# red-team agent's phishing test email got quarantined: allowlisting the test sender

## TL;DR
Mail gateways quarantine anything that looks like phishing, including your sanctioned test. Before the campaign, register the test sender domain and sending IPs in the gateway's allowlist, confirm the test domain passes SPF and DKIM, and send a probe message to prove inbox delivery. When the campaign ends, remove the allowlist entries.

```text
red-team agent's phishing test email got quarantined: allowlisting the test sender
```

## Use this when
- A sanctioned phishing test's emails land in quarantine instead of inboxes
- The red-team agent reports zero clicks and the cause is delivery, not the template
- You are setting up a new phishing simulation tool (gophish or similar)
- Test emails pass sometimes and get quarantined other times

## Not for this skill when
- You are responding to real phishing (that is incident response, a different skill)
- You are choosing a mail gateway product
- You are writing the phish email templates

## Steps
1. Check the quarantine reason in the gateway console and confirm the phishing filter (not a config error) caught the test.
   Expected: the console cites the filter name and rule, so you know what to allowlist against.
2. Add the test sender domain and sending IPs to the allowed-senders list in the mail gateway (Defender, Proofpoint, Google Workspace, or yours).
   Expected: the entries are visible in the allowlist.
3. Verify the test domain's SPF and DKIM alignment with a test message. Misaligned auth gets quarantined even when the sender is allowlisted.
   Expected: both SPF and DKIM pass on the probe.
4. Send a probe to a test mailbox and confirm it lands in the inbox, not quarantine.
   Expected: inbox delivery confirmed before the campaign starts.
5. Launch the campaign, and remove the allowlist entries when it ends.
   Expected: the campaign runs, then no lingering bypass remains.

### Variant: phishing simulation emails blocked by filter
Same fix. Also check whether the gateway has a dedicated phishing-simulation allowlist feature; several do, and it is cleaner than the generic allowed-senders list.

### Variant: gophish test emails quarantined
Gophish's default sending domain rarely passes auth checks. Put gophish behind a domain you control with proper SPF and DKIM, then allowlist that domain.

### Variant: allowlist phishing test in Microsoft Defender
Use Defender's advanced delivery policy for phishing simulation: it allowlists the test while keeping the rest of filtering intact, and it scopes the bypass to the campaign dates.

## Why this happens
Gateways cannot tell a sanctioned test from a real phish without the allowlist entry, and most simulation setups fail authentication checks on top of that. The quarantine is the gateway doing its job; the missing piece is the coordination step before the campaign.

## Edge cases and pitfalls
- Allowlist entries are a real mail-flow bypass: time-box them to the campaign and remove them after, every time.
- Some gateways take 15 minutes or more to apply allowlist changes; do not launch the moment you save.
- Users clicking the report-phishing button on test mails is fine; that is data, not a problem.
- Get written authorization for the test scope before anything sends; an unannounced phish is indistinguishable from a real attack to everyone else.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_4Rjbnr3lKPExJWIs6jT7Tw