Security audits performed on incoming emails
SmartMail checks every incoming email before the user opens it and shows the result next to the sender's name with a trust score. If the score falls below the organization's quarantine threshold, the email is quarantined. Details of the checks security is explained on the page.
- Administrator
What are the security audits performed on incoming emails?
SmartMail checks every incoming email before the user opens it and shows the result next to the sender's name with a trust score. Who can do this: Administrator. If the score falls below the organization's quarantine threshold, the email is quarantined. Details of the checks are explained on the security page. To adjust the decision for your organization, use the quarantine threshold, sender rules and adding organization context to AI.
Audits
- Sender identity
- The SPF, DKIM and DMARC results and the sending server's reverse DNS record (PTR) are checked.
- Spoofing
- Similarly spelled domains, addresses written with letters from a different alphabet (punycode), senders that appear to be a known brand or person, and those writing on behalf of an organization from a free email address are detected.
- Links
- Links whose displayed text differs from the address they lead to, links to internal network addresses, links containing the recipient's address, and emails where the reply is redirected to another address (Reply-To) are flagged.
- Attachments
- Dangerous file types and compressed files that grow excessively when opened are caught.
- Content
- AI evaluates identity information, payment and urgency requests in the email and generates a risk score; it compares them against known fraud examples online.
- Relationship
- Senders writing for the first time, addresses you have corresponded with before, and emails from your own domain are evaluated separately.
- Learning
- User corrections such as "remove from quarantine" or "quarantine" will be taken into account in the subsequent evaluation of similar mails.
Viewing a mail's audit result
Open the email and click the security badge next to the sender's name.
In the Security analysis window that opens, read the risk score, the Findings list and the Recommended action.
Always-on protections
Mails open in a secure viewer and scripts in the mail are not executed; remote images are not loaded until the user permits. Sending rate limits and dangerous attachment blocking are applied to outgoing mails.