Domain allowlist
Exclude your own and your partners' domains to stop false positives. How far a listed name reaches, and the API request format.
Domains on the allowlist stop coming up as threats in later scans. Use it for your other domains, your partners' domains, and lookalike domains you have checked and know are safe.
Setting it up
- Open Settings > Allowlist in the console
- Type the domain in the Add to allowlist box and click Add
Adding a domain stops later scans from flagging it. If it's already in the threat queue and you haven't confirmed it, the next scan that reaches it closes it. Items you've confirmed stay. To clear things now, use the queue's bulk actions.
How far a listed name reaches
A scan skips a domain when the allowlist has an entry for that exact name, or for its registrable domain (eTLD+1). An entry is saved exactly as you enter it.
| Name listed | Excluded from scans |
|---|---|
example.com | example.com and all of its subdomains |
safe.example.com | Only safe.example.com. Not example.com, not its sibling subdomains, and not subdomains below safe.example.com |
To exclude a whole domain, list the registrable domain. To exclude one host and nothing else, list that host.
You don't need to write *.. If you enter *.example.com, we remove the leading *. before saving, so it works the same as example.com (the domain and all its subdomains).
API
These are the same endpoints the console uses. They authenticate with your organization session and need the settings:view or settings:update permission.
List entries:
GET /api/v1/console/whitelist{ "domains": ["example.com", "partner.example"] }Add one entry:
POST /api/v1/console/whitelist{ "domain": "partner.example" }The only accepted keys are domain and an optional type. Any other key makes the whole request fail, because unknown fields are not allowed. To replace the whole list, send {"domains": [...]} to PUT /api/v1/console/whitelist.
Operational notes
- The API doesn't store why an entry was added. Record decisions other people need to know about somewhere else.
- Allowlisted domains never raise alerts. If you add a name an attacker has started using, it goes quiet, so check who holds a domain now before you add it.