{"id":20740,"date":"2020-01-30T15:23:17","date_gmt":"2020-01-30T15:23:17","guid":{"rendered":"https:\/\/www.arimetrics.com\/glosario-digital\/whitelist"},"modified":"2026-09-29T07:26:55","modified_gmt":"2026-09-29T07:26:55","slug":"whitelist","status":"publish","type":"encyclopedia","link":"https:\/\/www.arimetrics.com\/en\/digital-glossary\/whitelist","title":{"rendered":"Whitelist"},"content":{"rendered":"<p><img decoding=\"async\" class=\"boxpad alignright wp-image-81045 size-full\" src=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/whitelist-en-square-600.jpg\" alt=\"Whitelist as a set of approved elements\" width=\"300\" height=\"300\" srcset=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/whitelist-en-square-600.jpg 600w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/whitelist-en-square-600-300x300.jpg 300w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/whitelist-en-square-600-150x150.jpg 150w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2026\/09\/whitelist-en-square-600-360x360.jpg 360w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><strong>Definition:<\/strong><\/p>\n<p>A <strong>whitelist<\/strong>, also called an <em>allowlist<\/em>, is an explicit set of elements approved by a policy. It can contain email addresses, domains, IP addresses, applications, files, websites, devices, or users that are allowed to perform a specific action.<\/p>\n<p>Approval depends on the system and the defined scope. Inclusion in a whitelist does not prove that an element is safe in every context. It means that the element meets an <strong>admission rule<\/strong>. The term <em>allowlist<\/em> is increasingly used in technical documentation as an alternative to <em>whitelist<\/em>.<\/p>\n\n<h2>How a Whitelist Works<\/h2>\n<p>The system compares each request, message, or resource with the identifiers stored in the list. A match activates the <strong>intended permission<\/strong>, while unrecognized elements can be blocked, quarantined, or sent for review.<\/p>\n<ul>\n<li><strong>Identification:<\/strong> The policy defines which attribute must match, such as an account, domain, signature, application, or <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/ip\">IP address<\/a>.<\/li>\n<li><strong>Authorization:<\/strong> The policy specifies the allowed action and the resources to which it applies.<\/li>\n<li><strong>Verification:<\/strong> The system evaluates the element when it attempts to connect, run, or deliver content.<\/li>\n<li><strong>Logging:<\/strong> Events can be recorded to investigate errors, exceptions, and unintended use.<\/li>\n<\/ul>\n<p>A whitelist can enforce a strict model in which everything not approved is rejected, or it can operate as an exception within broader controls. Therefore, its effect depends on <strong>the platform<\/strong>.<\/p>\n<h2>Common Applications<\/h2>\n<p>Whitelists are used to reduce exposure and <strong>control<\/strong> which elements participate in a process. Their contents and consequences vary according to the application:<\/p>\n<ul>\n<li><strong>Email:<\/strong> Approve senders, domains, or sending servers to reduce false positives.<\/li>\n<li><strong>Networks:<\/strong> Permit connections from specific sources through access or <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/firewall\">firewall<\/a> rules.<\/li>\n<li><strong>Applications:<\/strong> Restrict execution or installation to identified and approved software.<\/li>\n<li><strong>Web content:<\/strong> Enable domains, URLs, or categories within a filter.<\/li>\n<li><strong>Resource access:<\/strong> Grant permissions to previously approved accounts, devices, or integrations.<\/li>\n<\/ul>\n<p>The list can rely on exact values, ranges, certificates, signatures, or other verifiable attributes. A broader rule increases the <strong>scope of permission<\/strong>.<\/p>\n<h2>Use in Email<\/h2>\n<p>In email systems, a whitelist can be configured in an individual account or at an organization&#8217;s administrative level. A user can mark a <strong>sender as safe<\/strong>, while an administrator can approve addresses, domains, or servers to prevent legitimate messages from reaching the <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/spam\">spam<\/a> folder.<\/p>\n<p>This measure can correct false positives, but it <strong>does not guarantee<\/strong> delivery to the inbox. The provider can continue to apply controls against spoofing, malware, or phishing and can also consider domain authentication, sender reputation, and recipient behavior.<\/p>\n<p>A whitelist is not a <strong>subscriber database<\/strong>. Obtaining consent, managing opt-outs, and sending relevant content are parts of responsible <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/email-marketing\">email marketing<\/a>, but they do not automatically add a sender to the recipient&#8217;s trust rules. The user or receiving organization decides whether to grant that permission.<\/p>\n<h2>Permission Management<\/h2>\n<p>A whitelist <strong>requires maintenance<\/strong> because accounts, services, and providers change. Old or overly broad entries can preserve permissions that are no longer needed and turn a useful exception into an excessive access path.<\/p>\n<ul>\n<li><strong>Scope:<\/strong> Approve only the identifier and action that are necessary.<\/li>\n<li><strong>Ownership:<\/strong> Assign someone to approve additions, changes, and removals.<\/li>\n<li><strong>Duration:<\/strong> Review entries regularly and set an expiration when permission is temporary.<\/li>\n<li><strong>Validation:<\/strong> Confirm that the element retains the identity, control, and purpose for which it was approved.<\/li>\n<li><strong>Monitoring:<\/strong> Record usage and test changes to detect configuration errors.<\/li>\n<\/ul>\n<p>Inclusion should be specific and reviewable. If an approved account is compromised or a rule accepts an overly broad range, it can create <strong>excessive permission<\/strong>.<\/p>\n<h2>Comparison With a Blacklist<\/h2>\n<p>A <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/blacklist\">blacklist<\/a> or blocklist identifies elements that must be rejected. A whitelist identifies those that can be admitted. The main difference is the treatment of an <strong>unknown element<\/strong>.<\/p>\n<p>In a strict whitelist model, anything not approved is excluded by default. In a blacklist model, anything not blocked can proceed. Many systems <strong>combine several controls<\/strong>, so a match is only one part of the final decision.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A whitelist authorizes specific elements within a system. Learn how it works, its applications, its use in email, and how it differs from a blacklist.<\/p>\n","protected":false},"author":6,"featured_media":81047,"template":"","encyclopedia-tag":[1373],"class_list":["post-20740","encyclopedia","type-encyclopedia","status-publish","has-post-thumbnail","hentry","encyclopedia-tag-email-deliverability"],"_links":{"self":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia\/20740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia"}],"about":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/types\/encyclopedia"}],"author":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/users\/6"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media\/81047"}],"wp:attachment":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media?parent=20740"}],"wp:term":[{"taxonomy":"encyclopedia-tag","embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia-tag?post=20740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}