See how SecuraWall checks supported attachments, QR codes, suspicious sender identities and protected links. Explore the limits of outbound text DLP and the security results recorded in your portal.
Protection follows your package
Backup MX: secondary queue and delivery only, without content scanning or pre-acceptance mailbox lookup. Email Protection: the only published MX, with enabled inbound checks and quarantine. SMTP Relay: a separate outbound relay add-on for an active Package 1 or 2. Your existing mailboxes stay with your provider.
PART OF OUR EMAIL PROTECTION
Google Web Risk Lookup
Google Web Risk adds checks for known phishing, malware and unwanted-software URLs to Click-time Link Protection.
Available with Email Protection when server-side Google integration, domain link wrapping and required protection controls are enabled. Checks run before supported destination and redirect requests and again on Continue. Backup MX does not include content inspection.
What is checked?
Wrapped HTTP(S) links and supported redirect destinations
Supported password-form actions during static inspection
Current domain authorization and policy at click time
Privacy and inspection limits
Full checked URLs, including path and query, are sent to Google and may contain personal information or access tokens. No email body, attachment, sender, recipient or SecuraWall token is submitted. If enabled checks fail or the local API quota is exhausted, the Continue option is unavailable. A URL that is not listed may still be unsafe. Static inspection does not execute JavaScript.
URL reputation provided by Google Web Risk. Protection is not guaranteed: some risky sites may be missed and safe sites may be identified in error. The provider name identifies the service used and does not imply endorsement.
Sender authentication
SPF checks the connecting sender against its domain policy. DKIM verifies a message signature. DMARC evaluates alignment with the visible From domain. Protected inbound messages can carry the recorded authentication results to your receiving system.
Spam scoring
Message headers, content and sender-reputation signals contribute to a total spam score. Configure separate tagging and rejection thresholds. With quarantine enabled, eligible messages are held for review instead of entering normal delivery.
Malware inspection
When enabled, antivirus inspection uses signatures and supported heuristic signals. Archives and documents are inspected within engine format and resource limits. Encrypted content may remain unreadable; an incomplete inspection is not treated as a clean scan.
Links and attachments
Configured rules can monitor or reject misleading-link signals, malicious URL matches and risky attachment types. A macro-capable document type is a risk indicator, not proof of a malicious macro.
Policy choices
Administrators manage global controls; eligible customers manage their domain settings. DKIM policies distinguish missing signatures, invalid signatures, permanent key errors and temporary verification failures. A score policy and a reject policy have different outcomes.
Evidence in your portal
Open a Queue ID in Delivery history to inspect the recorded total score, decision, sender checks and individual rule contributions. “Not recorded” means no result is available. It does not mean the check passed.
Secure the delivery connection
Domain settings can require TLS, validate the receiving certificate and define an expected server name. Mandatory TLS failures defer delivery. Compatibility settings may allow different behavior. SMTP transport is not end-to-end message encryption. Device submission supports STARTTLS on 587 and TLS on 465.
Inspection depends on configured controls and supported formats. The service does not claim sandbox detonation or guaranteed detection of every new threat.
Protection and portal capabilities
Message inspection and personal quarantine are available in Email Protection (base Package 2). Backup MX provides queuing and delivery without content scanning. Availability depends on package, enabled controls and supported analysis limits.
Click-time Link Protection
Email Protection (base Package 2)
When link protection is enabled, supported links open a check screen.
Scope and limits
When link protection is enabled, supported links open a check screen. Current domain registration, authorization and configured blocklists are checked when the link is clicked and again when the user selects Continue. Bounded static inspection follows up to four redirects and checks HTTP/static refresh destinations and cross-origin password forms. Public-only address checks and TLS verification constrain requests. Incomplete inspection offers no Continue. Destination-visible GET requests can consume one-time links. Optional server-managed Google Web Risk Lookup checks phishing, malware and unwanted-software reputation; full checked URLs, including path and query, are sent to Google. API errors and local quota exhaustion offer no Continue when enabled. A URL that is not listed may still be unsafe. No JavaScript execution is provided. Rewriting can invalidate original DKIM/ARC signatures downstream.
BEC & Impersonation Protection
Email Protection (base Package 2)
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals.
Scope and limits
Business email compromise (BEC) checks help identify supported impersonation and payment-request signals. Configure protected display names and approved sender addresses per domain. Bounded checks compare Sender and Reply-To lookalikes with the recipient domain. Local English/Turkish heuristics combine bank-change/payment-request language, pressure and identity/Reply-To signals. Separate actions cover identity, similar domains, payment risk and incomplete analysis. Protected-name matching requires configured names. False positives are possible; checks do not verify a transaction or identify every compromised sender.
Attachment Threat Analysis
Email Protection (base Package 2)
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory.
Scope and limits
Optional local scanning applies a versioned starter pack of three static script heuristics to decoded attachment bytes and supported ZIP members in memory. ZIP inspection is bounded to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio. Unsupported, encrypted, corrupt or over-limit content remains partial. Choose separate suspicious/incomplete Accept, Quarantine or Reject actions. False positives are possible. This supplements Antivirus and Advanced Threat Signatures; no sandbox, complete malware coverage or detection rate is claimed.
QR & Image Analysis
Email Protection (base Package 2)
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email.
Scope and limits
Decode QR codes and use optical character recognition (OCR) to extract text from supported images and the first three PDF pages of eligible protected incoming email. Configured global/domain blocked targets can select Accept, Quarantine or Reject independently of the zero score observations. A separate action handles incomplete inspection. No URL is opened by this image scanner and no automatic reputation feed is used. Remaining pages, unsupported formats and limits are partial coverage; no finding is a clean-mail verdict.
Office VBA analysis
Email Protection (base Package 2)
Inspect supported file contents for actual VBA macros and suspicious static indicators.
Scope and limits
Inspect supported file contents for actual VBA macros and suspicious static indicators. Configure separate Accept, Quarantine or Reject actions for macro presence, suspicious heuristics and incomplete analysis. This is static analysis, not sandbox execution.
Advanced Threat Signatures
Email Protection (base Package 2)
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail.
Scope and limits
Apply separate policies to reported phishing, malware, spam and other signature families on eligible protected incoming mail. Domain settings can inherit server defaults or use an override. Scanner readiness and enabled AntiSpam are required.
Attachment file-type controls
Email Protection (base Package 2)
Select filename extensions or add custom extensions to the Antivirus file-type list.
Scope and limits
Select filename extensions or add custom extensions to the Antivirus file-type list. A matching Accept, Quarantine or Reject applies to the whole message; attachments are never silently removed. Filename matching is separate from file contents, Office VBA analysis and malware detection. Renaming a file can change its filename match; Accept never cancels another security decision.
Outbound text DLP
SMTP Relay add-on · optional outbound policy
Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments.
Scope and limits
Opt-in data loss prevention (DLP) checks use format and checksum validation to flag candidate Turkish identity numbers, TR IBANs and supported payment-card formats in the subject, visible body text and supported text attachments. Observe/SMTP Reject and incomplete Observe/temporary-failure actions apply only to eligible authenticated SMTP Relay with an external exact-domain recipient. Defaults off. PDF, Office, images, archives and attached messages are outside coverage. Matched values are excluded from DLP output. Native enforcement and mailbox delivery require separate deployment validation.
Choose Security in the main menu for analysis scope, or Company → What’s new for release details.