Go to Administration Toolbar > Gateway > Policies.
3. Select Permitted Senders, then New Policy.
4. Fill in the settings below, plus the shared settings above.
5. Save the policy.

Option:	Setting:
Policy Narrative	Holm Security Phishing Permitted Senders
Select Option	Permit Sender

2. Create a Greylisting policy

The Permitted Senders policy usually bypasses greylisting already. We still recommend a dedicated policy to avoid delivery delays.

1. Go to Administration Toolbar > Gateway > Policies.
2. Select Greylisting, then New Policy.
3. Fill in the settings below, plus the shared settings above.
4. Save the policy.

Option:	Setting:
Policy Narrative	Holm Security Phishing Greylisting
Select Option	Take no action

3. Create an Impersonation Protection Bypass policy

You only need this if your simulations appear to come from colleagues or domains inside your organization. It has two parts: a definition, and a bypass policy that uses it. If you already have an impersonation protection definition, skip to part B.

A. Create an impersonation protection definition

1. Go to Administration Toolbar > Gateway > Policies.
2. Select Impersonation Protection, then New Definition.
3. Fill in the settings below and save.

Section:	Option:	Setting:
Identifier Settings	Description	Holm Security Impersonation Protection Bypass Definition
Identifier Settings	Similar Internal Domain	Checked
Identifier Settings	Similarity Distance	1
Identifier Settings	Newly Observed Domain	Unchecked
Identifier Settings	Internal User Name	Checked
Identifier Settings	Reply-to Address Mismatch	Checked
Identifier Settings	Targeted Threat Dictionary	Checked
Identifier Settings	Mimecast Threat Directory	Checked
Identifier Settings	Custom Threat Directory	Leave as is
Identifier Settings	Number of Hits	2
Identifier Settings	Ignore Signed Messages	Unchecked
Identifier Actions	Action	None
Identifier Actions	Tag Message Body, Tag Subject, Tag Header	Unchecked
General Actions	Mark All Inbound Items as 'External'	Unchecked
Notifications	Notify Group	Leave as is
Notifications	Notify (Internal) Recipient, Notify Overseers	Unchecked

B. Create the bypass policy

1. Go to Administration Toolbar > Gateway > Policies.
2. Select Impersonation Protection Bypass, then New Policy.
3. Fill in the settings below, plus the shared settings above.
4. Save the policy.

Option	Setting
Policy Narrative	Holm Security Phishing Impersonation Protection Bypass
Select Option	The definition to bypass (use the one from part A if you have no other)

4. Create an Anti-Spoofing policy

You only need this if your simulations use your organization's own domain as the sender.

1. Go to Administration Toolbar > Gateway > Policies.
2. Select Anti-Spoofing, then New Policy.
3. Fill in the settings below, plus the shared settings above.
4. Save the policy.

Option:	Setting:
Policy Narrative	Holm Security Phishing Anti-Spoofing Allow
Select Option	Take no action
Emails To > Applies To	Everyone (this replaces Internal Addresses from the shared settings)

5. Create a URL Protection Bypass policy

Mimecast URL Protection scans and rewrites links when emails are delivered. On simulation emails this can trigger link checks that show up as clicks in your results.

1. Go to Administration Toolbar > Gateway > Policies.
2. Select URL Protection Bypass, then New Policy.
3. Fill in the settings below, plus the shared settings above.
4. Save the policy.

Option:	Setting:
Policy Narrative	Holm Security Phishing URL Protection Bypass
Select Option	Disable URL Protection