> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/phishing/allowlist-feed.md).

# Domain allowlist feed

Some recipients never receive the phishing simulation emails, or the landing page gets blocked, because their firewall inspects or filters the traffic to the campaign domains. Stoïk publishes a domain allowlist feed that your firewall can poll automatically to exempt these domains from SSL inspection and URL filtering.

## Prerequisites

* A **FortiGate**, **Palo Alto**, or **Cato Networks** firewall. We haven't found an equivalent setup for other vendors yet.
* The feed credentials provided by Stoïk (`<allowlist_feed_username>` and `<allowlist_feed_password>`). Contact <protect@stoik.io> if you don't have them.

## Configure your firewall

{% tabs %}
{% tab title="FortiGate" %}
FortiOS 7.4 / 7.6 / 8.0

{% stepper %}
{% step %}

### Create the external resource

In the FortiGate CLI, create a `type category` external resource pointing at the feed URL. A `type domain` resource cannot be used for SSL inspection exemption.

```
config system external-resource
    edit "stoik-allowlist"
        set status enable
        set type category
        set category 192
        set resource "https://prod.phishing.cyber.stoik.io/public/v1/allowlist/domains.txt"
        set username "<allowlist_feed_username>"
        set password "<allowlist_feed_password>"
        set server-identity-check full
        set refresh-rate 5
    next
end
```

Field notes:

* `set type category` is required (not `type domain`) so the resource can be added to the SSL/SSH inspection exempt list.
* `set category 192` assigns the resource to a custom FortiGuard category slot. Slots 192-221 are available (30 total per scope/VDOM). Choose a free slot; the number must be unique within the scope.
* `set username` and `set password` activate HTTP Basic authentication automatically.
* `set server-identity-check full` validates the full TLS certificate chain and hostname. Default is `none`; `full` is recommended for HTTPS feeds.
* `set refresh-rate 5` polls every 5 minutes (units are minutes; range 1-43200).
  {% endstep %}

{% step %}

### Exempt from SSL inspection

Add the category to the SSL/SSH inspection profile's exempt list. This is the mechanism that actually bypasses SSL deep inspection for matching domains. Without this step, FortiGate will still MITM the TLS connection.

GUI path: `Security Profiles` > `SSL/SSH Inspection` > your deep-inspection profile > `Exempt from SSL Inspection` > `Web categories` > add the `stoik-allowlist` category.

CLI equivalent:

```
config firewall ssl-ssh-profile
    edit "deep-inspection"
        config ssl
            set exempt-categories "stoik-allowlist"
        end
    next
end
```

{% endstep %}

{% step %}

### Verify the firewall policy uses the inspection profile

Confirm that the firewall policy covering client outbound traffic references the `ssl-ssh-profile` you modified in the previous step.

{% hint style="warning" %}
**Web Filter "Allow" does not pass traffic.** Setting the external resource category to `Allow` in the Web Filter profile does not allow the traffic. Per the FortiOS 7.6 documentation: "Selecting the Allow action for the FortiGuard Category Based Filter does not actually allow the category. It merely implies that no filter has been applied."

If the base FortiGuard rating for a landing domain is `Phishing` or `Malware`, the `Allow` action on the custom category will not override it. Use the SSL/SSH inspection exempt list (previous step) or a Static URL Filter Exempt entry in the web filter profile instead.
{% endhint %}
{% endstep %}
{% endstepper %}

Official documentation:

* [FortiOS 7.6 - Threat Feeds](https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/009463/threat-feeds)
* [FortiOS 7.6 - FortiGuard Category Threat Feed](https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/995517/fortiguard-category-threat-feed)
* [FortiOS 7.6 - Domain Name Threat Feed](https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/195303/domain-name-threat-feed)
* [FortiOS 7.6.3 CLI Reference - config system external-resource](https://docs.fortinet.com/document/fortigate/7.6.3/cli-reference/549356530/config-system-external-resource)
  {% endtab %}

{% tab title="Palo Alto" %}
PAN-OS 11.1+

{% stepper %}
{% step %}

### Create an External Dynamic List (type URL)

Use `type URL`, not `type Domain`. A `type Domain` EDL is for DNS sinkholing only and cannot be used in URL Filtering profiles or Decryption policy.

GUI path: `Objects` > `External Dynamic Lists` > `Add`

Settings:

* **Type:** URL
* **Source:** `https://prod.phishing.cyber.stoik.io/public/v1/allowlist/domains.txt`
* **Client Authentication:** enable, then enter the `<allowlist_feed_username>` and `<allowlist_feed_password>`
* **Check for updates:** Every Five Minutes

Notes:

* Client Authentication is only available when the source URL is HTTPS.
* Each unique source URL counts against the 30-source-EDL limit per firewall.
  {% endstep %}

{% step %}

### Allow traffic in a URL Filtering profile

GUI path: `Objects` > `Security Profiles` > `URL Filtering` > add/edit profile > `Categories` tab

Find the EDL in the category list and set its action to `Allow`. Attach this URL Filtering profile to the Security policy rule covering the relevant traffic.
{% endstep %}

{% step %}

### Add a No-Decrypt Decryption policy rule

Without this step, the firewall will still decrypt and re-encrypt traffic to the landing domains, which may interfere with TLS certificate validation by the campaign target.

GUI path: `Policies` > `Decryption` > `Add`

Settings:

* **Name:** e.g., `No-Decrypt-Stoik-Allowlist`
* **Source / Destination:** Any
* **Service/URL Category tab:** add the EDL
* **Options tab** > **Action:** No Decrypt
* (Optional but recommended) Apply a no-decryption profile that blocks expired or untrusted certificates

Move the rule to the **top** of the decryption rulebase, above any "Decrypt all HTTPS" or catch-all decrypt rules. Decryption rules are evaluated top-to-bottom; the first match wins.

Commit after saving.

{% hint style="info" %}
**Wildcard coverage:** `*.example.com` matches all subdomains (`login.example.com`, `docs.example.com`) but does not match the bare apex `example.com`. Both lines are present in the feed. PAN-OS URL type silently skips malformed entries; bare domain entries (without a scheme) are treated as `example.com/` and match the apex.
{% endhint %}
{% endstep %}
{% endstepper %}

Official documentation:

* [External Dynamic List](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list)
* [Configure the Firewall to Access an External Dynamic List](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/configure-the-firewall-to-access-an-external-dynamic-list)
* [Use an External Dynamic List in a URL Filtering Profile](https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions/use-an-external-dynamic-list-in-a-url-filtering-profile)
* [Guidelines for URL Category Exceptions](https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions/guidelines-for-url-category-exceptions)
* [Enforce Policy on an External Dynamic List](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/enforce-policy-on-an-external-dynamic-list)
* [Create Policy-Based Decryption Exclusions](https://docs.paloaltonetworks.com/network-security/decryption/administration/decryption-exclusions/create-policy-based-decryption-exclusions)
  {% endtab %}

{% tab title="Cato Networks" %}
In the Cato Management Application:

1. Go to `Resources` > `Categories` > `Containers`.
2. Create a Container with type `FQDN`.
3. Select `Syncing a file from a URL` as the source.
4. Select the CSV/TXT format and enter the feed URL provided by Stoïk (it already includes your access token).
5. Select an hourly synchronization interval, then click `Test Container` before saving.

Official documentation:

* [Integrating Custom IoC Lists with Containers](https://support.catonetworks.com/hc/en-us/articles/22280839625373-Integrating-Custom-IoC-Lists-with-Containers)
  {% endtab %}
  {% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/human-security/phishing/allowlist-feed.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.