I presume that by whitelisting you mean a sender group in your HAT whereby the mail passes through a mail flow policy with far fewer restrictions than usual. If so, a novice error is to confuse the domain of the sender with the domain of the equipment sending the mail.
So, for example, if you're trying to whitelist sender@bubbly.tld and the mail in question is actually being sent through scheissesturm.bendgrid.net then it's no good putting any permutation of bubbly into your HAT. No, that Bendgrid server must go into your list of trusted machines with all that this implies.
However, you mention the C170 "holding" items and that suggests that items are being caught by CASE (the anti-spam engine) or a content filter someone's put into your incoming policies. Do you have a policy that handles your whitelisted senders? If not, you'll need one if CASE is the problem. Policies do work by sender address so in our example you need to add Sender: @bubbly.tld to the policy users. You can then turn off anti-spam, anti-virus or any of the content filters as you need to.
Beware that if anyone impersonates a domain you've whitelisted by policy then they're going to sail through the defences you've turned off for that domain.
Finally, if that Bendgrid server in our example does get a very low Senderbase rating then no policy is going to save the mail, and the problem won't show up in message tracking; you'll have to read the connection log to see the rejection.
