What is an email whitelist and how does whitel­ist­ing work?

An email whitelist is a list of senders or domains whose emails are auto­mat­ic­ally con­sidered trust­worthy and not blocked by spam filters. Whitel­ist­ing checks if the sender is on this list; if so, the message is delivered, even if it meets other filter criteria. This way, users can ensure that important emails are reliably received.

What is an email whitelist?

A whitelist is the opposite of a blacklist. Instead of blocking in­di­vidu­al senders, IP addresses, or domains, a passlist contains only entries that are ex­pli­citly allowed. These can include websites, programs, file ex­ten­sions, email addresses, or in­di­vidu­als. In short, everything is pro­hib­ited except what is listed.

How does an email whitelist work?

Such lists are commonly used in firewalls. Ad­min­is­trat­ors define which com­mu­nic­a­tion targets are permitted by adding them to an email whitelist, and only these are allowed through the firewall. All other con­nec­tions are blocked. A similar principle applies to securing in­di­vidu­al computers, where only approved ap­plic­a­tions can be installed via a whitelist.

In many cases, these lists also exclude certain file types — for example, files with the ex­ten­sions .docx, .xlsx, or .exe — ensuring they are blocked from being opened or installed. Whitel­ists are also used to manage email systems or enforce youth pro­tec­tion rules, where only specific IP addresses or domains are granted access.

From a technical per­spect­ive, two key data sets are par­tic­u­larly important in the delivery of emails:

• The MX record of a domain. MX stands for Mail Exchange and specifies which server is re­spons­ible for handling email for that domain.
• The (often hidden) in­form­a­tion in the email header, which makes it possible to trace an email’s path and check whether the stated sender actually matches the true sender. Spammers fre­quently ma­nip­u­late the From and Return-Path fields to create false iden­tit­ies.

What are the ad­vant­ages of whitel­ist­ing?

With email whitel­ists, ad­min­is­trat­ors can centrally manage per­mis­sions for user in­ter­ac­tions. This ensures both clarity and security when it comes to approved programs, web services, or senders. Content that is unsafe or not legally permitted is auto­mat­ic­ally filtered out and re­dir­ec­ted to des­ig­nated storage or quar­ant­ine. In this way, spam emails can be ef­fect­ively reduced. The key re­quire­ment is to clearly define which in­ter­ac­tions are permitted. The main advantage of this approach is that unknown senders, programs, or files cannot penetrate the protected system.

Re­cip­i­ents on an email whitelist will con­sist­ently receive messages from those senders. Emails from approved contacts skip the spam folder and are delivered straight to the inbox. In many cases, a small note within the message also prompts re­cip­i­ents to add the sender to their address book for ongoing reliable delivery.

How to create an email whitelist

When creating a passlist (whitelist), it’s important to consider several levels: internet service providers (ISPs), free or com­mer­cial email providers, and in­di­vidu­al users. Many email providers allow you to manage your own block­lists and passlists. Keep in mind that blacklist entries may override whitelist entries — both terms are still commonly used. To configure these settings, a customer account with the provider is usually required.

A well-known, provider-in­de­pend­ent option is DNSWL.ORG, a volunteer anti-spam coalition that offers a publicly ac­cess­ible free whitelist (with a query limit). If your domain is listed there, you receive detailed in­form­a­tion such as IP ranges and hostnames.

Among the most widely used paid repu­ta­tion and whitelist services in the UK and in­ter­na­tion­ally is Spamhaus, which works closely with major providers such as Gmail, Microsoft Outlook, and Yahoo to help improve email de­liv­er­ab­il­ity and reduce the risk of messages being flagged as spam. To be listed, you generally need to register and meet specific re­quire­ments, including:

• Re­spons­ible and re­spons­ive handling of abuse reports from your network
• Correct re­gis­tra­tion in the Whois directory
• A proven track record with minimal spam com­plaints

New entries are carefully reviewed using both public and private data sources. Past spam activity linked to a domain or IP address can neg­at­ively impact approval. Networks with open or public users are given lower trust ratings, while tightly managed networks can achieve higher levels. Each provider also defines its own removal criteria if issues arise.

In the UK, senders must also comply with the Privacy and Elec­tron­ic Com­mu­nic­a­tions Reg­u­la­tions (PECR) and UK GDPR, which set the legal standards for com­mer­cial email and data pro­tec­tion.

Guides for creating an email whitelist

Although the technical principle behind whitel­ists is es­sen­tially the same, the practical steps can differ from one provider to another. On mobile devices, the pro­ced­ures are usually very similar. In some cases, certain fields in the email client may be hidden by default, but these can typically be made visible through the settings or menu. On touch­screens, for example, tapping on the ‘From’ field will reveal the sender’s actual email address — without opening the message itself. Here’s a brief overview with simple steps:

Gmail

• Log into your Google account and open your inbox
• Hover the mouse pointer over the email sender; a pop-up window will open
• Select ‘Add to contacts’ (avatar with plus sign) in the window

Outlook for Microsoft 365 / Outlook 2019 and 2016

• Open the sender’s email that you want to add to the email whitelist
• Click the 3-dot icon
• Click on ‘Junk’ and then on ‘Never Block Sender’

Outlook 2013 / Outlook 2010

• Right-click on the email from the sender you want to whitelist in the message preview window.
• In the context menu, go to ‘Junk’.
• Select ‘Never Block Sender’ (or ‘Never Block Sender’s Domain’ to allow all emails from that domain).
• If you choose ‘Junk Email Options’, you can open the settings window to adjust the level of junk mail pro­tec­tion and manage both the Safe Senders List (whitelist) and Blocked Senders List (blacklist).

Thun­der­bird

In Thun­der­bird, you can create ad­di­tion­al address books beyond the default one — for example, an address book named Whitelist. Adding a sender to this list ensures their emails are treated as safe.

• Open the message from the sender you want to whitelist.
• Right-click on the sender’s email address.
• Select ‘Add to Address Book’.
• Confirm by clicking ‘OK’.

Yahoo Mail

• Open the message from the sender you want to whitelist.
• Hover over or click on the sender’s name in the ‘From’ field.
• In the pop-up window, click ‘Add to contacts’.
• Fill in any details if you wish, then click ‘Save’.

Apple Mail

• Open the email you want to whitelist in the preview.
• Hover over the sender’s name (the top entry in the email header) and open the drop-down menu.
• Click ‘Add to Contacts’ (or ‘Add to VIPs’ if you want messages from this sender to be high­lighted).
• Tip: In ‘Mail > Settings > Rules’, you can also create custom rules for specific email addresses to ensure those messages are always delivered to your inbox.

Create an email whitelist with a provider (IONOS)

With the IONOS email whitelist, you can make sure that messages from specific senders are always delivered in IONOS Webmail and never end up in the spam folder. To set this up, log in to your IONOS customer account and open the menu settings. Under the ‘Anti-SPAM’ settings, go to the ‘Safe Senders’ section and enter the email addresses or domains you want to whitelist. From then on, all emails from these senders will auto­mat­ic­ally be re­cog­nised as trust­worthy. Using the IONOS whitelist gives you full control over your email traffic, prevents important messages from being filtered out, and ensures reliable delivery.