A whitelist is a list of email addresses or senders you trust, and your email program checks it before filtering messages
When you whitelist an address, you are telling your email provider or email program: "I know this sender. Let their messages through, even if they look suspicious." Your email system has filters that catch spam and phishing — they look for things like unknown senders, odd links, or messages that match patterns of junk mail. A whitelist overrides those filters for the addresses you add to it.
The word "whitelist" comes from the opposite idea: a blacklist, which blocks known bad senders. A whitelist does the reverse. It says "these senders are safe" rather than "these senders are dangerous." When a message arrives from a whitelisted address, it skips the spam folder and lands in your inbox, even if the content would normally trigger a filter.
Key Takeaways
- Whitelisting tells your email system to trust a specific sender and deliver their messages to your inbox instead of spam or junk folders.
- The method for whitelisting differs by email provider — Gmail, Outlook, Yahoo, and Apple Mail each have their own steps and menu locations.
- Whitelisting an address does not make it safe to click unknown links or read attachments; it only affects where the message lands in your inbox.
- If a sender's address changes or is spoofed by a scammer, whitelisting the old address will not protect you from the fake version.
Where whitelists live in your email account
Most email providers let you whitelist addresses in two places: in your contacts or address book, and in your email filters or rules. Adding someone to your contacts is the simplest method — many systems treat your contacts as a de facto whitelist. When you save an address in your contacts, your email program learns to trust it.
The second method is through filters or rules. In Gmail, this lives under Settings > Filters and Blocked Addresses. In Outlook, it is Settings > Mail > Junk Email. In Yahoo Mail, it is Settings > Security and Privacy > Blocked Addresses. Each provider calls it something slightly different, but the function is the same: you create a rule that says "if the message comes from this address, put it in my inbox, not spam."
Some email programs also let you whitelist entire domains. If you whitelist @company.com, every message from anyone at that company will be treated as trusted. This is useful if you work with a large organization and do not want to add each person individually.
Why whitelisting alone is not enough protection
Whitelisting tells your email system to deliver a message, but it does not make the message safe to interact with. If you whitelist an address and then receive a message with a suspicious link or attachment, whitelisting does not protect you from clicking that link or opening that file. It only affects where the message appears in your inbox.
Scammers also spoof email addresses — they send messages that look like they come from a trusted sender, but the actual address is slightly different. If a real sender is john@company.com and a scammer sends from john@c0mpany.com (with a zero instead of the letter O), whitelisting the real address will not catch the fake one. You have to look at the actual sender address, not just the display name, to know whether a message is real.
The difference between whitelisting and marking as not spam
When you receive a message in your spam folder and click "not spam" or "report not spam," you are giving your email system feedback, but you are not creating a permanent whitelist entry. Marking a single message as not spam teaches your filter that this particular message should not have been caught, but it does not may provide that future messages from that sender will reach your inbox.
Whitelisting is permanent. Once you add an address to your whitelist or contacts, every future message from that sender will be treated as trusted. Marking one message as not spam is a one-time correction. If you want to may support a sender always reaches your inbox, whitelisting is the stronger choice.
How to whitelist an address in the most common email providers
Gmail: Open the message from the sender you want to whitelist. Click the three dots menu in the top right. Select "Add to Contacts." Gmail will now treat messages from this address as trusted. Alternatively, go to Settings > Filters and Blocked Addresses > Create a New Filter, enter the sender's address, and choose "Never send to spam."
Outlook (web and desktop): Right-click the message and select "Mark as not junk" or "Junk > Not Junk." To create a permanent rule, go to Settings > Mail > Junk Email > Safe Senders and add the address there. You can also add the sender to your contacts, and Outlook will treat them as safe.
Yahoo Mail: Click the message, then click the three dots menu. Select "Add to Contacts." You can also go to Settings > Security and Privacy > Blocked Addresses and use the "Safe Senders" section to add addresses you trust.
Apple Mail (iCloud): Add the sender to your Contacts app. Apple Mail treats your contacts as a whitelist. You can also create rules in Mail > Preferences > Rules, though this is less common for most users.
When whitelisting causes problems
Whitelisting can backfire if you whitelist an address that has been compromised. If a trusted contact's email account is hacked, messages from that account will still reach your inbox because you have whitelisted the address. The hacker can then send you phishing messages or malware from an address you trust.
For this reason, stay cautious even with whitelisted senders. If a message from a trusted address asks you to click a link, read a file, or share sensitive information in an unusual way, contact the sender through another method (a phone call, a text message, or a separate email) to confirm they actually sent it. Whitelisting means the message reached your inbox — it does not mean the message is legitimate.
Frequently Asked Questions
Can I whitelist an entire email domain instead of one address?
Yes. In Gmail, create a filter for messages from @domain.com and choose "Never send to spam." In Outlook, add @domain.com to your Safe Senders list. This is useful if you work with a large company and receive messages from many people there, but use it carefully — if the domain is compromised, all messages from that domain will reach your inbox.
If I whitelist someone, will they see that I did?
No. Whitelisting is a setting on your account only. The sender has no way to know whether you have whitelisted them. It does not send them a notification or change anything on their end.
What is the difference between whitelisting and unblocking?
Unblocking removes someone from your blocked or blacklist. Whitelisting adds someone to your trusted list. If you have blocked a sender, you must unblock them first. After that, you can whitelist them to may support their messages always reach your inbox.
Does whitelisting protect me from phishing emails?
No. Whitelisting only controls where a message lands in your inbox. It does not scan the message for phishing links or malware. Even whitelisted messages can contain phishing attempts, especially if the sender's account has been hacked. Always verify unusual requests by contacting the sender through another method.
Can I whitelist a sender on my phone?
Yes, but the steps vary by phone and email app. On iPhone with Apple Mail, add the sender to your Contacts. On Android with Gmail, open the message and tap the three dots, then "Add to Contacts." On both platforms, you can also access your email provider's website through a browser and whitelist from there.