Hi @kbulgrien , thanks for the heads up.
The Yahoo Mail subscription was initially designed to only allow the mail service while omitting the rest. I renamed the subscription now to make that a bit more clear. You mentioned login.yahoo.com needed to be added, but since that was already part of the subscription, I assume you meant login.yahoo.net , which I too noticed was required along with guce.yahoo.com. The subscription has now been updated and includes a few others subdomains that seemed necessary for the mail service functionality. I did not add the att. subdomain as it may be unique to your carrier? My recommendation would be to add att.yahoo.com to an allowlist activated in your policy(s). If all of Yahoo needs to be allowlisted including the search engine and entertainment, here are a few domains observed from the domain log that could be added to an allowlist (one that includes subdomains) that should get you most of the way there.