When would I use it?
When incoming invoices, attachments and links need configured checks before reaching your mail platform.
PACKAGE 2
Email Protection
Primary MX gateway: all incoming mail enters SecuraWall for enabled protection and quarantine, with queuing during destination outages.
THE EVERYDAY USE CASE
Put an inspection layer before your mail server
What do I gain?
Enabled threat checks, quarantine review and recorded delivery decisions in one gateway.
Without this layer
Protection depends on the controls provided by your receiving server or another gateway.
The route at a glance
- Mail enters SecuraWallSecuraWall is your only published MX.
- Enabled checks runPolicies may accept, reject or hold a message for review.
- Accepted mail continuesDelivery goes to the saved real receiving server; outages queue within limits.
Know the service boundary
Review before release
Authorized IT and mailbox users see their eligible quarantine scope.
Keep your mail platform
Save the actual receiving target before switching MX.
Outgoing relay is optional
SMTP Relay is a separate add-on; it does not come with the base price.
What Email Protection gives you
Protect the incoming route
With SecuraWall as the only published MX, incoming mail reaches the protection gateway before your real mail server. Queuing and retry remain available during a destination outage.
Hold suspected spam for review
Eligible spam can be held for an authorized review and release instead of immediately reaching the receiving server.
Choose controlled protection
Use this package when you need content, malware and sender checks on the primary gateway route, without outbound sending through SecuraWall.
Free Setup Assistance and Unlimited Technical Support Tickets are included. Your mailboxes remain on your existing server.
Protection and portal capabilities
Message inspection and personal quarantine are available in Email Protection (base Package 2). Backup MX provides queuing and delivery without content scanning. Availability depends on package, enabled controls and supported analysis limits.
Click-time Link Protection
Email Protection (base Package 2)
When link protection is enabled, supported links open a check screen.
Scope and limits
When link protection is enabled, supported links open a check screen. Current domain registration, authorization and configured blocklists are checked when the link is clicked and again when the user selects Continue. Bounded static inspection follows up to four redirects and checks HTTP/static refresh destinations and cross-origin password forms. Public-only address checks and TLS verification constrain requests. Incomplete inspection offers no Continue. Destination-visible GET requests can consume one-time links. Optional server-managed Google Web Risk Lookup checks phishing, malware and unwanted-software reputation; full checked URLs, including path and query, are sent to Google. API errors and local quota exhaustion offer no Continue when enabled. A URL that is not listed may still be unsafe. No JavaScript execution is provided. Rewriting can invalidate original DKIM/ARC signatures downstream.
BEC & Impersonation Protection
Email Protection (base Package 2)
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals.
Scope and limits
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals. Configure protected display names and approved sender addresses per domain. Bounded checks compare Sender and Reply-To lookalikes with the recipient domain. Local English/Turkish heuristics combine bank-change/payment-request language, pressure and identity/Reply-To signals. Separate actions cover identity, similar domains, payment risk and incomplete analysis. Protected-name matching requires configured names. False positives are possible; checks do not verify a transaction or identify every compromised sender.
Attachment Threat Analysis
Email Protection (base Package 2)
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory.
Scope and limits
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory. ZIP inspection is bounded to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio. Unsupported, encrypted, corrupt or over-limit content remains partial. Choose separate suspicious/incomplete Accept, Quarantine or Reject actions. False positives are possible. This supplements Antivirus and Advanced Threat Signatures; no sandbox, complete malware coverage or detection rate is claimed.
QR & Image Analysis
Email Protection (base Package 2)
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email.
Scope and limits
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email. Configured global/domain blocked targets can select Accept, Quarantine or Reject independently of the zero score observations. A separate action handles incomplete inspection. No URL is opened by this image scanner and no automatic reputation feed is used. Remaining pages, unsupported formats and limits are partial coverage; no finding is a clean-mail verdict.
Attachment file-type controls
Email Protection (base Package 2)
Select filename extensions or add custom extensions to the Antivirus file-type list.
Scope and limits
Select filename extensions or add custom extensions to the Antivirus file-type list. A matching Accept, Quarantine or Reject applies to the whole message; attachments are never silently removed. Filename matching is separate from file contents, Office VBA analysis and malware detection. Renaming a file can change its filename match; Accept never cancels another security decision.
Office VBA analysis
Email Protection (base Package 2)
Inspect supported file contents for actual VBA macros and suspicious static indicators.
Scope and limits
Inspect supported file contents for actual VBA macros and suspicious static indicators. Configure separate Accept, Quarantine or Reject actions for macro presence, suspicious heuristics and incomplete analysis. This is static analysis, not sandbox execution.
Advanced Threat Signatures
Email Protection (base Package 2)
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail.
Scope and limits
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail. Domain settings can inherit server defaults or use an override. Scanner readiness and enabled AntiSpam are required.
Personal quarantine and aliases
Email Protection (base Package 2)
Give mailbox users access to authorized held mail for their primary address and linked aliases.
Scope and limits
Give mailbox users access to authorized held mail for their primary address and linked aliases. Aliases share the primary account credentials and quota. Personal quota overflow stays held for IT review.
IT release requests
Email Protection (base Package 2)
Mailbox users can request IT review of eligible held messages.
Scope and limits
Mailbox users can request IT review of eligible held messages. IT sees pending requests and can receive configured email notifications. Authorized release requires fresh checks; submission to the delivery queue and destination SMTP acceptance are separate results.
Mail traffic and account activity
All packages
Use Logs to distinguish mail traffic from account activity.
Scope and limits
Use Logs to distinguish mail traffic from account activity. Recorded setting changes include named old and new values where available. Customer access stays scoped to the account; historical records may contain less detail.
Brute Force Protection
All packages
Configured login and SMTP authentication protections limit repeated failed attempts.
Scope and limits
Configured login and SMTP authentication protections limit repeated failed attempts. This account and server protection is separate from message content filtering; enabled controls and administrator settings determine coverage.
Delivery history and security details
All packages
Open a Queue ID to follow recorded delivery attempts, SMTP responses, security decisions and rule contributions.
Scope and limits
Open a Queue ID to follow recorded delivery attempts, SMTP responses, security decisions and rule contributions. A local submission result, destination acceptance and inbox placement are different outcomes.
Choose Security in the main menu for analysis scope, or Company → What’s new for release details.
Installation steps
- Choose and verifySelect the base package and keep your ownership TXT record published.
- Connect the routeKeep primary MX for Backup MX; set the real manual target and only SecuraWall MX for Email Protection.
- Check the outcomeTest your own domain and review the recorded queue, scan and destination result.
Full setup checklist
Select and activate the package
Create an account, verify an independent recovery email, choose the domain package and complete its initial payment.
Prove domain ownership
Publish the exact TXT token displayed in the portal. Keep this record published while the service is active.
Save the real receiving destination first
Save the real public mail-server hostname/IP and SMTP port as a manual delivery target. Test it before changing DNS. Do not use the domain MX for destination discovery; those records will point to SecuraWall.
Publish SecuraWall as the only MX
After the real delivery target is saved and verified, remove the other MX records for this domain and publish only gate.securawall.com. A direct MX to the receiving server would bypass gateway protection. MX preference is not a failover choice when there is only one record.
Set delivery and notifications
Review TLS/certificate policy, complete-message size and the applicable queue lifetime. Enable the notification preferences you need.
Verify outage and recovery
With the primary available, confirm a temporary refusal and its log. During a controlled outage, send a uniquely identified message to a real recipient you control; confirm queuing and one delivery after recovery.
Choose the protection policy
Review global administrator switches and available domain controls for spam, antivirus, identity/authentication and link/attachment signals. Start with monitored content policies where appropriate.
Verify quarantine and outcomes
Use an authorized synthetic test. Confirm the intended mark, rejection or quarantine decision; release a held test and confirm its destination result.
Protocol decisions and responsibility
SMTP outcomes and mailbox responsibilities
The recipient probe is a limited SMTP observation, not a directory lookup or a user login. Only an explicit unknown-recipient result causes early rejection. A timeout, temporary refusal, TLS problem, insufficient probe capacity or catch-all response cannot establish mailbox existence. Enabled message policies then apply to the accepted transaction.
No mailbox accounts are created or synchronized. Domain ownership verification proves control of the domain; it does not verify each mailbox. A local queue response proves gateway acceptance. A remote 2xx response proves acceptance by the receiving SMTP system, not inbox placement or user reading. Temporary failures retry within the queue lifetime; permanent failures and expiry can produce a delivery failure notification, which can itself fail.
Security and delivery settings
Security and delivery settings
These are available controls, not a claim that every switch is enabled. Administrator global policy, domain settings, package rights and device policy determine the applied behavior.
| Control | Scope | What it does |
|---|---|---|
| Registered domain and service state | All packages | Receiving is restricted to registered, enabled recipient domains with valid ownership and service status. No portal username, mailbox password or SMTP AUTH is required from an incoming sender. Portal account login protects management operations only. |
| MX and destination safety | Package-specific | Backup MX uses a less-preferred secondary MX alongside your real primary MX records. Email Protection (base Package 2) requires gate.securawall.com as the only published MX and a separately saved manual delivery destination. Never discover the destination from the protected domain MX or point delivery back to SecuraWall. Current delivery target safety checks require validated public IPv4 addresses and, when explicitly enabled, validated public IPv6 addresses. Unsafe destinations are deferred. |
| Delivery TLS | All packages | Choose whether TLS is required, whether invalid certificates are accepted and whether legacy TLS versions are disabled. Certificate verification can use a configured server hostname. These are transport settings, not content inspection. |
| Message and queue limits | All packages | Administrators configure complete-message size, queue retention and retry timing. Domain size limits can be lower. A server outage does not reset message age. |
| Connection and rate limits | All packages · Administrator | Incoming-listener limits cover total concurrent connections, connections per host, emails per connection, recipients per email, emails per minute per host and connections per second per host. These protect service resources; Package 1 still has no spam or antivirus scanning. |
| DNS/SMTP monitoring and notifications | All packages | Administrators set DNS query budgets, SMTP timeouts, check concurrency and cycle budgets. Customers and administrators can configure available notification preferences. Background checks do not replace real delivery results. |
| Attachment file-type list | Email Protection (base Package 2) · Incoming | Select built-in extensions or add custom filename extensions. A matching action applies to the whole message. Filename rules, malware scanning, Office VBA and static attachment heuristics are independent controls; Accept does not cancel a different rule. |
| Attachment Threat Analysis | Email Protection (base Package 2) · Incoming | Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory. ZIP inspection is bounded to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio. Unsupported, encrypted, corrupt or over-limit content remains partial. Choose separate suspicious/incomplete Accept, Quarantine or Reject actions. False positives are possible. This supplements Antivirus and Advanced Threat Signatures; no sandbox, complete malware coverage or detection rate is claimed. |
| QR and image actions | Email Protection (base Package 2) · Incoming | Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email. Configured global/domain blocked targets can select Accept, Quarantine or Reject independently of the zero score observations. A separate action handles incomplete inspection. No URL is opened by this image scanner and no automatic reputation feed is used. Remaining pages, unsupported formats and limits are partial coverage; no finding is a clean-mail verdict. |
| BEC and impersonation actions | Email Protection (base Package 2) · Incoming | Business email compromise (BEC) checks help identify supported impersonation and payment-request signals. Configure protected display names and approved sender addresses per domain. Bounded checks compare Sender and Reply-To lookalikes with the recipient domain. Local English/Turkish heuristics combine bank-change/payment-request language, pressure and identity/Reply-To signals. Separate actions cover identity, similar domains, payment risk and incomplete analysis. Protected-name matching requires configured names. False positives are possible; checks do not verify a transaction or identify every compromised sender. |
| Click-time Link Protection | Email Protection (base Package 2) · Incoming | When link protection is enabled, supported links open a check screen. Current domain registration, authorization and configured blocklists are checked when the link is clicked and again when the user selects Continue. Bounded static inspection follows up to four redirects and checks HTTP/static refresh destinations and cross-origin password forms. Public-only address checks and TLS verification constrain requests. Incomplete inspection offers no Continue. Destination-visible GET requests can consume one-time links. Optional server-managed Google Web Risk Lookup checks phishing, malware and unwanted-software reputation; full checked URLs, including path and query, are sent to Google. API errors and local quota exhaustion offer no Continue when enabled. A URL that is not listed may still be unsafe. No JavaScript execution is provided. Rewriting can invalidate original DKIM/ARC signatures downstream. |
| Recipient address probe | Email Protection (base Package 2) · Incoming | Before accepting the message body, the real receiving server can be probed with MAIL FROM and RCPT TO, without DATA or mailbox credentials. Only an explicit 5xx / 5.1.1 unknown-recipient result rejects early. Offline, slow, rate-limited, TLS-failed or otherwise uncertain results do not prove a missing mailbox; mail proceeds to queuing. Catch-all acceptance does not prove that an individual mailbox exists. |
| AntiSpam switches and thresholds | Email Protection (base Package 2) | Global and domain enable/disable switches, sender reputation/blocklist scoring, reverse-DNS scoring, HELO scoring, mark/reject thresholds and optional spam quarantine. Administrator global settings govern what domain settings can enable. |
| SMTP identity policy | Email Protection (base Package 2) | Optional rejection of invalid HELO/EHLO syntax or missing reverse DNS. A correctly formatted greeting does not prove that a sender is trustworthy. |
| Sender-domain authentication | Email Protection (base Package 2) | SPF and DMARC results can contribute to enabled spam analysis. DKIM verification has an enable switch and configurable handling for invalid/missing signatures and permanent or temporary verification errors. Temporary verification failures cannot be configured as permanent rejection. |
| Antivirus and scanner failure | Email Protection (base Package 2) | Global/domain scanning switches and scanner-failure handling. Detected malware is rejected before queue acceptance. Scanner unavailability can temporarily defer acceptance or reject according to policy. |
| Link and attachment policy | Email Protection (base Package 2) | Separate content, filename and file-type controls can Accept, Quarantine or Reject according to the configured policy. A macro-capable extension is a risk signal, not proof of actual VBA. Enabled rules can overlap; accepting one category does not bypass another security decision. |
| Office VBA actions | Email Protection (base Package 2) · Incoming | Supported file contents are inspected for actual VBA and suspicious macro heuristics independently of the filename. Separate actions cover macro presence, suspicious heuristics and incomplete analysis. Static observation does not execute macros, provide CDR or establish an antivirus-clean verdict. |
| Advanced Threat Signatures | Email Protection (base Package 2) · Incoming | Manage domain actions from Domains / Settings / Advanced Threat Signatures. Inherit server defaults or override supported family actions. Administrator scanner readiness and enabled AntiSpam are required; Backup MX and authenticated sending are excluded. |
| Quarantine and release | Email Protection (base Package 2) | Configured spam and policy holds stay separate from delivery retries. Personal users see only authorized primary/alias messages and can request IT review. IT has pending requests and configured email notifications. Elevated-risk holds require IT review and a fresh antivirus check before authorized release. Release submits mail for delivery; it does not prove inbox placement. |
How the package works
- Registered routeCurrent ownership and service status are checked.
- Package policyBackup MX queues during outages; Email Protection applies enabled controls.
- Delivery resultReview destination SMTP acceptance separately from inbox placement.
Detailed protocol flow
Incoming mail never requires a portal login or mailbox password. Temporary delivery failures remain queued within the configured lifetime. Permanent delivery rejection or expiry can generate a failure notification. Remote SMTP acceptance is separate from inbox placement.
Choosing and renewing this package
Package changes and manual renewal
One active package per domain. During an active period, an upgrade has no immediate charge and keeps its end date. The next manual renewal uses the selected package price. Downgrades apply at the paid period end. Moving between Backup MX and protected packages also changes DNS topology: save the real destination before a primary-gateway switch; restore the real primary MX when returning to secondary Backup MX. Check the saved gateway mode before changing DNS, especially on an older registration. Renew selected package opens the current package payment screen directly.
Current monthly price: USD 45.00 per domain, taxes included.
Choose Email ProtectionMX routing and scope details
Backup MX handles mail reaching its secondary route. Email Protection uses the only published MX; the SMTP Relay add-on keeps the existing receiving route; a separate manual target delivers to the real mail server. MX selection does not reroute mail already queued by another sender or prevent direct connections to the receiving server; restrict direct delivery there if required. These packages do not include hosted mailboxes, outage webmail or a permanent mailbox archive.