Understanding the Risky allow-list policies detected risk

BarracudaONE displays this risk when it detects, through Barracuda Email Gateway Defense, that one or more commonly abused email domains are included in allow-list policies. This configuration bypasses email filtering controls and exposes your organization to impersonation attempts, domain spoofing, malware delivery, and unwanted email.

The included domains are:

• intuit.com

• docusign.net

• adobesign.net

• amazon.com

• dropbox.com

• mailchimp.com

• microsoft.com

• netsuite.com

• quickbooks.com

• sf-notifications.com

• sharepointonline.com

• ukg.com

• zoom.us

Adding commonly abused domains to an allow-list policy means that emails appearing to come from those domains bypass normal email security filtering. Attackers commonly spoof legitimate-looking domains to impersonate trusted services. When these domains are allow-listed, malicious emails are not filtered and can reach users' inboxes, increasing the risk of:

• Phishing attacks—Emails designed to steal credentials or sensitive information by impersonating legitimate services.

• Business Email Compromise (BEC)—Spoofed requests that appear to come from trusted organizations.

• Malware delivery—Malicious attachments or links disguised as legitimate communications.

• Domain spoofing—Attackers can send emails that appear to originate from trusted domains without proper authentication.

• Credential theft—Fake login pages designed to capture usernames and passwords.

Allow-listing broadly used domains significantly weakens your email protection and creates an exploitable gap in your security posture.

To help you identify the policies affected, BarracudaONE displays:

• the number of policies containing unsafe domains

• the names of policies with the risk

• the types of policies with the risk (Account-level, Domain-level, or User-level)

• the specific domains that are allow-listed

Resolving this risk involves reviewing and removing unsafe domains from allow-list policies in Barracuda Email Gateway Defense.

1. In the left navigation menu, select Home.

2. In the Risks section, do one of the following:

   • Select the Risky allow-list policies detected risk.

   • Select another risk, then use the arrows to navigate to the Risky allow-list policies detected risk.

3. Review the list of policies containing unsafe domains in the Evidence section.

4. Select Manage to open the Email Protection Risky policies page.

5. Review each policy and follow the steps in Risky Policies Detection and Remediation to do one of the following:

   • remove the unsafe domain from the policy

   • delete the policy if it is no longer needed.

Removing unsafe domains from allow-list policies restores full email filtering for these domains and gives your environment:

• Stronger phishing protection—Emails spoofing legitimate services are now properly filtered and inspected.

• Reduced risk of domain spoofing—Attackers can no longer bypass filtering by impersonating trusted domains.

• Better malware detection—All emails from these domains are scanned for malicious attachments and links.

• Improved filtering effectiveness—Email protection can analyze message content, sender reputation, and authentication.

• Consistent security enforcement—No gaps in filtering that attackers could exploit.

• Better customer experience—Harmful or unwanted emails are filtered, reducing complaints.

• Protection against impersonation attacks—Fake requests from trusted organizations are identified and blocked before reaching users.