---
title: How do I safelist in Avanan?
description: This article details the steps necessary to setup safelisting in Avanan for both Microsoft 365 and Google Workspace clients.
---

[Skip to content](https://support.hooksecurity.co/how-do-i-safelist-in-avanan#main-content)

English

Show submenu for translations

[Submit a Ticket](https://support.hooksecurity.co/kb-tickets/new?hsLang=en) [Customer Portal](https://support.hooksecurity.co/tickets-view?hsLang=en)

[![Hook\_Logo (3)](https://support.hooksecurity.co/hs-fs/hubfs/Hook_Logo%20(3).png?width=150&height=113&name=Hook_Logo%20(3).png)](https://www.hooksecurity.co/welcome)

- [Tickets](https://6535385.hs-sites.com/tickets-view)
- [Sign out](https://6535385.hs-sites.com/_hcms/mem/logout)

Open main navigation

Close main navigation

- [Tickets](https://6535385.hs-sites.com/tickets-view)
- [Sign out](https://6535385.hs-sites.com/_hcms/mem/logout)
- English
  
  Show submenu for translations
- [Submit a Ticket](https://support.hooksecurity.co/kb-tickets/new)
- [Customer Portal](https://support.hooksecurity.co/tickets-view)
- [Account created in 2026 or later? Go to the Knowledge Base →](https://docs.hooksecurity.co/docs)

[Account created in 2026 or later? Go to the Knowledge Base →](https://docs.hooksecurity.co/docs)

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [Help Center](https://support.hooksecurity.co/?hsLang=en)
2. [Getting Started](https://support.hooksecurity.co/getting-started?hsLang=en)
3. [Firewall/Spam Filter Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#firewall-spam-filter-safelisting)

# How do I safelist in Avanan?

## This article details the steps necessary to setup safelisting in Avanan for both Microsoft 365 and Google Workspace clients.

#### Microsoft 365

For phishing emails to be delivered successfully, a header must be added to mail coming from PhishingBox IP's. This header will inform Avanan that the incoming mail is safe to be delivered to the inbox. Follow the steps below to create this mail flow rule in Exchange Admin Center:

1. Navigate to **[admin.exchange.microsoft.com](https://admin.exchange.microsoft.com/) \> Mail flow \> Rules**
2. Click the ![](https://support.phishingbox.com/hc/article_attachments/20315521270420) button and select "Create a new rule"
3. In the new rule pop-up, input the following: 
     - **Name:** Input an appropriate name like "PhishingBox Avanan Safelisting"
     - **Apply this rule if**: "The sender" | "IP address is any of these ranges or exactly matches" 
           - In the "specify IP address ranges" pop-up, input the PhishingBox's mail IP's: 
                   - US Clients: 
                             - 64.191.166.196 (Phishing Mail) and click "Add"
                             - 64.191.166.197 (Training Mail) and click "Add"
                   - EU Clients 
                             - 64.238.34.10 (Phishing Mail) and click "Add"
                             - 64.238.34.11 (Phishing Mail) and click "Add"
                             - 64.191.166.197 (Training Mail) and click "Add"
           - Click "Save
     - **Do the following**: "Modify the message properties" | "set a message header"  
           - Click the first "Enter text" link
           - Input "X-CLOUD-SEC-AV-Info" and click "Save"
           - Click the second "Enter text" link and input "{portalname},office365\_emails,inline" (replace {portalname} with the name of your Avanan portal) and click "Save"
           - ![](https://support.phishingbox.com/hc/article_attachments/20315567152276)
           - 1. Click "Next"
                   2. Set "Rule Mode" to **Enforce**
                   3. Check the **Stop processing more rules** box
                   4. Click "Next"
                   5. Click "Finish" and then "Done"
                   6. Click the check box for the new rule and click "Edit"
                   7. Click the "Settings" tab
                   8. Change the priority so that its above the "Avanan - Protect" mail flow rule
             
             #### Google Workspace
             
             To ensure phishing email delivery, you must modify the existing Avanan content compliance rule and create one new rule. Below are the steps to achieve this:
             
             #### Modify Existing Rule
             
                   1. Navigate to **admin.google.com \> Apps \> Google Workspace \> Gmail**
                   2. Expand the **Compliance** section
                   3. In the **Content compliance** section, click "Edit" on your existing Avanan rule
                   4. In the pop-up, click "Edit" on the expression under step 2
                   5. Modify the expression fields to the following: 
                              1. **Metadata** match
                              2. **Attribute**: Source IP
                              3. **Match Type**: Source IP is **not** within the following range: 64.191.166.192/28
                                 
                                 > NOTE: EU clients will need to add two expressions that use the same settings above but with these two IP ranges: 64.191.166.192/28 and 64.238.34.8/30
                   6. Click "Save"
             
             #### Create New Rule
             
                   1. Navigate to **admin.google.com \> Apps \> Google Workspace \> Gmail**
                   2. Expand the **Compliance** section
                   3. Click "Configure" or "Add another rule" in the **Content compliance** section
                   4. In the "Add setting" pop-up, input the following settings: 
                              1. **Content Compliance**: Input an appropriate name like "PhishingBox Avanan Safelisting"
                              2. **Email messages to affect**: Inbound
                              3. **Add expression that describe the content you want to search for in each message**: 
                                           1. **If ALL of the following match the message** 
                                                          1. **Expressions**: 
                                                                           1. **Metadata match**
                                                                           2. **Attribute**: Source IP
                                                                           3. **Match type**: Source IP is within the following range: 64.191.166.192/28
                                                                              
                                                                              > NOTE: EU clients will need to add two expressions that use the same settings above but with these two IP ranges: 64.191.166.192/28 and 64.238.34.8/30
                              4. **If the above expressions match, do the following**: 
                                           1. **Modify message**: 
                                                          1. **Headers**: Add custom headers  
                                                                           1. **Header key**: "CLOUD-SEC-AV-Info"
                                                                           2. **Header value**: "{portalname},google\_mail,inline" (replace {portalname} with the name of your Avanan portal)
                                                                           3. Click "Save"
                   5. Click "Save"

- [Getting Started](https://support.hooksecurity.co/getting-started?hsLang=en#main-content)

    - [General](https://support.hooksecurity.co/getting-started?hsLang=en#general)
    - [General Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#general-safelisting)
    - [Microsoft Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#microsoft-safelisting)
    - [GSuite Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#gsuite-safelisting)
    - [Firewall/Spam Filter Safelisting](https://support.hooksecurity.co/getting-started?hsLang=en#firewall-spam-filter-safelisting)
    - [Creating Groups/Adding Targets](https://support.hooksecurity.co/getting-started?hsLang=en#creating-groups-adding-targets)
    - [Reporting Plug-In](https://support.hooksecurity.co/getting-started?hsLang=en#reporting-plug-in)
    - [3rd Party Integrations](https://support.hooksecurity.co/getting-started?hsLang=en#3rd-party-integrations)
    - [Platform Settings](https://support.hooksecurity.co/getting-started?hsLang=en#platform-settings)
- [Hook Academy](https://support.hooksecurity.co/hook-academy?hsLang=en#main-content)

    - [Campaign Ideas](https://support.hooksecurity.co/hook-academy?hsLang=en#campaign-ideas)
    - [Industry Specific Campaigns](https://support.hooksecurity.co/hook-academy?hsLang=en#industry-specific-campaigns)
    - [Course Reviews](https://support.hooksecurity.co/hook-academy?hsLang=en#course-reviews)
    - [Mastering Reporting](https://support.hooksecurity.co/hook-academy?hsLang=en#mastering-reporting)
    - [Becoming Compliant](https://support.hooksecurity.co/hook-academy?hsLang=en#becoming-compliant)
    - [Suggest a Hook Academy Topic](https://support.hooksecurity.co/hook-academy?hsLang=en#suggest-a-hook-academy-topic)
- [Tests/Campaigns](https://support.hooksecurity.co/tests-campaigns?hsLang=en#main-content)

    - [Reseller Only](https://support.hooksecurity.co/tests-campaigns?hsLang=en#reseller-only)
- [School](https://support.hooksecurity.co/school?hsLang=en#main-content)

    - [3rd Party Integrations](https://support.hooksecurity.co/school?hsLang=en#3rd-party-integrations)
    - [Troubleshooting](https://support.hooksecurity.co/school?hsLang=en#troubleshooting)
    - [Branding](https://support.hooksecurity.co/school?hsLang=en#branding)
    - [Course](https://support.hooksecurity.co/school?hsLang=en#course)
    - [Students](https://support.hooksecurity.co/school?hsLang=en#students)
    - [Automations](https://support.hooksecurity.co/school?hsLang=en#automations)
- [Reports](https://support.hooksecurity.co/reports?hsLang=en#main-content)

    - [Generate Reports](https://support.hooksecurity.co/reports?hsLang=en#generate-reports)
- [FAQs](https://support.hooksecurity.co/faqs?hsLang=en#main-content)

    - [Troubleshooting](https://support.hooksecurity.co/faqs?hsLang=en#troubleshooting)
    - [Campaign of the Month](https://support.hooksecurity.co/faqs?hsLang=en#campaign-of-the-month)
- [Reseller Guide](https://support.hooksecurity.co/reseller-guide?hsLang=en)
- [Hook Security Updates](https://support.hooksecurity.co/hook-security-updates?hsLang=en)
- [Onboarding Guides](https://support.hooksecurity.co/onboarding-guides?hsLang=en)
- [Managed Services](https://support.hooksecurity.co/managed-services?hsLang=en)

- [Default HubSpot Blog](https://hooksecurity-6535385.hs-sites.com/blog)

[![Newsletter\_Logo-08](https://support.hooksecurity.co/hs-fs/hubfs/Newsletter_Logo-08.png?width=250&height=59&name=Newsletter_Logo-08.png "Newsletter_Logo-08")](http://hooksecurity.co)

Proudly Headquartered in Lakeland, Floirda

<https://www.linkedin.com/company/hooksecurity>

Copyright © 2026, Hook Security Inc.