# Security audits performed on incoming emails | SmartMail

> For administrators: it explains which identity, content, link and attachment checks SmartMail performs on every incoming email and how it makes the decision.

Source page: https://dblinx.net/en/smartmail/belgeler/yonetici/guvenlik-denetimleri

---

# Security audits performed on incoming emails

SmartMail checks every incoming email before the user opens it and shows the result next to the sender's name with a trust score. If the score falls below the organization's quarantine threshold, the email is quarantined. Details of the checks [security](/en/smartmail/guvenlik) is explained on the page.

- Administrator

## What are the security audits performed on incoming emails?

SmartMail checks every incoming email before the user opens it and shows the result next to the sender's name with a trust score. Who can do this: Administrator. If the score falls below the organization's quarantine threshold, the email is quarantined. Details of the checks are explained on the security page. To adjust the decision for your organization, use the quarantine threshold, sender rules and adding organization context to AI.

## Audits

Sender identity

The SPF, DKIM and DMARC results and the sending server's reverse DNS record (PTR) are checked.

Spoofing

Similarly spelled domains, addresses written with letters from a different alphabet (punycode), senders that appear to be a known brand or person, and those writing on behalf of an organization from a free email address are detected.

Links

Links whose displayed text differs from the address they lead to, links to internal network addresses, links containing the recipient's address, and emails where the reply is redirected to another address (Reply-To) are flagged.

Attachments

Dangerous file types and compressed files that grow excessively when opened are caught.

Content

AI evaluates identity information, payment and urgency requests in the email and generates a risk score; it compares them against known fraud examples online.

Relationship

Senders writing for the first time, addresses you have corresponded with before, and emails from your own domain are evaluated separately.

Learning

User corrections such as "remove from quarantine" or "quarantine" will be taken into account in the subsequent evaluation of similar mails.

## Viewing a mail's audit result

Open the email and click the security badge next to the sender's name.

In the **Security analysis** window that opens, read the risk score, the **Findings** list and the **Recommended action**.

## Always-on protections

Mails open in a secure viewer and scripts in the mail are not executed; remote images are not loaded until the user permits. Sending rate limits and dangerous attachment blocking are applied to outgoing mails.

**Tip**To adjust the decision according to your organization [the quarantine threshold](/en/smartmail/belgeler/yonetici/karantina-esigini-ayarlama), [sender rules](/en/smartmail/belgeler/yonetici/gonderen-kurallari) and [organization context for the AI](/en/smartmail/belgeler/yonetici/yapay-zekaya-kurum-baglami-ekleme) use the add option.

## Related pages

- [Reading the security badge and its report](/en/smartmail/belgeler/kullanici/guvenlik-raporunu-okuma)

- [Setting the quarantine confidence threshold](/en/smartmail/belgeler/yonetici/karantina-esigini-ayarlama)