Whitelisting tells your email program to trust a sender and deliver their messages to your inbox

When you whitelist an email address, you are creating an exception in your email filter that says "always let mail from this sender through, even if it looks suspicious." Instead of landing in spam or a junk folder, whitelisted messages go straight to your inbox. The term comes from the idea of a "white list" of approved senders — the opposite of a blacklist, which blocks people.

Whitelisting is not the same as unblocking. When you unblock an address, you are removing a rule that was actively rejecting it. When you whitelist, you are adding a rule that actively accepts it. Some email programs use the terms interchangeably, but the mechanics are different. Unblocking stops the rejection; whitelisting starts the acceptance.

The reason you need to whitelist is that spam filters work by pattern-matching. A legitimate email might look suspicious because of its formatting, the links it contains, or the sender's domain reputation. Whitelisting overrides that pattern-matching for one specific sender and tells the filter: "I know this person. Deliver their mail."

Key Takeaways

  • Whitelisting adds a sender to a trusted list so their emails bypass spam filters and land in your inbox.
  • The method for whitelisting differs by email program — Gmail, Outlook, Yahoo, and Apple Mail each have their own steps.
  • Whitelisting only affects mail from that one address, so if a sender uses multiple addresses, you may need to whitelist each one separately.
  • Whitelisting does not prevent a sender from spoofing their address, so only whitelist addresses you actually recognize and trust.

How whitelisting works in the most common email programs

In Gmail, whitelisting happens through the filter system. You open an email from the sender you want to trust, click the three-dot menu, select "Create filter," and then check the box that says "Never send to spam." Gmail then routes all future mail from that address to your inbox, bypassing the spam folder entirely.

In Outlook (both the desktop program and Outlook.com), you can add a sender to your Safe Senders list. Right-click the email, choose "Junk," then "Never Junk." Outlook also lets you add senders to a contacts group called Safe Senders, which has the same effect. Mail from anyone in that group will not be filtered as spam.

In Apple Mail, whitelisting is less direct. You can mark an email as "Not Junk," which trains the filter over time, but there is no formal whitelist. A more reliable method is to add the sender to your Contacts app — Apple Mail treats mail from your contacts more favorably than mail from strangers.

In Yahoo Mail, you can add a sender to your Contacts, which prevents their mail from going to spam. You can also use the filter system to create a rule that sends mail from a specific address directly to your inbox. Both methods work, though adding to Contacts is the simplest route.

Why a sender's email might land in spam even if you know them

Spam filters look at many signals: the sender's domain reputation, whether the email contains shortened links, the ratio of images to text, and whether the message matches patterns known to be used by scammers. A legitimate business email can trigger these filters if the company uses a new domain, sends a lot of images, or includes a link to a third-party service.

Another common reason is that the sender's email account has been compromised. If a hacker sends mail from a trusted contact's address, the filter may flag it as suspicious because the sending server or location looks wrong. Whitelisting the address does not protect you from this — you should still check the content of the email before clicking links or downloading attachments.

Some email providers also filter based on authentication standards like SPF, DKIM, and DMARC. If a sender's domain does not have these set up correctly, their mail may be filtered even if the content is legitimate. Whitelisting overrides this check, but it is a sign that the sender's email setup needs attention.

The difference between whitelisting and marking as "not spam"

When you mark a single email as "not spam" or "not junk," you are telling your email program that this one message was filtered incorrectly. Most programs use this feedback to adjust their filter for future mail from that sender, but the adjustment is gradual and not may provide. Marking one email as not spam does not create a permanent rule.

Whitelisting, by contrast, creates a permanent rule that applies to all future mail from that sender. It is a stronger signal than marking one email. If you find yourself repeatedly marking emails from the same sender as not spam, whitelisting is the more efficient solution.

Some email programs blur this distinction. Gmail's "Never send to spam" filter is technically a rule, but it works similarly to marking multiple emails as not spam. The result is the same — future mail from that sender goes to your inbox — but the mechanism is slightly different.

What to do if whitelisting does not work

If you have whitelisted an address and mail from that sender still lands in spam, the first step is to check whether the sender is using a different email address. Many organizations send from multiple addresses — a support team might use support@company.com while billing uses billing@company.com. You would need to whitelist each address separately.

The second step is to verify that the whitelist rule was actually created. Go back to your email program's filter or safe sender settings and confirm the address is listed. Sometimes the rule is created but not activated, or it was created with a typo in the address.

If the rule exists and the address is correct, contact the sender and ask them to check their email setup. They may need to configure SPF, DKIM, or DMARC records, or they may be sending from a server that your email provider blocks at a higher level. Whitelisting can override some blocks but not all of them.

Security considerations when whitelisting

Whitelisting is safe when you whitelist addresses you recognize and trust. However, email addresses can be spoofed — a scammer can send mail that appears to come from someone you know. Before whitelisting an address, especially for a business or financial institution, verify that it is the real address by checking the company's official website or calling them directly.

If you receive an email from a trusted contact asking you to whitelist a new address, be cautious. Contact the person through another method — a phone call or a separate email — to confirm they actually sent that request. Scammers sometimes compromise email accounts and use them to trick contacts into whitelisting malicious addresses.

Whitelisting does not make you vulnerable to malware or viruses just by itself. The risk comes from clicking links or downloading attachments in whitelisted emails. Treat whitelisted mail the same way you treat any email — do not click links from unexpected senders, and do not read attachments unless you were expecting them.

Frequently Asked Questions

If I whitelist someone, can they see that I did?

No. Whitelisting is a setting on your email account only. The sender has no way of knowing whether you have whitelisted them. They will only know if their mail stops going to your spam folder and you start responding to it.

Do I need to whitelist both the sender's address and their domain?

Most email programs let you whitelist either an individual address or an entire domain. Whitelisting the domain (for example, @company.com) will whitelist all addresses from that company. Whitelisting a single address is more selective and is usually the safer choice unless you trust everyone at that organization.

What happens if I whitelist someone and then they send me spam?

You can remove them from your whitelist at any time. Go back to your email program's filter or safe sender settings, find the address, and delete the rule. Future mail from that sender will be filtered normally again. You can also mark individual emails from them as spam to train your filter.

Can I whitelist an email address on my phone?

Yes, but the steps vary by phone and email app. On an iPhone using Apple Mail, add the sender to your Contacts. On an Android phone using Gmail, open an email from the sender, tap the three-dot menu, and select "Create filter" or "Mark as important." Check your specific app's help section for exact steps.

If I whitelist a sender, will their emails bypass all security checks?

Whitelisting bypasses spam filtering but not all security checks. Your email provider may still scan whitelisted mail for viruses or malware. However, whitelisting does mean the mail will not be rejected based on sender reputation or domain authentication, so it is important to only whitelist addresses you actually trust.