Trusted forwarders

When another mail service forwards your mail here (a university or work account, an old provider, a mailing service), the forwarded copy comes from its servers, not the original sender's. Senders that publish a strict DMARC policy (p=reject or p=quarantine), such as banks, can then look forged: the copy would be refused or put in Junk.

A trusted forwarder fixes that. Mail it brings to you is not held to the original sender's DMARC policy.

Two ways to trust a forwarder

By its sending addresses (an IP address or network, such as 198.51.100.0/24). Its mail to you also skips greylisting and spam scoring (viruses are still refused), so add only servers you trust. The forwarder's help pages usually list the addresses it sends from.
By its domain, if it ARC-seals what it forwards (such as example.edu). ARC (RFC 8617) lets a forwarder sign a record of how a message looked when it arrived there. When the seal checks out and the forwarder recorded that the message passed DMARC, the copy is let through. Spam scoring still applies. A seal by a subdomain (such as mx.example.edu) counts for its domain. Big providers such as Gmail and Outlook.com seal what they forward.

Who sets them

You, for your own mailbox: in webmail, Settings → Junk and blocking → Trusted forwarders (an advanced option; turn on Show advanced options first). Up to 50 networks and 50 domains; a network may be no wider than /16 (IPv4) or /32 (IPv6). They count for mail to your mailbox only.
Your team's admins, for every mailbox of the team: Trusted forwarders (IP allowlist) on the team's page in the domain admin panel. Add the common forwarders' sealers there trusts the seals of the big providers (Gmail, Microsoft, Yahoo, Fastmail and Zoho) in one step.
Your provider, for everyone on the platform.

Each mailbox gets all three: its own, its team's and the provider's.

What it never does

A message whose From is on a domain hosted here (a colleague's address, say) and that is not authenticated as that domain is still refused, whoever brings it. A trusted forwarder cannot be used to forge someone here.
It does not make the sender count as proven. Images from senders you trust, and brand logos, still need the message to pass DMARC itself.
It does not change anyone else's mail.

The message's Authentication-Results still shows the real DMARC result, so you can see that a message failed DMARC and was let through.

API

Your own: GET|PUT /api/mail/trusted-hosts with items (networks) and arcSealers (domains). A team's: GET|PUT /v1/tenants/{tenantId}/ip-allowlist with the same fields.

See also SPF, DKIM and DMARC and Mail filters.