The Free Pass Problem: Auditing the Addresses Your Filter Never Questions

Every spam filter has a soft spot. For most UK inboxes, it’s the allowlist: the safe-sender entries, approved domains and trusted-IP rules that tell the filter, “don’t worry, we know this one.” The trouble is that filters have very good memories. Someone once said “just let this through” during a busy Tuesday, and the system has been obeying ever since.

Allowlists are not inherently bad. They are a practical way to stop a fussy filter binning a supplier’s invoice or a colleague’s weekly report. But they are also policy decisions dressed up as settings. And like any policy, they rot quietly when nobody reviews them. At Spamdex, we think the allowlist deserves the same scrutiny as your DMARC record or your password manager — because it is one of the quiet backdoors into your inbox.

The allowlist is a policy, not a setting

When you add an address to a safe-sender list, you are not just helping one message. You are telling every downstream check to stand down for that sender, sometimes permanently. Depending on the platform, that can mean skipping spam scoring, bypassing quarantine, or ignoring authentication failures. In Microsoft 365, Google Workspace and most secure email gateways, allowlist entries can be surprisingly powerful.

The problem is ownership. A password policy has an owner. A firewall rule usually has a ticket. An allowlist entry often has a faint memory and a name nobody recognises. If your organisation has had staff turnover, supplier changes or a merger in the last few years, your allowlist is probably a small archaeological site.

Where these entries actually hide

Before you can audit anything, you need to find it. Allowlist entries tend to scatter across layers:

• Tenant-level allow lists in Microsoft 365 Defender or Exchange transport rules.
• Approved senders and domain allowlists in Google Workspace.
• Safe-sender lists in Outlook, Apple Mail or Thunderbird on individual machines.
• Shared mailbox rules that quietly move mail from a “trusted” address into the inbox.
• Gateway policies, IP allowlists and spam-filter overrides.
• Helpdesk tickets from 2022 that say “please whitelist this domain” and were never revisited.

Admin consoles are the easy part. Client-side safe-sender lists are the shadow IT of email trust: invisible to central reporting, copied from old machines and restored from backups. A quarterly reminder to staff is not glamorous, but it beats discovering that a departed employee’s personal address still has a free pass.

Build a ledger, not a list

A list tells you what is allowed. A ledger tells you why. For each entry, record the address or domain, the scope, the owner, the reason it was added, the date, an expiry date, the last review date and a bypass count.

If an entry has no owner, treat it as a ghost. Ghosts do not get renewed. If an entry has no reason beyond “it was blocking our invoices”, that is a reason to fix authentication or sender reputation, not to hand out a permanent pass.

The ledger can live in a spreadsheet or a ticketing system — the format matters less than the habit. The point is to make trust visible, reviewable and temporary.

Scope is where trust gets sloppy

A single address is a narrow promise. A whole domain is a much bigger one. If you allowlist supplier.co.uk, you are not just trusting the accounts payable mailbox. You are trusting every mailbox on that domain, including any that get compromised next month. If you use a wildcard, you may also be trusting subdomains you have never seen.

Overbroad entries are common because they are convenient. A supplier’s invoice keeps getting quarantined, so someone allowlists the domain and moves on. But domain-wide allowlists are exactly what a compromised supplier account needs. The attacker does not have to spoof the domain; they just log in and send from it. Your filter sees a trusted domain and waves the message through.

Where possible, allowlist specific addresses. Where you must allowlist a domain, document why and set a short expiry. Check whether the entry bypasses SPF, DKIM and DMARC checks entirely. Sometimes that is the intention. Often it is an accident waiting to happen.

Test the free pass

An allowlist entry is only as good as its scope. Test it with a mailbox you control, not a real supplier. Send a message from an allowed address and inspect the headers: did authentication still run? Did spam scoring still happen? Did the message land in the inbox because of the allowlist or because it was genuinely clean?

Then test the edges. Does a lookalike domain still get blocked? Does a display-name spoof from an unrelated address still get caught? Does a message from the allowed domain but with a suspicious link or attachment still get scanned? If the answer to any of these is “no”, you have found a hole.

Give every entry an expiry date

Trust should be rented, not owned. A one-off allowlist entry for a newsletter might need seven days. A supplier might need 12 months. A temporary project address might need 90 days. Whatever the period, put an expiry date in the ledger and set a calendar reminder to review it before it lapses.

Auto-expiry is better than a reminder if your platform supports it. If it does not, make the review part of a quarterly routine. An entry that nobody has needed for a year is not a safety net; it is clutter with a security clearance.

Log every bypass

Every time an allowlisted message gets through that would otherwise have been quarantined, log it. That log is your early-warning system. A sudden spike in bypasses from one supplier could mean a compromised account or a change in their sending infrastructure. A steady trickle from an old address could mean nobody has cleaned up the list since the last reorganisation.

Review the bypass log monthly. If an entry has produced zero bypasses in 12 months, remove it. If it has produced bypasses but no owner can explain them, remove it faster.

The supplier problem

Allowlisting a supplier does not make the supplier trustworthy. It just makes their mail more likely to reach you. In the UK, invoice fraud and supplier impersonation are familiar threats, and a compromised supplier mailbox is a particularly nasty variant because the domain checks out.

That is why allowlists should never replace out-of-band verification for payment changes, bank detail updates or urgent requests. If an allowlisted supplier emails to say their account has changed, call the number you already have. The free pass gets the message into the inbox; it does not get the message a clean bill of health.

A 30-minute quarterly routine

Export your allowlist entries. Sort by owner: blanks first. Flag any domain-wide entries, wildcards and entries with no expiry. Check the bypass log for surprises. Remove the ghosts. Reconfirm the rest with their owners. Test one entry’s scope.

It is not glamorous work, but it is the difference between an allowlist that helps your filter and one that quietly undermines it. Your inbox already has enough backdoors. Make this one deliberate.