Introduction
Riot sends phishing simulation emails.
If your Proofpoint solution is not properly configured, these emails may be blocked by spam filters, which can distort your campaign statistics.
This article outlines the steps required to authorize Riot’s IPs and domains, ensuring that your tests (and the Phish Alarm button) run smoothly.
Definition
Proofpoint is an advanced email security solution.
It can block legitimate Riot test emails if certain IP addresses or domains are not authorized in its settings.
Proofpoint includes several modules: Essentials, Enterprise, Targeted Attack Protection (TAP), and Phish Alarm (for reporting suspicious emails).
Associated Options / Features
✅ Proofpoint Essentials
Go to
Security Settings > Email > Sender ListsAdd Riot’s IP to the Safe Sender list:
159.135.234.25
Click Save
👉 If attachments are being blocked, check Proofpoint’s article on default blocking rules.
This ensures Riot simulation emails are properly delivered to user inboxes.
✅ Proofpoint Enterprise
Log in to the Proofpoint Enterprise Admin Console
Click Email Protection
In the
Spam Detectionmenu, select Organisational Safe ListClick Add
In the Global Safe List window:
Filter Type: Sender IP Address
Operator: Equals
Value: 159.135.234.25
Click Save Changes
💡 This configuration ensures Riot’s test emails are not flagged as spam by Proofpoint’s detection engine.
✅ Targeted Attack Protection (TAP)
To avoid false positives with TAP, add Riot to the URL Defense exceptions:
Go to the Proofpoint Essentials admin console
Click Email Protection
Under
Targeted Attack Protection, select URL DefenseClick URL Rewrite Policies
Under
Exceptions, add the IP: 159.135.234.25Click Save Changes
This prevents TAP from rewriting or blocking URLs contained in Riot test emails.
✅ Configuring the Proofpoint Phish Alarm (TRAP)
The Phish Alarm button allows users to report suspicious emails directly from their inbox.
To ensure compatibility with Riot simulations, Proofpoint must recognize and process Riot emails as legitimate test messages.
Recommended Steps:
Verify TRAP Compatibility
Proofpoint’s TRAP AI can only analyze emails that pass through Proofpoint’s filtering pipeline.
If your Riot tests bypass Proofpoint, they will not be processed or classified correctly.
Create a Firewall / Bypass Rule
Add a specific rule to allow Riot emails through Proofpoint without interference from other security tools or external gateways.
This ensures TRAP and Phish Alarm can analyze the message properly.
Add a Tag or Routing Policy (optional)
Some Proofpoint environments require a tag or policy route to identify Riot messages and apply the correct processing rules.
Test the Workflow
Send a test email from Riot and use the Phish Alarm button to confirm that:
The email is correctly reported
It appears in Proofpoint TRAP
It is not blocked or altered before processing
💡 Tips
If your emails still land in spam despite this configuration, verify that IP 159.135.234.25 is correctly added in:
Email Protection > Spam Detection > Organisational Safe ListFor proper Phish Alarm behavior, make sure Riot emails go through Proofpoint’s pipeline (and not another MTA or pre-filter)
If TRAP errors occur, confirm that Riot’s IP and domains are present in your approved sender lists