Proofpoint allowlisting instructions

Follow the steps below to allow NINJIO training messages and PHISH3D simulations through Proofpoint.

Before you begin: Open the NINJIO Allowlisting Guide. Use it for the current NINJIO SMTP IP addresses and domains referenced below.

Important: Proofpoint Essentials and Proofpoint Enterprise use different administration consoles and policy models. Complete the section that matches your Proofpoint product. Do not create broad sender-domain or global security bypasses.

Proofpoint Essentials

1. Add NINJIO to the Organization Allowlist

1. Sign in to the Proofpoint Essentials administrator portal.
2. Go to Security Settings > Email > Allowlist.
   • In the legacy interface, go to Security Settings > Email > Sender Lists and use the Safe Sender list.
3. Confirm you are editing the Organization allowlist, not an individual user or group list.
4. Add each current NINJIO SMTP IP address from the NINJIO Allowlisting Guide.
   • If the field requires CIDR notation, enter each address as an individual /32 range.
5. Save the changes.

2. Exclude NINJIO URLs from URL Defense

1. Go to Security Settings > Malicious Content > URL Defense.
2. Locate the URL Defense exception or safelist settings.
3. Under Exclude URLs that contain specified domains/IP addresses, add the current NINJIO domains from the NINJIO Allowlisting Guide.
4. Save the configuration.

3. Allow attachment-based simulations

1. Open the Proofpoint controls for Attachment Defense.
2. If your tenant provides an Attachment Defense Safe Sender List, add the current NINJIO SMTP IP addresses.
3. Review any customer-created attachment filters and exclude NINJIO test traffic where needed.
4. Save the configuration.

Note: Some executable, script, malware, or prohibited file-type controls cannot be bypassed. If Proofpoint blocks a simulation attachment at one of these controls, use a supported PHISH3D attachment type or contact Proofpoint Support.

4. Configure the downstream email platform

Proofpoint allowlisting does not automatically bypass protections in Microsoft 365, Exchange, or Google Workspace. Complete the applicable downstream configuration in the NINJIO Allowlisting Guide.

If Proofpoint Essentials is integrated with Microsoft 365 through Proofpoint's MX integration, retain the Proofpoint-created connector and bypass rule unless your Proofpoint administrator directs otherwise.

5. Test the configuration

1. Allow several minutes for the changes to take effect.
2. Send a test to one or two authorized recipients.
3. Confirm the message reaches the Inbox.
4. Confirm PHISH3D links are not rewritten and click tracking behaves correctly.
5. Confirm attachment-based simulations arrive as expected.
6. Review the Proofpoint message log and verify the Organization Allowlist and applicable security exceptions matched.

Proofpoint Enterprise / Email Protection

1. Add NINJIO to the Organizational Safe List

1. Sign in to the Proofpoint Enterprise Admin Console.
2. Go to Email Protection.
3. Under Spam Detection, select Organizational Safe List.
4. Select Add.
5. Create an entry for each current NINJIO SMTP IP address using the sender-IP or sender-host filter available in your Proofpoint version.
6. Save the changes.

If your tenant requires CIDR notation, enter each NINJIO SMTP IP address as an individual /32 range. Do not substitute a broad domain allowlist if your version uses a different sender-IP field.

2. Configure URL Defense exceptions

1. Go to Email Protection > Targeted Attack Protection > URL Defense.
2. Open URL Rewrite Policies.
3. Open the applicable inbound rewrite policy and its Exceptions.
4. Add the current NINJIO SMTP IP addresses if your tenant supports source-IP exceptions.
5. Add the current NINJIO PHISH3D landing domains from the NINJIO Allowlisting Guide.
6. Save the changes.

3. Allow attachment and impersonation simulations

1. Review the Proofpoint message details for any NINJIO simulation that is modified, tagged, held, or quarantined.
2. Identify the specific Attachment Defense, impersonation, warning-banner, or related rule that acted on the message.
3. Create the narrowest supported exception using the current NINJIO SMTP IP addresses and the applicable internal recipients.
4. Save the changes.

Proofpoint Enterprise controls and entitlements vary by deployment. If your console does not provide a narrowly scoped exception for the control acting on the message, contact Proofpoint Support rather than disabling the control globally.

4. Configure the downstream email platform

Complete the applicable Microsoft 365, Exchange, or Google Workspace configuration in the NINJIO Allowlisting Guide.

5. Test the configuration

1. Send a test to one or two authorized recipients.
2. Confirm the message reaches the Inbox.
3. Confirm PHISH3D links remain unmodified and click tracking behaves correctly.
4. Confirm attachment-based simulations arrive as expected.
5. Review the Proofpoint message log, sender-list match, URL Defense status, and other applied controls.

Troubleshooting

• Sender allowlist does not match: Confirm Proofpoint sees the original NINJIO connecting IP and check for conflicting user or group Blocklist entries or custom filters.
• Message is still quarantined or rejected: Identify the Proofpoint module that acted on the message and review DNS authentication, attachment, impersonation, malware, and other security results.
• Links are rewritten or pre-clicked: Confirm the destination is included in the URL Defense exception and check downstream Microsoft Defender Safe Links or other security scanners.
• Attachments are removed or blocked: Check whether Attachment Defense, anti-virus, a prohibited extension, or a custom filter caused the action.

Anti-spoofing failures

Do not add a broad anti-spoofing exception as part of the standard allowlisting configuration. If Proofpoint quarantines NINJIO mail for SPF, DKIM, or DMARC, preserve the original message headers and Proofpoint log details, verify the sender against the current NINJIO Allowlisting Guide, and contact NINJIO Support if needed.