Features

Identity and reputation

SPF, DKIM and DMARC results influence score and quarantine. DNSBL (RBL) queries — with Spamhaus DQS and custom nameservers — can be tuned to reduce false positives. Empty subject, null sender and content filters (dangerous attachments) add more layers.

AI scoring

Body text is scored by a machine-learning model. Quarantine / reject thresholds are set globally or in the tenant My policy screen. Label spam/ham in the panel to retrain.

Antivirus (attachments)

Attachments are scanned by every installed engine before any other decision. Infected mail is rejected and cannot be released. Message text is not part of that scan. Link threats are handled at click time.

External banner

Mail from outside your organization gets a yellow warning strip on HTML and plain text so users see that it is external before they click. Wording is customizable in the panel.

Impersonation / lookalike

Senders that look like your domain via one-letter typos, dashes or homoglyphs are flagged. Fake local emails or VIP titles in the display name raise the score; high scores can quarantine or reject.

BEC / account-takeover signals

Sender identity, payment language and unusual outbound recipients raise BEC suspicion. Outbound rate limits curb bulk sending from a compromised account.

Supplier account change

If a known supplier’s payment account changes, the message is quarantined. The new account can be accepted after review.

Outbound recipient checks

First-time external recipients and a sudden burst of new recipients are flagged so outbound mail can be reviewed.

Suspicious report

A message can be marked suspicious from the panel and lands in a review queue until it is closed.

Attachments and macros

Dangerous attachment types are blocked. An Office file that contains a macro is quarantined and can be released after review. Text inside attachments is included in the score.

Link Guard

• On delivery, URLs are rewritten to a panel approval page (trusted sites on the skip list are left alone).
• The link is scanned again on click and blocked when it looks risky.
• Redirect chains are followed. Download types can be blocked.
• URL reputation: URLHaus and optional Google Safe Browsing flag known malware / phishing URLs.

DLP — sensitive data protection

Built-in detectors for IBAN, national ID, payment cards and password patterns, plus named custom rules (keyword/regex). Monitor or quarantine inbound; stricter outbound leak controls. Reports never store raw PII — masked incidents and CSV export.

High-confidence phishing and greymail

High-confidence phishing is rejected or held in a quarantine that cannot be released. Newsletters and promos can be tagged and delivered, or quarantined separately.

eDiscovery

Search across message body and attachment text, plus legal hold and export. Available on Business and Enterprise plans.

Multi-tenant, isolated panel

Each tenant only sees mail, quarantine, archive and reports for their domains. They add domains within plan limits and manage thresholds in My policy; RBL/CAPTCHA and infrastructure stay admin-only.

Archive browser

Search incoming, outbound and internal mail by domain and mailbox. Body and attachment text are searchable. Copies are stored encrypted, with retention set by plan. Export and outbound sampling are included.

Cloud archive backup

Starter and above: the organization connects its own Google Drive or OneDrive. An archive copy is stored there as a ZIP. The server archive is not deleted. Manual, incremental and daily or weekly schedules are supported.

My policy (tenant)

Quarantine/reject thresholds, content filters, notification templates and external banner text are tenant-scoped. Global security layers stay in the admin policy; plan features apply automatically.

Plesk extension (customer + admin)

After install, the domain card has a connection screen and a panel sign-in. Customers do not see server settings. The license and server connection stay with the hosting administrator.