Threat protection

Better visibility into what reaches your inbox.

Phishing, impersonation and malware rarely announce themselves. Secure Message adds layered checks at your gateway and shows you exactly what it caught, and why.

Admin console · appliance v1.5.8
The Spam and filtering page under Threat Protection: inbound spam filtering enabled, threshold 8, action quarantine, and weighted checks for the local block list, SPF, DKIM and content intelligence, plus DNS blocklist scoring.
Threat Protection menu: Spam & filtering, Anti-phishing, Anti-malware, Recipient verify, Advanced filtering, Quarantine.
Supported protections

Layers that work together.

Each layer adds to one score or makes one clear decision, so you can see how a message was judged.

Anti-phishing & spoof defense

Phishing signals feed the spam score, and spoofed senders that fail authentication are caught before content is evaluated.

Professional

Anti-malware (ClamAV)

Attachments are scanned with ClamAV plus an attachment policy that looks one level into archives. Scanner down? Mail waits. It's never delivered unscanned.

Professional

Recipient verification

Rejects mail to addresses that don't exist via SMTP callout, LDAP or directory lookups, cutting backscatter and wasted load.

Professional

Advanced filtering rules

Finer-grained rules for the senders, content and attachments your business actually deals with.

Professional

Sender authentication

SPF, DKIM and DMARC checks on every inbound message, with DMARC enforcement that quarantines rather than drops.

Community

DNS blocklists & scoring

Reputation lists and weighted heuristics roll into one score you control.

Community
How decisions are made

Fail safe where it matters. Fail open where it's kind.

Mail security products usually disappoint at the edges. These are the rules Secure Message follows when something goes wrong.

  • Filter errors defer, never lose mail

    An unhandled filter error leaves the message queued for retry.

  • Anti-malware fails closed

    If ClamAV is unreachable, mail is deferred rather than delivered unscanned.

  • Reputation and AI checks fail open

    SPF, DKIM, DNSBL and AI lookups yield “no opinion” on timeout, so an outage elsewhere can't stop your mail.

  • DMARC quarantines, never drops

    A false positive is always recoverable.

Admin console · appliance v1.5.8
The Quarantine page under Threat Protection: held mail with received time and spam score, a search box, Release selected, and an option to let recipients release their own held mail. Senders and recipients are redacted.
Visibility

See it, then decide.

Quarantine shows held mail with its score; the mail flow log shows every event. Release what's legitimate and tune what isn't.

  • Per-domain policy can override most filtering settings
  • Administrator-supplied patterns run under a regex guard
  • Every configuration change is audited
FAQs

Threat protection questions

Which threat protection features need Professional?

Anti-phishing and spoof defense, anti-malware (ClamAV), recipient verification and advanced filtering rules are Professional. Community includes spam scoring, DNS blocklists and SPF, DKIM and DMARC checks.

What happens if the malware scanner is down?

The message is deferred, never delivered unscanned. Your mail server's queue retries it later.

Does anti-phishing rely on AI?

No. Professional includes non-AI anti-phishing and spoof defense. The optional AI classifier is a separate Enterprise feature that is off by default.

Can it stop every attack?

No product can. Secure Message adds layers of checks and gives you visibility into what reaches your inbox; it works best alongside good email hygiene and the rest of your security stack.

Want to see what it would catch?

We'll walk through threat protection on a running appliance and answer questions about your mail.