Safe sender allowlisting risks

Overview

Allow lists bypass helpful filtering—attackers abuse compromised trusted senders.

Policy

Require VP+ approval for domain allow; time-box 90 days default; review renewals.

Alternatives

Fix underlying DKIM/SPF at marketing SaaS instead of blanket allow.

Monitoring

Alert on first-time EXE from allowlisted marketing domain.

Audit

Quarterly dump of transport exceptions from Exchange/Defender admin.