Add external sender banner
|
Adds a banner to emails originating outside your organization so users can quickly identify external messages.
|
Add internal sender banner
|
Marks emails from internal senders with a banner confirming the message is from within your organization to reduce confusion and build trust. Misconfigured SPF or relay issues may prevent the banner from appearing or cause incorrect flagging.
|
Display "From" and "Sender" values in the banner
|
Shows both "From" and "Sender" headers in the banner for transparency, helping users detect spoofing attempts where attackers hide the real sender. Some legitimate mailing systems (for example, newsletters) use different "Sender" values, which could cause confusion.
|
Alert on common homoglyph character in the "From" header.
|
Alerts users when the "From" address contains Cyrillic or Greek characters that mimic Latin letters, which is a common impersonation tactic. This helps prevent homoglyph attacks. Legitimate international emails may also trigger this warning.
|
Alert on common homoglyph character in the "Sender" header.
|
Alerts users when the "Sender" address contains Cyrillic or Greek characters that mimic Latin letters, which is a common impersonation tactic. This helps prevent homoglyph attacks. Legitimate international emails may also trigger this warning.
|
Suspicious keyword filter
|
Flags emails containing common phishing or scam phrases such as "Verify your identity immediately" or "You have won", which are strongly associated with fraud attempts. Marketing emails or legitimate alerts may occasionally use similar language, so caution is advised. It is recommended to create a list of suspicious keywords tailored to your organization's needs.
|
Promotional emails filter
|
Identifies promotional emails by detecting unsubscribe links and non-business domains, helping users prioritize important messages. Some transactional emails (e.g., invoices) include unsubscribe links and may be flagged incorrectly.
|
Flag high-risk TLD domains
|
Warns users about emails from domains with high abuse rates (for example, .tk, .ml, .xyz). These TLDs are frequently used for spam and phishing. Some legitimate services use these domains, so verification is important.
|
Reply-To header mismatch
|
Alerts users when the Reply-To address differs from the sender, a common phishing tactic to redirect responses. Some mailing systems use different Reply-To addresses for support or ticketing, which may cause false positives.
|
Move unauthenticated emails to Junk (SPF fail)
|
Flags emails that fail or partially fail SPF checks, indicating possible spoofing. SPF validates sender authenticity. Misconfigured SPF records or forwarding services may cause false positives.
|
Move unauthenticated emails to Junk (SPF soft fail)
|
Flags emails that fail or partially fail SPF checks, indicating possible spoofing. SPF validates sender authenticity. Misconfigured SPF records or forwarding services may cause false positives.
|
Alert on urgent emails without SPF
|
Warns users when a high-priority email lacks SPF validation. Attackers often mark phishing emails as urgent to pressure recipients. Some legitimate systems may not set SPF correctly, so verification is recommended before proceeding.
|
Alert on failed ARC and DMARC checks
|
Flags emails failing DMARC and ARC checks, which validate sender identity and message integrity. This prevents spoofing and tampering. Forwarded emails or mailing lists may fail these checks, causing false positives.
|
Flag PHP mailer emails
|
Warns users about emails sent via PHP mailer, which is often exploited by spammers in low-security setups. While PHP mailer is commonly used in legitimate web applications, recipients should verify authenticity.
|
ARC fail banner
|
Alerts users when ARC authentication fails, indicating possible tampering in message forwarding. ARC helps preserve authentication through forwarding chains. Some email forwarding services may cause ARC failures.
|
Quarantine emails with macro-enabled attachments
|
Alerts users when an email contains macro-enabled Office files, which can execute malicious code. This is a common malware delivery method. Some legitimate workflows may use macro-enabled files, so administrators should verify before blocking.
|
Quarantine emails with executable attachments
|
Blocks emails containing executable files to prevent malware infections. Executables are a high-risk file type. Rare legitimate use cases (e.g., software distribution) may be impacted.
|
Quarantine emails with password-protected attachments
|
Blocks emails containing password-protected files that could hide malicious content. Attackers often use encryption to bypass scanning. Legitimate secure file transfers may also be blocked.
|
Quarantine emails with double-extension attachments
|
Blocks emails containing attachments with double extensions (for example, invoice.pdf.exe), which is a common malware tactic used to disguise executables. Rare legitimate naming conventions may also trigger this rule.
|
Prevent internal domain spoofing (SPF fail)
Prevent internal domain spoofing (DKIM fail)
Prevent internal domain spoofing (DMARC fail)
Prevent internal domain spoofing (Sender header)
|
Quarantines emails that appear to come from your domain but fail authentication checks, helping prevent internal spoofing attacks. Misconfigured DNS records or relay systems may cause false positives.
|
Block urgent emails with DKIM fail
|
Blocks emails marked as "urgent" that fail DKIM authentication, as attackers often use urgency to pressure recipients and bypass security checks. This rule helps prevent social engineering attempts. However, some legitimate urgent emails may fail DKIM due to forwarding or misconfigured mail servers.
|
