Email security
Protection for your email against phishing messages, malicious attachments, and malicious links, fitted to the mail system you already run.
What it protects against
What lands in the mailbox
Phishing has been the most common initial access vector for years. Filtering is there to keep these messages from reaching the user.
Phishing email
Today's phishing email is grammatically flawless and refers to the organization's real processes. Spelling mistakes no longer give it away.
Malicious attachment
A document infected with a macro or script. The defense is analyzing the attachment before delivery; we describe this under the sandbox service below.
Malicious link
Malicious links are often activated only after the message has been delivered. The defense is link rewriting and time-of-click checking.
Spoofed email in your company's name
The base email protocol does not authenticate the sender, so anyone can type anything into the From field. Domain authentication is covered below.
SPF, DKIM, DMARC
The sequence for authenticating a domain
SPF lists which servers may send mail on behalf of the domain. DKIM uses a cryptographic signature to prove that the message was not altered in transit. DMARC tells the receiving server what to do with a message that fails and where to send the report. Our article on email authentication has the details.
-
List every sender
Besides your own mail system, the newsletter tool, the invoicing system, the CRM, the HR system, and the monitoring tool typically send mail on behalf of the domain too. Any sender left off the list will stop getting its mail delivered once authentication is enforced.
-
SPF record
The senders are added to the SPF record. SPF limits the number of DNS lookups: if too many services have to be listed, the record can become invalid.
-
DKIM on every sender
A signature from the main mail system is not enough. Every system that sends on behalf of the domain gets its own signing key.
-
DMARC in monitor mode
The p=none setting does not block anything yet; it only asks for reports. The reports show which senders fail and which of them are legitimate. A processing tool turns the raw XML reports into something readable.
-
Gradual enforcement
First p=quarantine for part of the mail, then for all of it, and finally p=reject. From then on the receiving server rejects mail that fails, and outsiders can no longer get mail delivered in the company's name.
Deliverables
What you get at the end
items handed over
- Email protection solution, installed and configured
- Mail domain authentication set up correctly (SPF, DKIM, DMARC)
- Quarantine handling and reporting rules
- Handover documentation
Related services
Protection around email
The mail filter protects incoming traffic. These services cover the other risks that come with email.
Microsoft 365 security hardening
Reviewing and fixing the tenant settings, including those for authentication, sharing, and email.
Advanced threat protection (sandbox)
Unknown files and attachments are analyzed in an isolated environment (a sandbox) before they reach the user.
Data loss prevention (DLP)
The outbound direction: sensitive data must not leave the organization by email or any other channel.
Log source for the SIEM
Mail filter logs are among the most signal-dense sources, because the events arrive already filtered.
Reference
- Municipality of Gödöllő
- FortiMailWe integrated a redundant FortiMail system that forwards incoming mail to the internal mail servers according to rules. It handles spam, virus, and content filtering, quarantine, and blocklists and allowlists, with logging and reporting done in FortiAnalyzer.
Frequently asked questions
The questions we hear most
SPF, DKIM, and DMARC are set up. Why do phishing emails still get through?
Authentication does not filter out mail from a lookalike domain (for example arl1tech.hu), technically flawless mail sent from a compromised partner account, or deception through the display name. Training, processes, and technical filtering together protect against these.
How can I check that domain authentication works?
Send a message to an external mailbox and look for the Authentication-Results line in its header. It shows whether the SPF, DKIM, and DMARC checks passed. If any of them shows fail or none, that is where work is needed.
Does the mail filter catch QR code phishing?
Not always. The QR code arrives as an image, so the mail filter cannot see the link inside it, and users often scan it with a personal phone that has no corporate protection. In that case the user's own rule is the defense: if someone urgently asks for something that involves money or access, the user verifies it through another channel. We collected the other common patterns in our article on phishing.
What protects against a payment request sent in an executive's name?
The mail system can be set to put a visible tag on messages that arrive from outside. This is one of the most effective controls against executive-impersonation phishing. It needs a process rule alongside it: the four-eyes principle for payments, and any change of bank account number confirmed by calling back on the number in the contract.
