Trusted Senders and Infrastructure

With the Trust lists, you can manually override trust levels of communication partners.

Trusted senders

xorlab Security Platform lets you adjust the trust level of individual senders and entire domains. This can be helpful to maintain a higher risk profile for certain senders while lowering the guard on others. To adjust trust levels, log in to XSP and navigate to Settings → Lists → Trust. Then add email addresses or individual email domains to one of the following lists:

Trust level	List name	Accepted entries
High	1. High trusted sender addresses 2. High trusted sender domains	1. Email addresses as `String` 2. Email domain as `String`
Medium	1. Medium trusted sender addresses 2. Medium trusted sender domains	1. Email addresses as `String` 2. Email domain as `String`
Low	1. Low trusted sender addresses 2. Low trusted sender domains	1. Email addresses as `String` 2. Email domain as `String`
Untrusted	1. Untrusted sender addresses 2. Untrusted sender domains	1. Email addresses as `String` 2. Email domain as `String`

SubdomainsWhen you specify a root (top-level) domain, e.g., example.com, all its subdomains will also be affected. When you enter a particular subdomain, e.g., site.example.com, only this subdomain will be affected, not any lower-level ones such as other.site.example.com.

The impact of including a sender in a particular list would be:

Untrusted: aggressive filtering, all detection rules apply
Low: very lenient filtering except for malware and BEC detection
Medium: very lenient filtering; some malware and BEC detection still applies
High: almost no filtering unless certain events occur (e.g., YARA rule match)

Please note that adding a sender to a trusted list overrides XSP mechanisms which decrease or increase the sender’s trust level with time based on communications.

Trusted infrastructure

Similar to adjusting the trust level for senders and/or their organizations above, you can let xorlab Security Platform know of trusted email infrastructure components. This can be helpful to mitigate the impact of misconfigurations in a sender’s SPF configuration. Use the lists below to add host names of trusted but non-verifiable mail transfer agents:

List name	Description	Accepted entries
1. MTA EHLO trust list (regex) 2. MTA RDNS trust list (regex)	Use these lists for known senders whose email infrastructure cannot be authenticated	Host names as `Regex`, e.g., `mta\.trusted\.org`

​Trusted senders

​Trusted infrastructure

Trusted senders

Trusted infrastructure