ExchangeDefender Phishing Firewall Whitelist and Blacklist explained | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human June 12, 2019 · [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) ExchangeDefender Phishing Firewall Whitelist and Blacklist explained ==================================================================== ExchangeDefender Phishing Firewall goes online tomorrow, and we wanted to explain our policy and our implementation of the URL rewriting/redirection because it is a departure from a traditional IT hierarchy where organizational policies override group and user requirements. Our goal with ExchangeDefender PF is to provide a level of alert and notification to our clients that is designed to provide additional information about the link they clicked on. As we scale this service out, that will be it's purpose: **Be aware of what you clicked on, and prepare for what you're about to see.** Phishing, and spear phishing in particular, is designed to be a convincing fraudulent identity theft of an organization you know and trust (your bank, your coworker, your vendors) and our goal is to help you discern if something is valid or not. Our whitelist/blacklist implementation is in line with "we inform, you decide" mantra, as we cannot outright block you from actually going to the dangerous site. That is the responsibility of your IT department, your network management, and your organization. ### **How do Whitelists and Blacklists work?** In ExchangeDefender we have 4 sets of whitelists and blacklists: user, domain/organization, service provider, and global. Our global lists are automatically populated for our service providers and when they protect a domain with ExchangeDefender, those entries are applied on the domain/organization level, and further down to the end user. As we continue to monitor, manage, and get additional intelligence about dangerous sites we will continue to curate these lists as a part of the service. For example, we might find out that \*.vlad8150.microsoft.net is a Microsoft Azure instance that is attempting to spread malware. We will promptly add it to our global blacklist and that site will now be blacklisted for every ExchangeDefender user. When they click on a link that leads them to that domain, they will see the ExchangeDefender PF notice with the URL in red. User will then have the option of ignoring it and proceeding to the site, or adding it to their whitelist. If they whitelist a domain/web site, any future requests will bypass ExchangeDefender PF web site and automatically redirect to the target URL. The hierarchy of whitelists/blacklists is as follows, whichever rule is defined on the top is the one that is applied to the user when they click on a link. ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/06/Pyramid-Phishing-Firewall-1-1024x569.png) ### **But why, why not implement policies like NTFS, access list, or any other policy in which global deny rules override end user policies?** Simply put: Traffic blocking should be done on the network level. We are simply the alert service, we will advise you when we see something dangerous and it's up to you to discern if the site is trustworthy or not. We believe that this implementation will cause the least amount of interruption to the day-to-day use. That said, we have been working on additional controls and policies to help our service providers and CIO's better enforce company security policies. As with everything, security policies must be implemented in layers - and dangerous content should be enforced in accordance to business requirements. This means that if your clients should not be downloading .exe files, the network firewall should be doing that. We don't have the means to do that as an email service - users can right click on the email, put it in notepad, remove [https://r.xdref.com/url=](https://r.xdref.com/url=) from the link and go straight to the web site. ### **How do we manage them?** **ExchangeDefender PF whitelists are available at every level of ExchangeDefender.** Simply add a site to either a whitelist and blacklist and ExchangeDefender will automatically propagate your rules down through the entire organization. Users will have the ability to add / block sites from the ExchangeDefender PF in real-time and their settings will be preserved in their account only. ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/06/image-56-1024x761.png)Service Provider Level ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/06/image-57-1024x760.png)Domain Level P.S. Officially the service goes online tomorrow, unofficially it's been in place for months we just haven't rewritten a single URL except for the emails you received from us - we have worked very hard on the implementation and we don't expect major problems but will have staff on hand around the clock to address any issues immediately. Spear phishing is an epidemic, over 90% of compromises start with a link in an email. We will handle any glitches, bugs, and issues as fast as possible and have full confidence that having an alerting service with potential problems is far more useful than having nothing and leaving clients exposed. [ Previous post ExchangeDefender Phishing Firewall FAQ June 11, 2019 ](https://www-preview.exchangedefender.com/blog/2019/06/exchangedefender-phishing-firewall-faq) [ Next post New look for ExchangeDefender SPAM Release & Re-directions June 25, 2019 ](https://www-preview.exchangedefender.com/blog/2019/06/new-look-for-exchangedefender-spam-release-re-directions) Related Posts ------------- [ 1 May ](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live)### [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [Read more: ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2026/04/xd10.png) 2 Apr ](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10)### [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [Read more: Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/12/christmas-1.jpg) 25 Dec ](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas)### [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) [Read more: Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) Search the blog Search Recent Posts ------------ - [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) - [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) - [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) - [Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) - [Top 5 IT Problems Small Businesses Face in 2025 — and How to Fix Them](https://www-preview.exchangedefender.com/blog/2025/10/top-5-it-problems-small-businesses-face-in-2025-and-how-to-fix-them) Categories ---------- - [Archiving](https://www-preview.exchangedefender.com/blog?category=archiving) (21) - [Business Continuity](https://www-preview.exchangedefender.com/blog?category=business-continuity) (13) - [Compliance](https://www-preview.exchangedefender.com/blog?category=compliance) (8) - [ExchangeDefender](https://www-preview.exchangedefender.com/blog?category=exchangedefender) (349) - [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) (590) - [Hosted Services](https://www-preview.exchangedefender.com/blog?category=hosted-services) (86) - [Industry News](https://www-preview.exchangedefender.com/blog?category=industrynews) (29) - [Marketing](https://www-preview.exchangedefender.com/blog?category=marketing) (18) - [Phishing](https://www-preview.exchangedefender.com/blog?category=phishing) (5) - [PRO TIPS](https://www-preview.exchangedefender.com/blog?category=pro-tips) (44) - [Product Features](https://www-preview.exchangedefender.com/blog?category=product-features) (54) - [Security](https://www-preview.exchangedefender.com/blog?category=security) (65) - [Shockey Monkey](https://www-preview.exchangedefender.com/blog?category=shockey-monkey) (22) - [Spamfilter](https://www-preview.exchangedefender.com/blog?category=spamfilter) (5) - [Support](https://www-preview.exchangedefender.com/blog?category=support) (45) - [Webinars](https://www-preview.exchangedefender.com/blog?category=webinars) (44) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close