Package 1 · Backup MX
Secondary MX, temporary queuing during destination outages and automatic delivery on recovery. No mailbox pre-check, AntiSpam, Antivirus, content inspection or quarantine.
SECURAWALL MAILFLOW
SecuraWall MailFlow Email Security
DOMAIN AND EMAIL PROTECTION
Security you can understand and control
Package 1 has no message protection scanning. Package 2 adds configurable message checks. Ownership, relay isolation, delivery safety and infrastructure limits apply to every package.
Package 2 · Email Protection
Primary MX gateway with configurable AntiSpam, Antivirus, sender-domain checks and quarantine. Publish only gate.securawall.com and configure a separate manual receiving target. Queuing and recovery remain included.
Optional SMTP Relay add-on
Add authorized outbound delivery to either Package 1 or 2 for the same domain. Separate add-on pricing, approval, server credentials, quotas, TLS and verified SPF apply. Customer-domain DKIM signing is optional and recommended. Incoming protection remains determined by the base package.
Explore packages and add-ons
Link and attachment policies · Package 2
Configure misleading-link, risky attachment and unreadable-content handling. Filename and file-type controls are separate from actual VBA analysis; overlapping security checks keep their own decisions.
Antivirus protection
In Package 2, the antivirus scanner checks incoming mail for malware when enabled. Detected malware is rejected before queue acceptance and detection notices are queued to the customer and administrator. The global administrator switch overrides domain choices; customers can disable scanning for their own domains. Encrypted contents cannot be inspected.
Spam and sender reputation
In Package 2, the spam filter checks message content and sender reputation. Sender blocklist checks, reverse DNS scoring and configurable thresholds help control unwanted email.
SPF, DKIM and DMARC checks · Package 2
Authentication and content signals contribute to spam analysis. Reverse DNS, HELO and sender domain names do not have to match exactly.
Domain ownership monitoring
DNS TXT proves control of a domain during purchase. Checks approximately every five minutes pause service when ownership cannot be verified, with customer email notices on pause and recovery.
Safe delivery destinations
Delivery hostnames are checked approximately every five minutes. Private, loopback and gateway IP addresses are blocked. Unsafe or unresolved targets cause temporary delivery deferral.
Protected account operations
Authenticated customer access, request verification and account isolation protect domain changes. Destructive account operations require password confirmation.
Account isolation and audit trails
Customers see their own domains, queues and activity. Logs show client IP addresses and changes to settings; password values are excluded.
Missing, changed or unverifiable ownership TXT records temporarily pause new mail acceptance and queued delivery. An unsafe delivery target temporarily defers queued messages until it is corrected, subject to the normal 14-day queue lifetime. The gateway adds no mandatory certificate requirement for your primary mail server.
Protection on the primary gateway route
Email Protection requires SecuraWall as the only published MX and a manually configured delivery target for your receiving server. Enabled protection applies to incoming mail passing through that primary gateway. Direct delivery to the real server still bypasses the gateway unless the receiving server restricts it. Protected packages inspect incoming mail routed through SecuraWall; hosted mailboxes and guaranteed detection of every threat are not included.
Controls, with explicit limits
Ownership TXT and MX checks restrict mail acceptance to configured domains. Delivery checks reject private, loopback and gateway destinations. Checks run approximately every five minutes; detection is not instantaneous.
Spam scoring includes sender reputation, reverse DNS, content and authentication signals. Antivirus and link / attachment controls depend on global and domain settings. Administrators can disable antivirus globally; customers cannot override that switch. These controls reduce risk but do not detect every threat. Encrypted contents cannot be inspected.
Forwarding and authentication
Sender rewriting supports forwarding SPF checks for the SMTP envelope. It does not guarantee DMARC alignment. Original DKIM signatures must remain valid for aligned DKIM authentication; receiver policies and message changes can affect the result. Your primary system must be configured to accept legitimate forwarded mail.
Access and operational data
The portal uses HTTPS, authenticated account access, account-scoped domain views and request verification. Optional two-step verification is available. SMTP transport encryption depends on the receiving server; this is not end-to-end message encryption.
Collected delivery metadata, SMTP status transitions and protection event history are retained for 90 days. History collection and email alerts may be delayed or incomplete; logs are not a full message archive. No uptime SLA, reserved capacity, inbox placement or customer mailbox recovery guarantee is advertised here.
Protection and portal capabilities
Message inspection and personal quarantine are available in Email Protection (base Package 2). Backup MX provides queuing and delivery without content scanning. Availability depends on package, enabled controls and supported analysis limits.
Click-time Link Protection
Email Protection (base Package 2)
When link protection is enabled, supported links open a check screen.
Scope and limits
When link protection is enabled, supported links open a check screen. Current domain registration, authorization and configured blocklists are checked when the link is clicked and again when the user selects Continue. Bounded static inspection follows up to four redirects and checks HTTP/static refresh destinations and cross-origin password forms. Public-only address checks and TLS verification constrain requests. Incomplete inspection offers no Continue. Destination-visible GET requests can consume one-time links. Optional server-managed Google Web Risk Lookup checks phishing, malware and unwanted-software reputation; full checked URLs, including path and query, are sent to Google. API errors and local quota exhaustion offer no Continue when enabled. A URL that is not listed may still be unsafe. No JavaScript execution is provided. Rewriting can invalidate original DKIM/ARC signatures downstream.
BEC & Impersonation Protection
Email Protection (base Package 2)
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals.
Scope and limits
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals. Configure protected display names and approved sender addresses per domain. Bounded checks compare Sender and Reply-To lookalikes with the recipient domain. Local English/Turkish heuristics combine bank-change/payment-request language, pressure and identity/Reply-To signals. Separate actions cover identity, similar domains, payment risk and incomplete analysis. Protected-name matching requires configured names. False positives are possible; checks do not verify a transaction or identify every compromised sender.
Attachment Threat Analysis
Email Protection (base Package 2)
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory.
Scope and limits
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory. ZIP inspection is bounded to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio. Unsupported, encrypted, corrupt or over-limit content remains partial. Choose separate suspicious/incomplete Accept, Quarantine or Reject actions. False positives are possible. This supplements Antivirus and Advanced Threat Signatures; no sandbox, complete malware coverage or detection rate is claimed.
QR & Image Analysis
Email Protection (base Package 2)
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email.
Scope and limits
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email. Configured global/domain blocked targets can select Accept, Quarantine or Reject independently of the zero score observations. A separate action handles incomplete inspection. No URL is opened by this image scanner and no automatic reputation feed is used. Remaining pages, unsupported formats and limits are partial coverage; no finding is a clean-mail verdict.
Attachment file-type controls
Email Protection (base Package 2)
Select filename extensions or add custom extensions to the Antivirus file-type list.
Scope and limits
Select filename extensions or add custom extensions to the Antivirus file-type list. A matching Accept, Quarantine or Reject applies to the whole message; attachments are never silently removed. Filename matching is separate from file contents, Office VBA analysis and malware detection. Renaming a file can change its filename match; Accept never cancels another security decision.
Office VBA analysis
Email Protection (base Package 2)
Inspect supported file contents for actual VBA macros and suspicious static indicators.
Scope and limits
Inspect supported file contents for actual VBA macros and suspicious static indicators. Configure separate Accept, Quarantine or Reject actions for macro presence, suspicious heuristics and incomplete analysis. This is static analysis, not sandbox execution.
Advanced Threat Signatures
Email Protection (base Package 2)
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail.
Scope and limits
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail. Domain settings can inherit server defaults or use an override. Scanner readiness and enabled AntiSpam are required.
Personal quarantine and aliases
Email Protection (base Package 2)
Give mailbox users access to authorized held mail for their primary address and linked aliases.
Scope and limits
Give mailbox users access to authorized held mail for their primary address and linked aliases. Aliases share the primary account credentials and quota. Personal quota overflow stays held for IT review.
IT release requests
Email Protection (base Package 2)
Mailbox users can request IT review of eligible held messages.
Scope and limits
Mailbox users can request IT review of eligible held messages. IT sees pending requests and can receive configured email notifications. Authorized release requires fresh checks; submission to the delivery queue and destination SMTP acceptance are separate results.
Mail traffic and account activity
All packages
Use Logs to distinguish mail traffic from account activity.
Scope and limits
Use Logs to distinguish mail traffic from account activity. Recorded setting changes include named old and new values where available. Customer access stays scoped to the account; historical records may contain less detail.
Brute Force Protection
All packages
Configured login and SMTP authentication protections limit repeated failed attempts.
Scope and limits
Configured login and SMTP authentication protections limit repeated failed attempts. This account and server protection is separate from message content filtering; enabled controls and administrator settings determine coverage.
Outbound text DLP
SMTP Relay add-on · optional outbound policy
Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments.
Scope and limits
Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments. Observe/SMTP Reject and incomplete Observe/temporary-failure actions apply only to eligible authenticated SMTP Relay with an external exact-domain recipient. Defaults off. PDF, Office, images, archives and attached messages are outside coverage. Matched values are excluded from DLP output. Native enforcement and mailbox delivery require separate deployment validation.
Choose Security in the main menu for analysis scope, or Company → What’s new for release details.
Security and delivery settings
These are available controls, not a claim that every switch is enabled. Administrator global policy, domain settings, package rights and device policy determine the applied behavior.
| Control | Scope | What it does |
|---|---|---|
| Registered domain and service state | All packages | Receiving is restricted to registered, enabled recipient domains with valid ownership and service status. No portal username, mailbox password or SMTP AUTH is required from an incoming sender. Portal account login protects management operations only. |
| MX and destination safety | Package-specific | Backup MX uses a less-preferred secondary MX alongside your real primary MX records. Email Protection (base Package 2) requires gate.securawall.com as the only published MX and a separately saved manual delivery destination. Never discover the destination from the protected domain MX or point delivery back to SecuraWall. Current delivery target safety checks require validated public IPv4 addresses and, when explicitly enabled, validated public IPv6 addresses. Unsafe destinations are deferred. |
| Delivery TLS | All packages | Choose whether TLS is required, whether invalid certificates are accepted and whether legacy TLS versions are disabled. Certificate verification can use a configured server hostname. These are transport settings, not content inspection. |
| Message and queue limits | All packages | Administrators configure complete-message size, queue retention and retry timing. Domain size limits can be lower. A server outage does not reset message age. |
| Connection and rate limits | All packages · Administrator | Incoming-listener limits cover total concurrent connections, connections per host, emails per connection, recipients per email, emails per minute per host and connections per second per host. These protect service resources; Package 1 still has no spam or antivirus scanning. |
| DNS/SMTP monitoring and notifications | All packages | Administrators set DNS query budgets, SMTP timeouts, check concurrency and cycle budgets. Customers and administrators can configure available notification preferences. Background checks do not replace real delivery results. |
| Outbound text DLP | SMTP Relay add-on · Authenticated outbound only | Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments. Observe/SMTP Reject and incomplete Observe/temporary-failure actions apply only to eligible authenticated SMTP Relay with an external exact-domain recipient. Defaults off. PDF, Office, images, archives and attached messages are outside coverage. Matched values are excluded from DLP output. Native enforcement and mailbox delivery require separate deployment validation. |
| Sending approval and device credentials | SMTP Relay add-on | Administrator approval, an enabled device account and an authorized eligible sender domain are required. A verified domain alone does not enable outbound sending. SMTP AUTH verifies the issued device credentials, not a portal login or an individual mailbox password. Sender authorization is at the permitted domain level; it is not a sender-mailbox existence lookup. |
| Device transport policy | SMTP Relay add-on | STARTTLS on port 587 or implicit TLS on port 465. Encryption is required on both submission listeners. Match the client TLS mode to the port; plaintext authentication is unavailable. |
| Sender authorization and quotas | SMTP Relay add-on · Administrator | Anonymous relay and unauthorized sender domains are rejected. Administrators control recipient budgets per minute, hour and day; customer/domain/device ceilings apply together. Customers cannot raise approved quotas. |
| Submission DoS limits | SMTP Relay add-on · Administrator | Separate sending-listener limits cover concurrent connections, per-host connections, messages per connection, recipients per message and per-host message/connection rates. |
| Customer DKIM signing | SMTP Relay add-on | Create and publish a domain selector TXT record, verify it and enable signing. Signing needs current sending eligibility. Keys can be disabled or deleted; removal of the public DNS TXT record is a separate task. |
Explore packages and add-ons
Related technical guidance
Queue, capacity and deletion conditions
Current plan: up to 14 days in the delivery queue; retries approximately every 3 minutes; maximum complete encoded message 50 MiB (52,428,800 bytes). Attachments grow when encoded. A domain may have a lower message limit.
No per-message charge or advertised message-count cap. Storage is finite and shared: there is no unlimited disk allocation or reserved per-domain capacity. Acceptance remains subject to available resources, active service and configured security policies.
A destination SMTP acceptance removes the message from the delivery queue; it does not prove delivery to an inbox. Temporary 4xx failures are retried within the remaining lifetime. Permanent 5xx failures normally end that delivery attempt with a failure notification. These notifications can themselves fail.
Undelivered mail expires after the configured lifetime, including time spent paused. Quarantined mail is removed at its retention deadline. Confirmed domain deletion permanently purges queued and held messages. If a queued message has recipients in multiple domains, deleting it removes it for every pending recipient. Delivered, expired or deleted messages are not a customer archive.
Ready to configure your domain?
Review the setup and conditions before purchasing.
Choose your package Contact the team