Inbound filtering
Everything addressed to your domains passes the filter first. Clean mail is delivered in seconds; the rest is rejected, or quarantined where a person can review it.
Authentication enforced on arrival
SPF, DKIM and DMARC are checked on every message and the sender's DMARC policy is applied, reject included. ARC keeps forwarded mail from mailing lists working.
Lookalike and impersonation
Mail from domains one typo or one look-alike character away from yours or your clients', and display names that copy your executives, is held before anyone replies.
Spam and phishing scoring
Content, links and sender reputation are scored together, and links are checked against blocklists before the message is delivered.
Dangerous attachments
Executables, macro-enabled documents and archives that hide them are rejected or quarantined by your policy.
Quarantine people can use
A digest lists what was held; people release their own false positives, and admins decide who may release what.
Mail waits when your server is down
If your mail server or mailbox provider is unreachable, mail queues at the filter and is delivered when it is back.
Outbound filtering
Your own mail leaves through the filter too, so a phished password or a misbehaving script is stopped at your edge instead of on a blocklist.
Compromised accounts stopped early
A mailbox that suddenly writes to hundreds of new recipients is held for review before receivers, and blocklists, notice.
Rate limits per sender and domain
Hourly limits per mailbox and per domain, so a script or a stolen password cannot send a flood under your name.
Outbound spam scoring
Messages that look like spam or phishing are held instead of leaving with your domain in the From line.
Blacklists, cause and effect
EmailSecOps already watches Spamhaus, SpamCop, Barracuda, PSBL and UCEPROTECT for your domains and IPs; outbound filtering removes the usual cause of a listing.
Every decision, explained
The mail log shows what happened to each message and why, in the same plain language as the rest of EmailSecOps.
Blacklists, cause and effect
sample data| Time | Message | Action | Why |
|---|---|---|---|
| 09:14 inbound |
billing@acme-logistlcs.example to ap@acme-logistics.example · phishing Lookalike of acme-logistics.example (i → l) |
quarantined | Lookalike of acme-logistics.example (i → l) |
| 09:12 inbound |
dana.whitfield.ceo@freemail.example to finance@acme-logistics.example · impersonation Display name matches an executive; sent from free webmail |
quarantined | Display name matches an executive; sent from free webmail |
| 09:09 inbound |
it-support@acme-logistics.example to all-staff@acme-logistics.example · spoofed DMARC fail; the domain publishes p=reject |
rejected | DMARC fail; the domain publishes p=reject |
| 09:05 inbound |
invoices@supplier.example to ap@acme-logistics.example · clean SPF, DKIM and DMARC pass |
delivered | SPF, DKIM and DMARC pass |
| 09:03 inbound |
scanner@print-shop.example to ops@acme-logistics.example · malware Macro-enabled attachment |
rejected | Macro-enabled attachment |
| 08:58 outbound |
j.park@acme-logistics.example to 412 recipients · burst 412 new recipients in 10 minutes: compromised account? |
held | 412 new recipients in 10 minutes: compromised account? |
| 08:51 outbound |
newsletter@acme-logistics.example to 1,906 recipients · clean Within the sender's hourly limit |
relayed | Within the sender's hourly limit |
How it fits your mail
- Step 1
Inbound
Point your MX records at the filter. It hands clean mail to Microsoft 365, Google Workspace or your own server; mailboxes, clients and rules stay where they are.
- Step 2
Outbound
Add the filter as a smart host: an outbound connector in Microsoft 365, the SMTP relay in Google Workspace, or relayhost in Postfix.
- Step 3
Lock it down
Accept inbound mail only from the filter, so nobody can go around it straight to your mail server.
- Step 4
Watched before and after
EmailSecOps monitoring checks MX, SPF and DMARC before you switch and alerts you if they drift afterwards. Exact hostnames and records come with your beta invitation.
Built for MSPs and IT teams
Filtering follows the structure you already have in EmailSecOps: clients, their domains, and who may see what.
- Policies per client. Strict for the law firm, relaxed for the marketing agency, from one console.
- Quarantine per client. Each client's people release their own mail; your technicians see all of it.
- Your brand on the digest. Quarantine digests and reports carry your name on the Enterprise plan.
Monitoring many client domains already? EmailSecOps for MSPs
Why filtering belongs with posture monitoring
A filter enforces sender policies; EmailSecOps already knows yours. The DMARC policy you publish, the senders your reports show, the lookalike domains registered against you and the blacklists your IPs appear on all feed the filter's decisions, and every change to them is something you are alerted about anyway.
Questions about email filtering
What is the difference between inbound and outbound email filtering?+
Does email filtering work with Microsoft 365 and Google Workspace?+
Do I need to change my MX records for email filtering?+
Does outbound filtering change my SPF or DKIM setup?+
Can an MSP manage email filtering for each client separately?+
When will email filtering be available?+
Join the email filtering beta.
Tell us your mailbox provider and how many mailboxes and domains to protect. We enable teams in small groups.
Early access · Inbound and outbound · Microsoft 365, Google Workspace or your own server · Privacy