SecuraWall MailFlow Features

When link protection is enabled, supported links open a check screen. Current domain registration, authorization and configured blocklists are checked when the link is clicked and again when the user selects Continue. Bounded static inspection follows up to four redirects and checks HTTP/static refresh destinations and cross-origin password forms. Public-only address checks and TLS verification constrain requests. Incomplete inspection offers no Continue. Destination-visible GET requests can consume one-time links. Optional server-managed Google Web Risk Lookup checks phishing, malware and unwanted-software reputation; full checked URLs, including path and query, are sent to Google. API errors and local quota exhaustion offer no Continue when enabled. A URL that is not listed may still be unsafe. No JavaScript execution is provided. Rewriting can invalidate original DKIM/ARC signatures downstream.

Business email compromise (BEC) checks help identify supported impersonation and payment-request signals. Configure protected display names and approved sender addresses per domain. Bounded checks compare Sender and Reply-To lookalikes with the recipient domain. Local English/Turkish heuristics combine bank-change/payment-request language, pressure and identity/Reply-To signals. Separate actions cover identity, similar domains, payment risk and incomplete analysis. Protected-name matching requires configured names. False positives are possible; checks do not verify a transaction or identify every compromised sender.

Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory. ZIP inspection is bounded to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio. Unsupported, encrypted, corrupt or over-limit content remains partial. Choose separate suspicious/incomplete Accept, Quarantine or Reject actions. False positives are possible. This supplements Antivirus and Advanced Threat Signatures; no sandbox, complete malware coverage or detection rate is claimed.

Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email. Configured global/domain blocked targets can select Accept, Quarantine or Reject independently of the zero score observations. A separate action handles incomplete inspection. No URL is opened by this image scanner and no automatic reputation feed is used. Remaining pages, unsupported formats and limits are partial coverage; no finding is a clean-mail verdict.

Select filename extensions or add custom extensions to the Antivirus file-type list. A matching Accept, Quarantine or Reject applies to the whole message; attachments are never silently removed. Filename matching is separate from file contents, Office VBA analysis and malware detection. Renaming a file can change its filename match; Accept never cancels another security decision.

Inspect supported file contents for actual VBA macros and suspicious static indicators. Configure separate Accept, Quarantine or Reject actions for macro presence, suspicious heuristics and incomplete analysis. This is static analysis, not sandbox execution.

Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail. Domain settings can inherit server defaults or use an override. Scanner readiness and enabled AntiSpam are required.

Give mailbox users access to authorized held mail for their primary address and linked aliases. Aliases share the primary account credentials and quota. Personal quota overflow stays held for IT review.

Mailbox users can request IT review of eligible held messages. IT sees pending requests and can receive configured email notifications. Authorized release requires fresh checks; submission to the delivery queue and destination SMTP acceptance are separate results.

Use Logs to distinguish mail traffic from account activity. Recorded setting changes include named old and new values where available. Customer access stays scoped to the account; historical records may contain less detail.

Configured login and SMTP authentication protections limit repeated failed attempts. This account and server protection is separate from message content filtering; enabled controls and administrator settings determine coverage.

Open a Queue ID to follow recorded delivery attempts, SMTP responses, security decisions and rule contributions. A local submission result, destination acceptance and inbox placement are different outcomes.

SMTP Relay add-on adds approved device credentials, authorized sender domains, customer-domain DKIM and customer/domain/device recipient quotas. Incoming content inspection does not imply identical inspection of authenticated outgoing mail.

Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments. Observe/SMTP Reject and incomplete Observe/temporary-failure actions apply only to eligible authenticated SMTP Relay with an external exact-domain recipient. Defaults off. PDF, Office, images, archives and attached messages are outside coverage. Matched values are excluded from DLP output. Native enforcement and mailbox delivery require separate deployment validation.