Mail Security

Before a message reaches the server that holds a mailbox, it goes through a secure email gateway: a filtering service that inspects everything inbound and decides whether it is allowed to continue. Deliver it, hold it, or throw it away.

Out front is also where filtering is cheapest: the company throws away the overwhelming bulk of inbound mail before it costs any storage, and keeps filtering while the mail server is down.

Microsoft Defender for Office 365

The paid add-on that sits on top of what every Microsoft 365 tenant already has. The baseline is Exchange Online Protection: the quarantine, the anti-spam and anti-phishing policies, and the Tenant Allow/Block List for addresses permanently allowed or blocked. Safe links, safe attachments and impersonation protection are the Defender license, so ask which one you are working in before you go looking for a policy.

Proofpoint

A gateway that sits in front of whatever mail platform you run. Common in enterprises, and known for handing users their own quarantine digest so they can release low-risk mail themselves.

Mimecast

Another gateway with the same shape, which also keeps mail flowing when the platform behind it is down.

Google Workspace filtering

Google does it inside the platform itself. The admin console carries the quarantines, the spam and phishing settings, and the address lists.

Whatever the badge says, you are looking for the same three things: the held messages, the permanent block and allow lists, and the policy that decided.

So there are two logs and they answer different questions. The mail server knows what it did with the messages it received. The gateway knows about the ones it never passed on.

Users call all of it spam. The gateway sorts it into four kinds and so should you, because the response is different for each.

Spam

Unwanted bulk mail, annoying and harmless. Graded by a spam confidence score, and above a threshold it goes to junk or to quarantine. Nobody needs to be woken up about it.

Phishing

Mail designed to make someone hand over a password or approve a sign-in, usually by way of a link to a convincing fake login page. The payload is the link itself, and a password typed into that page is an account somebody else now has.

Malware

Mail carrying something executable, in an attachment or behind a link. Gateways detonate suspicious attachments in a sandbox and watch what they do before deciding.

Impersonation

Mail carrying nothing but words, written to look like it came from a person or a supplier you trust, asking for a payment or a gift card or a change of bank details. Also called business email compromise.

Anyone can write any address in the From: line of an email and the protocol will carry it. Three records are the industry's answer: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). All three are published in DNS by the domain that owns the address.

What this means on a ticket: when a supplier's mail is suddenly being junked and nothing changed on your side, the answer is often that the supplier changed theirs, or that a mailing list or an auto-forward broke alignment. The fix belongs to the sender, so tell them which check failed.

Quarantine is the gateway's holding pen: messages it judged bad enough to stop but not certain enough to destroy. They sit there for a fixed retention period and are then deleted. Admins can look through them, and release sends the message on to the mailbox it was addressed to.

Releasing is one click, and there are exactly two ways to get it wrong.

Microsoft 365 and Microsoft Defender are trademarks of Microsoft Corporation. ServiceDesk Simulator is not affiliated with, endorsed by, or sponsored by them.

Release what you can justify in one sentence. Everything else stays held, and the ticket carries the reason.

A false positive is legitimate mail the filter stopped. They come with the job: the filter is making a judgment on incomplete information millions of times a day.

The other thing that catches impersonation is a user reporting it. Somebody forwarding you a message asking "is this real?" has noticed that the tone is wrong, which is the part the filter is worst at. A message made of words alone gives a scanner nothing to test, so that report is often the only signal there is.

So the way you answer a report decides whether you get the next one. Thank them and tell them what it turned out to be, even when it was ordinary mail.

In this company, inbound mail is filtered in the cloud before it routes to the on-premises mail server, EXCH01. That filtering service has its own console at Tools, under Email, as Mail Security, alongside the mail console itself, Mail Admin.

Type a mailbox and press Review. You get two lists, one above the other.

Quarantine

Messages the filter is holding for that mailbox. Each row shows the sender, the subject and the spam confidence level (SCL) it scored, such as SCL 8 or SCL 9. Release sends one on to the mailbox, and the row then offers Undo.

Blocked senders

Addresses and domains that are blocked outright for the whole company, each with the reason it was blocked. Remove takes an entry off the list so that sender can reach people again.

Every row looks the same, the way a real console presents them. You decide from the sender address, the subject line and the reason it was held.

The reason on a blocked sender is the policy label, the same way a real gateway records why an entry exists.

A commercial filter puts more in front of you, and every addition changes what a release decision gets made from. Every quarantined row names the policy that caught it, so you can see which rule fired and whether that rule is the one misbehaving. A release can be made for everybody at once, which is what you actually want when one legitimate newsletter landed in ninety mailboxes, and a false negative can be reported back to the vendor so the verdict improves for the next customer. Users get their own quarantine digest, a scheduled mail listing what was held for them, with a release control on each line, and a large share of these tickets never reaches the desk because of it. And each row shows its SPF, DKIM and DMARC results, so "the sender says they sent it" is answerable from the record.

One more sits in the mail client itself: the report-a-phish button, which is how a user-reported phish reaches security at a company that has one. One press and the message goes to the security team with its full headers attached. At most small companies the report arrives as a ticket instead, in words, which is the version you practice here and the harder one to work.

If the message never reached the mailbox, this console owns the answer.

The filter runs in front of EXCH01, so a message it held was never delivered and was never in a folder. You can read the verdict in Mail Admin, on the Message Trace tab, where the row will say Quarantined with its SCL score, or Failed with 550 5.7.1 Message rejected by policy for a blocked sender. Reading is where the trace stops. Acting on the verdict happens here.

The word Quarantined on a trace row sends you to this console. The message stopped at the gateway and is still sitting there, so the release decision gets made here.