IP, sender and network filters in MailGuard

The IP and sender filter governs which sources and domains are accepted in the first place. It complements content inspection with scoring at transport and sender level, before a message goes into further analysis.

Network filter

The network filter governs sources centrally per policy. Every entry is evaluated individually.

• IP block list: these addresses are rejected.
• IP allow list: these addresses are permitted, individual addresses as well as whole CIDR ranges.
• Domain block list: blocks sender domains, wildcards such as *.example.com are supported.
• Country filter: blocks email from selected countries through ISO 3166-1 alpha-2 codes such as DE or FR.

In addition an automatic reputation check runs in the background. Anomalies raise the risk score of the message.

Filtering by IP address and sender.

Detecting sender forgery

Many attacks come from inconspicuous sources but forge the visible sender. Header protection actively checks the headers for spoofing patterns.

• Display name spoofing: a display name imitates internal or trusted senders.
• Homograph domains: similar-looking domains through Unicode or lookalike characters.
• Reply-To deviation and mismatched From and Reply-To domains.
• Envelope and header deviation.

These patterns are typical of BEC and CEO fraud and feed into the score.

Personal sender lists

From a quarantine message, recipients can block a sender or trust them. A blocked sender is automatically rejected in future, a trusted sender no longer lands in quarantine. Addresses of your own domain are exempt.

Further reading

Score evaluation is described on the spam and phishing page, affected messages in the quarantine. MailGuard gives the overview. Sender-side forgery is complemented by the DMARC reports. Further reading on the solution pages CEO fraud protection and directory harvesting protection.