> ## Documentation Index
> Fetch the complete documentation index at: https://oximy.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Email allowlisting

> What a mail administrator needs to allow so Oximy sign-in codes and activation emails reach employees.

If your organization uses a secure email gateway, allow Oximy's sending domains
before you invite employees. Enterprise gateways hold back mail from senders they
have not seen before, regardless of how well that mail is authenticated — and
sign-in codes are time-sensitive enough that a short quarantine usually expires
them.

This page is written for a mail administrator and can be forwarded as-is.

## What to allow

| What                               | Value                          |
| ---------------------------------- | ------------------------------ |
| Product email sender domain        | `notifications.oximy.com`      |
| Authentication email sender domain | `clkmail.oximy.com`            |
| Envelope / return path             | `send.notifications.oximy.com` |
| SPF include (product mail)         | `include:amazonses.com`        |
| Sign-in and account links          | `accounts.oximy.com`           |
| Employee workspace links           | `*.oximysidekick.com`          |
| Brand and image host               | `oximy.com`                    |

All of these sit under the organizational domain **`oximy.com`**, which
publishes:

* **SPF** and **DKIM** on every sending subdomain
* **DMARC** at `p=reject` (100%) — we ask providers to reject anything that
  fails authentication while claiming to be us
* **BIMI** with a GlobalSign **Verified Mark Certificate**, so supporting clients
  can display our verified logo

Allowlisting by **domain with DMARC alignment** is preferred over allowlisting by
IP address. Our sending IPs are provider-managed and change; the domains do not.

***

## Mail that Oximy sends

| Message                   | Sender                    | Trigger                               |
| ------------------------- | ------------------------- | ------------------------------------- |
| Sign-in verification code | `clkmail.oximy.com`       | A user signs in                       |
| Password reset code       | `clkmail.oximy.com`       | A user requests a reset               |
| Workspace invitation      | `clkmail.oximy.com`       | An admin invites someone              |
| Sidekick activation       | `notifications.oximy.com` | An admin provisions an employee login |
| Added to workspace        | `notifications.oximy.com` | A user joins an organization          |
| Policy and usage alerts   | `notifications.oximy.com` | A configured alert fires              |
| Billing notices           | `notifications.oximy.com` | A payment event occurs                |

Auth mail is time-sensitive: a verification code that is quarantined for review
has usually expired by the time it is released.

***

## Per-vendor steps

### Proofpoint

1. Open **Security Settings → Email → Safe/Blocked Senders** (or the Firewall
   rules in Proofpoint on Demand).
2. Add `notifications.oximy.com` and `clkmail.oximy.com` as **safe sender
   domains**.
3. In **Targeted Attack Protection → URL Defense**, add `oximy.com` and
   `sidekick.oximy.com` to the URL rewrite exception list. Without this, the
   activation link is rewritten and sandboxed, which can consume the single-use
   token before the employee ever clicks it.
4. If **Impostor/Business Email Compromise** classification is aggressive, add
   the two sender domains to the exception list — first-contact senders are a
   common false positive.

> URL Defense is the step most often missed. Symptom: the employee reports the
> activation link says it is invalid or already used, on their first click.

### Mimecast

1. **Administration → Gateway → Policies → Permitted Senders**.
2. Create a policy with **Source Domain** `notifications.oximy.com`, applied to
   all internal recipients. Repeat for `clkmail.oximy.com`.
3. **Administration → Gateway → Policies → URL Protection Bypass** — add
   `oximy.com` and `oximysidekick.com` so activation links are not rewritten.
4. Check **Managed Senders** for any pre-existing block on these domains.

> Prefer a Permitted Senders policy over an Auto-Allow entry: Auto-Allow is
> reputation-derived and can be re-evaluated away.

### Google Workspace

1. **Admin console → Apps → Google Workspace → Gmail → Spam, phishing and
   malware**.
2. Under **Allowlisted senders**, add `notifications.oximy.com` and
   `clkmail.oximy.com`.
3. Check **Spoofing and authentication**. If *"Protect against inbound emails
   spoofing your domain"* is enabled and Oximy sends on your behalf from a
   subdomain, add an exception — this setting can quarantine correctly
   authenticated subdomain mail.
4. Optionally add the domains to **Bypass spam filters for senders**.

### Microsoft 365 / Exchange Online

1. **Microsoft Defender portal → Policies & rules → Threat policies →
   Anti-spam → Connection filter / Allowed senders**.
2. Add `notifications.oximy.com` and `clkmail.oximy.com` to the allowed domains.
3. Better still, create a **Tenant Allow/Block List** entry for the two domains —
   allowlists there are honoured more consistently than anti-spam policy entries.
4. **Safe Links** — add `oximy.com` and `oximysidekick.com` to the "Do not
   rewrite the following URLs" list, for the same reason as Proofpoint URL
   Defense.

> Microsoft Defender is the most common cause of missing verification codes. If
> allowlisting is not possible, verification **codes** deliver more reliably than
> magic **links**.

***

## Verifying it worked

Ask the administrator to release any quarantined Oximy mail first — a
quarantined message can otherwise keep the sender's reputation suppressed.

Then, from the Oximy dashboard, re-send an activation to one real employee and
confirm it lands in the inbox rather than Junk. In the received message, use
**Show original** (Gmail) or **View message source** (Outlook) and confirm:

```
spf=pass       ... smtp.mailfrom=send.notifications.oximy.com
dkim=pass      ... header.d=notifications.oximy.com
dmarc=pass     ... header.from=notifications.oximy.com
```

All three should read `pass`. If they do and the message still lands in Junk,
the cause is gateway policy rather than authentication — revisit the steps
above.

***

## Troubleshooting

| Symptom                                                      | Likely cause                                                                                                   |
| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| Activation link says invalid or already used, on first click | Gateway URL rewriting consumed the single-use token. Add the URL Defense / Safe Links / URL Protection bypass. |
| Verification codes arrive minutes late                       | Google Workspace pre-delivery scanning adds roughly four minutes. Expected; not a fault.                       |
| Some employees get mail, others do not                       | Per-user quarantine or group-scoped policy. Confirm the allowlist applies to all internal recipients.          |
| Nothing arrives at all                                       | Check the gateway's quarantine and reject logs for the sender domains before assuming the mail was never sent. |

If mail is still not arriving after these steps, contact `support@oximy.com`
with the message ID from the gateway log and we will trace it from our side.