> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Trusted Senders and Infrastructure

> Raise or lower the detection for certain senders and their sending infrastructure, independently of learned reputation.

With the **Trust** lists, you can manually override trust levels of communication partners.

## Trusted senders

xorlab Security Platform lets you adjust the trust level of individual senders and entire domains. This can be helpful to maintain a higher risk profile for certain senders while lowering the guard on others.

To adjust trust levels, log in to xorlab and navigate to **Settings → Lists → Trust**. Then add email addresses or individual email domains to one of the following lists:

| Trust level | List name                                                                        | Accepted entries                                                |
| :---------- | :------------------------------------------------------------------------------- | :-------------------------------------------------------------- |
| High        | 1. **High trusted sender addresses**<br />2. **High trusted sender domains**     | 1. Email addresses as `String`<br />2. Email domain as `String` |
| Medium      | 1. **Medium trusted sender addresses**<br />2. **Medium trusted sender domains** | 1. Email addresses as `String`<br />2. Email domain as `String` |
| Low         | 1. **Low trusted sender addresses**<br />2. **Low trusted sender domains**       | 1. Email addresses as `String`<br />2. Email domain as `String` |
| Untrusted   | 1. **Untrusted sender addresses**<br />2. **Untrusted sender domains**           | 1. Email addresses as `String`<br />2. Email domain as `String` |

<Warning>
  **Subdomains**

  When you specify a root (top-level) domain, e.g., `example.com`, all its subdomains will also be affected. When you enter a particular subdomain, e.g., `site.example.com`, only this subdomain will be affected, not any lower-level ones such as `other.site.example.com`.
</Warning>

<Info>
  How much filtering each trust level still applies is documented in
  [Detection Defaults → Trust level filtering impact](/latest/detection-defaults#trust-level-filtering-impact).
  Access to that page is restricted.
</Info>

Please note that adding a sender to a trusted list overrides xorlab mechanisms which decrease or increase the sender’s trust level with time based on communications.

## Trusted infrastructure

Similar to adjusting the trust level for [senders and/or their organizations](#trusted-senders) above, you can let xorlab Security Platform know of trusted email infrastructure components. This can be helpful to mitigate the impact of misconfigurations in a sender’s SPF configuration.

Use the lists below to add host names of trusted but non-verifiable mail transfer agents:

| List name                                                                  | Description                                                                          | Accepted entries                                 |
| :------------------------------------------------------------------------- | :----------------------------------------------------------------------------------- | :----------------------------------------------- |
| 1. **MTA EHLO trust list (regex)**<br />2. **MTA RDNS trust list (regex)** | Use these lists for known senders whose email infrastructure cannot be authenticated | Host names as `Regex`, e.g., `mta\.trusted\.org` |