NINJIO phishing simulations mimic real-world threats. As email providers strengthen their security controls, even authorized simulations may be blocked, throttled, or rejected.
Allowlisting and verification are required before NINJIO phishing campaigns can run , helping ensure reliable delivery and the full benefit of your NINJIO subscription.
NINJIO now requires all phishing customers to complete an allowlisting confirmation test before campaigns can run. This helps prevent delivery failures and unreliable results.
What to do: Complete the required setup, then follow “How do I confirm allowlisting?” to unlock your campaigns.
How do I confirm allowlisting?
Have IT complete the applicable allowlisting requirements for your email environment. For Microsoft 365 SMTP delivery, include the required Partner Connector.
Select Send Test Email, open the email, click its verification link, and select Confirm.
Once confirmed, your phishing campaigns automatically unlock, and previously started campaigns resume.
Why did my phishing campaigns work before?
NINJIO introduced a new verification requirement for all phishing customers, including those whose campaigns previously worked.
What to do: Review your existing configuration, then follow “How do I confirm allowlisting?” to unlock your campaigns.
Does passing the confirmation test guarantee delivery?
No. The test confirms that an email was received and verified, but cannot validate every employee's mailbox or future delivery. It's an important first step that automatically unlocks your phishing campaigns .
What to do: Follow “How do I confirm allowlisting?” to unlock campaigns, then monitor delivery results.
We already configured allowlisting. Why are campaigns still on hold?
Your account may not have completed the required confirmation, or NINJIO may have detected delivery failures and automatically placed your campaigns on hold again.
What to do: Review “How do I confirm allowlisting?” and have IT revisit your configuration. For Microsoft 365, verify Part B: Configure the Exchange Online Partner Connector. NINJIO notifies account Super Administrators when qualifying delivery failures are detected.
I sent a test email but never received it. What happens next?
NINJIO will attempt delivery again through an alternative sending path. If it still doesn't arrive, your email security provider may be blocking it.
What to do: Have IT check spam, quarantine, and message traces. Microsoft 365 customers should also verify the Partner Connector. Contact NINJIO Support if unresolved.
Why was my campaign automatically placed on hold, and can it happen again?
NINJIO monitors delivery failures and may automatically hold affected campaigns when certain failures are detected, particularly Microsoft 365 throttling.
Notifications: We notify your account's Super Administrators when qualifying failures are detected.
What to do: Follow the notification and revisit allowlisting. Microsoft 365 customers should verify the Partner Connector.
Microsoft 365 & Email Throttling
Why is Microsoft 365 throttling NINJIO phishing emails?
Microsoft applies automated IP-based throttling that can delay or reject authorized simulations, sometimes returning 451 4.7.500 — Server busy. Please try again later. (ASxxx) .
This can indicate Microsoft's anti-spam throttling ( graylisting ), rather than an overloaded server. Repeated delays may eventually result in failed delivery.
What to do: Configure the Microsoft Partner Connector to help address these restrictions.
What if we use Proofpoint, Mimecast, Barracuda, or another security gateway?
These systems may block simulations before they reach Microsoft 365 or Google Workspace. The Microsoft Partner Connector does not bypass third-party gateways.
Our security standards prohibit allowlisting. We cannot make these exceptions. What are our options?
We understand that your security policies may restrict exceptions. If Microsoft 365 is both your receiving email gateway and Exchange Online destination, the Microsoft Partner Connector is critical for reliable SMTP-based phishing delivery. Microsoft also provides an Advanced Delivery policy for authorized simulations.
A reduced configuration may be possible, but can limit phishing simulation functionality or delivery reliability. Direct Message Injection (DMI) is another option that reduces reliance on SMTP.
We only use NINJIO training. Should we allowlist it?
Yes, we recommend it. Training emails continue as usual and are not subject to phishing campaign holds. Allowlisting helps reduce spam filtering and improves delivery reliability.
What to do: Ask IT to review allowlisting for NINJIO training emails. You do not need to complete the full phishing-specific allowlisting or confirmation process if you only use training.
Direct Message Injection (DMI)
What is Direct Message Injection (DMI)?
DMI uses email-provider APIs to create authorized phishing simulations directly in employee mailboxes, bypassing traditional SMTP delivery and associated IP throttling.
What to do: Contact NINJIO to learn whether DMI is available for your organization.
Is DMI available for Google Workspace and Microsoft 365?
NINJIO supports Google Workspace DMI and is introducing Microsoft 365 DMI through Early Access . Both require email administrator authorization.
What to do: For Google Workspace, follow the Google DMI setup instructions (Part A). For Microsoft 365 Early Access, contact NINJIO about eligibility and authorization requirements.
If we configure DMI, do we still need allowlisting?
Yes. DMI reduces reliance on SMTP, but other protections, such as URL filtering and browser security, can still interfere with simulations. Allowlisting also supports alternative delivery paths when needed.
What to do: Maintain applicable allowlisting alongside DMI and follow “How do I confirm allowlisting?” to complete NINJIO verification.
Delivery Reliability & Support
Does allowlisting guarantee delivery?
No. Receiving email providers ultimately control message acceptance and inbox placement. Allowlisting and the Microsoft Partner Connector improve reliability but cannot guarantee delivery.
What to do: Keep your configuration current and investigate any delivery failures reported by NINJIO.
Can NINJIO configure allowlisting for us?
No. These settings require administrative access to your organization's email security environment.
What to do: Follow our documentation or contact NINJIO Support . We can help guide your IT team through the requirements.
Who maintains allowlisting, and how often should it be reviewed?
Your IT or email security administrator maintains the configuration. Review it whenever NINJIO updates requirements, security policies change, or delivery problems occur.
What to do: Designate an IT owner and respond to delivery notifications sent to your NINJIO Super Administrators.
Need assistance? Contact NINJIO Support . Our team can help guide your IT administrators through the requirements.
Comments
0 comments
Article is closed for comments.