Building an Allowlist for Trusted Domains, Emails, and IP Ranges

No scoring system is perfect, and sometimes you know a sender is legitimate — your own staff, a partner company, an internal monitoring service. The allowlist is Spamify’s explicit override: anything on it skips the checks and goes straight through.

Three kinds of allowlist entry

• Domains — allow everyone at a trusted domain (e.g. your company’s own domain, or a partner’s). Useful for internal forms and B2B sites.
• Exact email addresses — allow one specific person without opening their whole domain. Good for a single known contact.
• IP addresses and CIDR ranges — allow submissions from a trusted network. CIDR notation (e.g. 203.0.113.0/24) lets you allow a whole block in one entry.

Why an allowlist matters

Two scenarios make it essential:

1. Rescuing false positives. If a legitimate sender keeps getting flagged — say a partner on a shared IP that’s tripping rate limits — allowlisting them ends the problem immediately without loosening your rules for everyone else.
2. Protecting internal traffic. Staff testing a form, or an internal service submitting data, shouldn’t be scored like anonymous public traffic.

Use it sparingly and specifically

The allowlist is powerful precisely because it bypasses your defenses — so keep it tight:

• Prefer exact addresses over whole domains when you only trust one person.
• Never allowlist a public webmail domain (like a generic free-email provider) — you’d be waving through every spammer using it.
• Use the narrowest CIDR range that covers your trusted network, not a broad block.

Think of the allowlist as the counterpart to your thresholds: thresholds decide the gray area, the allowlist removes all doubt for the senders you already trust.