Documentation

Security capabilities, stage by stage

What each stage does, when it runs, what it uses, how it affects the score, and whether you can turn it off per domain. Written so a reviewer can check a claim rather than take one.

Anything not listed here is not claimed. Where a capability is limited, the limit is stated in the same paragraph as the capability.

How scoring works

No stage decides on its own. Each one returns a score and a reason; the weighted total is compared against the domain's threshold, and that comparison is what quarantines a message. Every stage's raw score, its weight and the threshold it was judged against are recorded per message and shown in Message Tracker.

That is the reason this page can exist in this form. A product that reached a verdict some other way would have nothing to document here.

Each stage below is marked per-domain configurable where a domain can change or disable it. Defaults are inherited from the tenant and the domain's own setting wins.

Network and sender reputation

What it does: Checks the connecting host and the sending domain against public DNS reputation operators before the message body is parsed.
When it runs: First, at connection and envelope time.
What data it uses: The connecting IP address and sender domain, sent as DNS queries to the configured reputation operators. No message content leaves the gateway.
Effect on the score: Contributes a weighted score. A listing alone does not quarantine a message.
Optional: Yes, per domain.

Requires a local recursive resolver. Public resolvers are rate-limited or blocked by most reputation operators, which produces silent non-answers rather than errors.

Sender authentication

What it does: Evaluates SPF, DKIM and DMARC, including alignment, and records the result on the message.
When it runs: Before content analysis, so later stages can use the outcome.
Effect on the score: Failure contributes to the score. Passing authentication does not reduce a spam score — it proves only that the sender controls the domain, and a mailbox registered minutes ago authenticates perfectly.
Optional: Yes, per domain.

ARC sealing

Any gateway in front of Microsoft 365 or Google Workspace causes SPF to be evaluated against the gateway rather than the real sender, which fails SPF for almost all inbound mail and takes DMARC with it. The gateway stamps the authentication result it determined so the destination platform can use that verdict instead of deriving a wrong one. ARC sealing of that result switches on once the domain's ARC key is published in DNS; the gateway will not sign with a key it cannot resolve. Any inbound Authentication-Results header claiming to be from this gateway is stripped before ours is added.

DMARC aggregate reports are collected, parsed and analyzed per domain.

Attachments

Five separate stages, in increasing order of cost. Each one runs only when the cheaper ones could not answer.

1. Antivirus

Signature scanning of every attachment and the message body, with signature feeds updated daily. Per-domain configurable.

2. Structural and macro analysis

File type is determined from content rather than the declared MIME type or the extension, so a mismatch is itself a finding. Office documents are inspected for macros and for the structures used to auto-execute them; archives are opened and their contents examined, including nested archives to a bounded depth.

3. Attachment reputation

Every attachment is hashed and the hash is looked up with a third-party multi-engine service. A hash discloses nothing about content, so this is always safe. The verdict is a count of antivirus engines, and a single engine is not treated as a verdict — the corroboration threshold is configurable per domain.

Uploading an unknown file is a separate setting and is off by default, because sending a customer's document to a third party is a disclosure rather than an optimisation.

4. Behavioral analysis

Not offered yet. The integration is built and tested, but no analysis provider is configured on this platform, so no file has been analyzed this way. It is described here so the capability can be checked rather than taken on trust.

Asks what a file does when it runs — processes created, persistence written, hosts contacted — rather than how many engines dislike it. This is a different question from attachment reputation above, and it runs only when reputation could not answer and the message already scores above the domain's behavioral threshold.

Providers: Pluggable. VirusTotal (behavioral reports, hash lookup first) and Joe Sandbox (submission only) are implemented.
Modes: Off by default on every domain. Monitor records the verdict and shows it without changing any score. Enforce lets the verdict contribute to the score.
Privacy: Hash lookup discloses nothing. Uploading a file sends it to the provider, and that is a separate per-domain setting which is off by default.
Effect on the score: A malicious verdict contributes a weighted score alongside the other stages. It is not a separate decision and cannot quarantine a message on its own without the domain's threshold agreeing.
What it does not do: It does not hold mail waiting for an analysis to finish. A verdict that has not arrived is recorded as unknown, which scores nothing, and the message is delivered. An unknown or failed analysis is never treated as clean.

Requires an API key for the chosen provider, entered per domain. With no key configured this stage does not run.

5. Outbound content inspection

For mail submitted through the gateway, payment card numbers, US Social Security numbers and IBAN bank accounts are detected by checksum rather than by shape, plus any patterns you configure. A message that trips a rule is held for review rather than bounced.

Spam, phishing and impersonation

Content analysis: Rule-based content scoring with daily rule updates, plus per-tenant statistical classification that learns only from that tenant's own corrections. One customer's training never affects another's filtering.
Impersonation: Display-name and lookalike-domain detection against the names and domains a domain actually corresponds with, plus configurable pattern rules per domain.
Campaign detection: Messages sharing indicators are grouped into campaigns across the domains you manage, so a phish sent to twelve customers is one thing to act on.
Geographic policy: Per-domain rules on sending country, able to block or quarantine.
Optional: Every one of these is per-domain configurable, including off.

No detection rate or false-positive rate is published, because none has been measured on a sample large enough to defend. Monitor Mode exists so a domain can measure it on its own live traffic before enforcing anything.

Links and QR codes

URL analysis and rewriting

URLs are extracted from the body, redirect chains are resolved, and destinations are checked against reputation sources. Links can be rewritten so that the check happens again at the moment the recipient clicks, which is what protects against a URL that was clean at delivery and became malicious afterwards. The redirect service refuses to forward to a destination that is not the one it recorded, so it cannot be used as an open redirect.

Periodic rechecking

Links in recently delivered mail are re-evaluated on a schedule. A URL that turns malicious after delivery raises an incident naming the affected messages and recipients, rather than only updating a counter.

QR codes

QR codes are decoded from images, from PDF attachments and from images embedded in Office documents. The destination is then assessed through the same URL pipeline as a normal hyperlink.

A QR code is not treated as a threat in itself — invoices, tickets and newsletters contain them legitimately, and scoring their presence would punish ordinary mail. What scores is where the code goes: a shortener hiding the destination, a bare IP address, a credential-shaped path, a mismatch between the visible brand and the host, or a destination already known bad.

What was decoded is always recorded, even when it scores zero, because the whole point of putting a payload in an image is that nobody can read it.

AI analysis

What it does: An optional second opinion on messages the deterministic stages found ambiguous — the targeted phishing and business email compromise that has no signature.
Whose key: Yours. You supply the provider credential; it is encrypted at rest and never returned by any endpoint.
Effect on the score: Bounded. A low-confidence verdict contributes at half weight and cannot reach any domain's quarantine threshold on its own.
Guardrails: Message content is treated as untrusted input. Instruction-shaped text in a message is detected and recorded as evidence. The model cannot train, modify or override the filtering system, and a failed review results in no action.
Optional: Yes, and off unless you configure a key.

After delivery

Mailbox search and removal

In beta testing on Microsoft 365 and Google Workspace. The workflow below is built and tested and has not yet been verified against a live customer tenant, so it is not offered as a capability today.

Where a Microsoft 365 or Google Workspace integration has been configured and authorized by the customer, delivered copies of a message can be located across mailboxes and removed. The workflow is: find the copies, show what would be acted on, require confirmation, then act — and every action is recorded with who did it, when, which messages, and what the provider API returned.

This requires an application registration in the customer's own tenant, granted by that customer. Without it, the message list on an incident remains the record of who received a message.

Incident response

Incidents carry an ordered checklist bound to the incident, tracking which steps have been done and by whom. Progress comes from the incident's own timeline, so the checklist and the audit trail cannot disagree.

Indicator blocking is deliberately a person's decision rather than an automatic one. The indicators of a real phishing message routinely include ordinary destinations the same message also referenced, and the console shows how much clean mail carries each indicator before you block it.

Quarantine and continuity

Held mail is searchable with the full per-stage breakdown behind each decision, and can be released or discarded. Mail for a destination that is down is held and retried, visible with how long it has been waiting and when it would start bouncing.

Check any of this against the product.

Run one domain in Monitor Mode and read the per-message breakdown yourself.

Evaluate One Domain How mail flows through it What we can and cannot prove