Review the anti-phishing policies that apply to the intended users and domains.
Understand which users/domains are protected from impersonation, how mailbox intelligence or similar signals are used, and what actions occur on detections.
Then test representative legitimate and suspicious scenarios in a controlled way.
Avoid blanket trusted-sender exceptions as the first response to false positives. Determine which detection fired and whether the exception can be scoped more narrowly.