Skip to content
  • There are no suggestions because the search field is empty.

Troubleshoot ExecProtect alert and blocking issues

Troubleshooting missing ExecProtect alerts

ExecProtect quarantines emails that use a protected display name from an address that isn’t approved for that name. Use this article if your team stops receiving ExecProtect alerts, or if legitimate emails are being quarantined.

If your team stops receiving ExecProtect email notifications, review these common configuration areas:

  • Verify user notification permissions: Notifications are sent only to administrators assigned the ExecProtect notification permission, an admin can add it to any user. 
  • Review global Allow rules: Inbound Allow rules take priority over impersonation protection. If a broad or wildcard Allow rule matches a sender, ExecProtect skips evaluation entirely for those messages and will not trigger an alert.
  • Check protected names and domains: Confirm that the target display name or domain is active within your settings and has not been modified or removed.

Troubleshooting legitimate senders being blocked

When legitimate messages from outside senders trigger an ExecProtect quarantine, update your configurations using the following methods:

  • Add an approved sender: Navigate to your protected name entry and add the sender's exact email address to the approved list. This allows the specific address for that display name while keeping protection active for all other senders.
  • Use exact email addresses: Exact addresses are the safest choice, while wildcards like *@yourdomain.com are supported when you trust a whole domain. 
  • Refine short or generic display names: ExecProtect uses case-insensitive word matching. Short terms or single words (such as "CEO" or a first name) can cause false positives by matching unrelated display names. Ensure protected names use full, distinctive titles or multi-word names.
  • Differentiate Allow rules from approved senders: Prefer adding an approved sender directly within ExecProtect settings over creating a global Allow rule. A global Allow rule disables impersonation protection, link reputation checks, and geofencing across your entire account for that sender.

Releasing a quarantined message delivers that specific email copy to the user's inbox, but does not alter future protection rules. Release & allow email(s)/domain(s) creates an Allow rule that turns ExecProtect off for those senders.