Skip to main content
If your organization uses a secure email gateway, allow Oximy’s sending domains before you invite employees. Enterprise gateways hold back mail from senders they have not seen before, regardless of how well that mail is authenticated — and sign-in codes are time-sensitive enough that a short quarantine usually expires them. This page is written for a mail administrator and can be forwarded as-is.

​
What to allow

All of these sit under the organizational domain oximy.com, which publishes:
  • SPF and DKIM on every sending subdomain
  • DMARC at p=reject (100%) — we ask providers to reject anything that fails authentication while claiming to be us
  • BIMI with a GlobalSign Verified Mark Certificate, so supporting clients can display our verified logo
Allowlisting by domain with DMARC alignment is preferred over allowlisting by IP address. Our sending IPs are provider-managed and change; the domains do not.

​
Mail that Oximy sends

Auth mail is time-sensitive: a verification code that is quarantined for review has usually expired by the time it is released.

​
Per-vendor steps

​
Proofpoint

  1. Open Security Settings → Email → Safe/Blocked Senders (or the Firewall rules in Proofpoint on Demand).
  2. Add notifications.oximy.com and clkmail.oximy.com as safe sender domains.
  3. In Targeted Attack Protection → URL Defense, add oximy.com and sidekick.oximy.com to the URL rewrite exception list. Without this, the activation link is rewritten and sandboxed, which can consume the single-use token before the employee ever clicks it.
  4. If Impostor/Business Email Compromise classification is aggressive, add the two sender domains to the exception list — first-contact senders are a common false positive.
URL Defense is the step most often missed. Symptom: the employee reports the activation link says it is invalid or already used, on their first click.

​
Mimecast

  1. Administration → Gateway → Policies → Permitted Senders.
  2. Create a policy with Source Domain notifications.oximy.com, applied to all internal recipients. Repeat for clkmail.oximy.com.
  3. Administration → Gateway → Policies → URL Protection Bypass — add oximy.com and oximysidekick.com so activation links are not rewritten.
  4. Check Managed Senders for any pre-existing block on these domains.
Prefer a Permitted Senders policy over an Auto-Allow entry: Auto-Allow is reputation-derived and can be re-evaluated away.

​
Google Workspace

  1. Admin console → Apps → Google Workspace → Gmail → Spam, phishing and malware.
  2. Under Allowlisted senders, add notifications.oximy.com and clkmail.oximy.com.
  3. Check Spoofing and authentication. If “Protect against inbound emails spoofing your domain” is enabled and Oximy sends on your behalf from a subdomain, add an exception — this setting can quarantine correctly authenticated subdomain mail.
  4. Optionally add the domains to Bypass spam filters for senders.

​
Microsoft 365 / Exchange Online

  1. Microsoft Defender portal → Policies & rules → Threat policies → Anti-spam → Connection filter / Allowed senders.
  2. Add notifications.oximy.com and clkmail.oximy.com to the allowed domains.
  3. Better still, create a Tenant Allow/Block List entry for the two domains — allowlists there are honoured more consistently than anti-spam policy entries.
  4. Safe Links — add oximy.com and oximysidekick.com to the “Do not rewrite the following URLs” list, for the same reason as Proofpoint URL Defense.
Microsoft Defender is the most common cause of missing verification codes. If allowlisting is not possible, verification codes deliver more reliably than magic links.

​
Verifying it worked

Ask the administrator to release any quarantined Oximy mail first — a quarantined message can otherwise keep the sender’s reputation suppressed. Then, from the Oximy dashboard, re-send an activation to one real employee and confirm it lands in the inbox rather than Junk. In the received message, use Show original (Gmail) or View message source (Outlook) and confirm:
All three should read pass. If they do and the message still lands in Junk, the cause is gateway policy rather than authentication — revisit the steps above.

​
Troubleshooting

If mail is still not arriving after these steps, contact support@oximy.com with the message ID from the gateway log and we will trace it from our side.