Email Security

In this article, you will learn everything you need to know about the Email Security module. The Email Security engines scan for the most intrusive method cybercriminals use to introduce malware and viruses into corporate systems. Lightweight, easy to deploy, and highly responsive, our Email Security anti-malware and anti-spam filter can be scaled to any number of endpoints within your organization. Its MX record-based analysis vectors keep all malicious emails out of your inbox, automatically removing malware-laced attachments, and filtering emails coming from malicious IPs or domains, or those containing malicious URLs. 

1. Description
2. How does Email Security work?
3. Email Security setup guide
4. Email Security view
5. Email Security personal/individual console
6. Email Security settings

DESCRIPTION

Our Email Security uses market-leading spam detection and filtering engines that go beyond simple spam definitions. It proactively prevents even the most sophisticated email exploits that seek to harm your organization by bypassing regular spam filters and antivirus solutions. The Email Security features include anti-spam protection, botnet protection, Advanced Malware Filtering, Protection against DNS hijacking, Phishing protection, threat tracing & full audit log, social security number leakage detection (DK), personal quarantine report, 90-day email retention, deep attachment scanner, and deep content inspection. 
The Email Security infrastructure is hosted on Microsoft's Azure cloud platform (West Europe - Amsterdam, North Europe - Ireland, South India, East US - Virginia). As a security provider, HEIMDAL understands the importance of complying with security standards, and that is why Email Security comes with DNSSEC and DANE/TLSA support for inbound SMTP services:

HOW DOES EMAIL SECURITY WORK?

Email Security protects both inbound and outbound mail flows by acting like the man-in-the-middle, between the Internet and your organization's email server (in case of the Inbound Mail Flow) or vice-versa (in case of the Outbound Mail Flow). Below you have the diagram of the Email Security module:

On the Inbound flow, emails that come from the Internet reach the organization's domain (example.com) and are forwarded to the HEIMDAL Security MX Records found on the domain's DNS (example: eu-esec-01.heimdalsecurity.com or eu-esec-02.heimdalsecurity.com for the Europe region). Once they reach the HEIMDAL servers, Email Security goes through the following flow:

• Allowlist & Blocklist (Allowlist has priority over everything. Anything in the Allowlist is skipped from the Blocklist check);
• Greylist check
• IP Reputation check (only if Spam scanning is enabled)
• SPF/DMARC scanning
• Non-TLS check
• Virus scanning 
• EFP check
• Spam scanning
• Attachment scanning
• Newsletter scanning
• Advanced Threat Protection

If emails pass these checks, they are delivered to the organization's inbound Mail Server (configured in the HEIMDAL Dashboard - Network settings) to reach the recipient's inbox, but if the emails fail the checks, they can be tagged, quarantined, or rejected (depending on the settings configured in the HEIMDAL Dashboard - Network settings) before reaching the recipient's inbox. In the case of quarantined emails, the HEIMDAL Dashboard Admin can allow users to release the quarantined emails they have received, or they can release them themselves.

IMPORTANT

In the interest of timely email delivery, emails that include an attachment with a size above 0.7 MB will be scanned by only one of our Antispam engines. The rest of the emails are scanned by both our Antispam engines. 

On the Outbound flow, emails are sent from the organization's Outbound server using a forwarding rule/connector to reach the HEIMDAL Security smarthost (eu-esec-outbound.heimdalsecurity.com), where the Email Security engines perform the following operation:

• Spam scanning
• Virus scanning
• Attachment scanning
• Advanced Threat Protection

If emails pass these checks, they are delivered by the Email Security servers to the recipients, but if the emails fail the checks, they will be rejected or undelivered. 

EMAIL SECURITY setup guide

To set up Email Security, Heimdal gives you 2 ways of doing that without disrupting the email flow in your organization:

1. Manually switching your domain's MX records to point to the Email Security MX records.
2. Using the automated M365 Exchange Connector setup method (dedicated to those who use Exchange Online Protection.

A. MX RECORD SETUP

Setting up the Inbound Mail Flow 

A. Adding your domain to the HEIMDAL Dashboard
1. Log in to the HEIMDAL Dashboard and navigate to the Network Settings.
2. Click the Email Protection tab and make sure the Email Security module is enabled.
3. To add a new domain to be filtered by the Email Security engines, click Add Domain.
4. Insert your Domain Name and your Inbound Mail Server (Domain or Public IP Address), and Save Changes.

5. Additionally, you can configure the rest of the settings or leave them for a later time.
6. After having all the settings configured, press the Update Network Settings button.

B. Adding the Email Security MX Records to your domain's DNS Settings
1. Log in to the portal where you manage your domain's DNS Settings (your registrar's portal or your hosting company's portal | example: GoDaddy, HostGator, or others) and go to the DNS Settings. In case your domain's DNS hosting provider is Microsoft, note the fact that Microsoft 365 prefers Exchange Online Protection as the primary Mail Server service, and that is why you will see that on the MX Records configuration, Microsoft expects the Office 365 MX Record (example-com.mail.protection.outlook.com) and does not validate the MX Records of a 3rd-party spam filter as primary MX Records. Although the Email Security doesn't validate, the email flow will work just fine, having them set with priority 0 and 1. 

2. Change your MX Records to point to the Email Security MX Records (make sure you use the MX Records corresponding to the region your customer account is stored):

• au-esec-01.heimdalsecurity.com (for customers stored in the Australian region).
• au-esec-02.heimdalsecurity.com (for customers stored in the Australian region).
• eu-esec-01.heimdalsecurity.com (for customers stored in the Europe region).
• eu-esec-02.heimdalsecurity.com (for customers stored in the Europe region).
• us-esec-01.heimdalsecurity.com (for customers stored in the United States region).
• us-esec-02.heimdalsecurity.com (for customers stored in the United States region).
• uk-esec-01.heimdalsecurity.com (for customers stored in the United Kingdom region).
• uk-esec-02.heimdalsecurity.com (for customers stored in the United Kingdom region).
• uae-esec-01.heimdalsecurity.com (for customers stored in the United Arab Emirates region).
• uae-esec-02.heimdalsecurity.com (for customers stored in the United Arab Emirates region).

Once the configuration of the MX Records has been completed and the settings propagated, emails should be displayed and filtered by the Email Security module in the HEIMDAL Dashboard, under the Email Security view (Inbound view).

IMPORTANT

In case you are setting up Email Security to work with Office 365, make sure you go through the steps described in this article to prevent the bypass of Email Security and also to configure the bypass of the EOP spam filtering: https://support.heimdalsecurity.com/hc/en-us/articles/22421112073501-Email-Security-and-Exchange-Online-Office-365-setup-of-the-inbound-flow

Setting up the Outbound Mail Flow 

A. Adding your Outbound Mail Server(s) in the HEIMDAL Dashboard
1. Log in to the HEIMDAL Dashboard and navigate to the Network Settings.
2. Click the Email Protection tab and make sure the Email Security module is enabled.
3. Click the Edit button (the pencil icon) to edit the domain you have created.
4. Add your Outbound Mail Server (Domain or Public IP Address) by clicking the Add button, and Save Changes.

5. After having all the settings configured, press the Update Network Settings button.

B. Adding the Email Security SPF, DMARC, DKIM records to your domain's DNS Settings
1. Log in to the portal where you manage your domain's DNS Settings (your registrar's portal or your hosting company's portal | example: GoDaddy, HostGator, Office 365, or others) and go to the DNS Settings.
2. Edit your SPF Records to include the Email Security SPF Records:

• include:spf-esec.heimdalsecurity.com (for customers stored in the Europe region).
• include:spf-esec-au.heimdalsecurity.com (for customers stored in the Australian region).
• include:spf-esec-us.heimdalsecurity.com (for customers stored in the United States region).
• include:spf-esec-uk.heimdalsecurity.com (for customers stored in the United Kingdom region).

• include:spf-esec-uae.heimdalsecurity.com (for customers stored in the United Arab Emirates region).
  Example:

  v=spf1 include:spf.protection.outlook.com include:spf-esec.heimdalsecurity.com -all

Make sure you don't remove any 3rd Party SPF Records that are already set up on your SPF Records. After adding the Email Security SPF Records, do an SPF Record Lookup to make sure the SPF Records are validating correctly (you can use mxtoolbox.com or any other online tool to check).
3. Add a DMARC Record:

• Type: TXT
• Host: _dmarc
• Value: v=DMARC1; p=quarantine; rua=mailto:gcafy1yi@ag.dmarcian-eu.com, mailto:test1@example.com; ruf=mailto:gcafy1yi@fr.dmarcian-eu.com, mailto:test1@example.com;
• TTL: 1/2 Hour

4. Additionally, you can add a DKIM Signature to make sure the emails you send are DKIM-signed. 

C. Adding a rule/connector on your Mail Server to relay emails to the Email Security smarthost
1. Go to your Outbound Mail Server settings and create a rule/connector to relay all the outbound emails through the Email Security smarthost:  

• au-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (for customers stored in the Australian region).
• eu-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (for customers stored in the Europe region).
• us-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (for customers stored in the United States region).
• uk-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (for customers stored in the United Kingdom region).
• uae-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (for customers stored in the United Arab Emirates region).

Once the configuration of the smarthost has been completed, emails should be displayed and filtered by the Email Security module in the HEIMDAL Dashboard, under the Email Security view (Outbound view).

B. M365 EXCHANGE CONNECTOR SETUP

The M365 Exchange Connector setup is dedicated to tenants that want to integrate their Exchange Online Protection with Heimdal and have the mail traffic filtered by Heimdal's Email Security. This setup method is dedicated to MSPs who want to quickly set up the mail flow without changing the MX records at the domain's DNS level. To achieve that, follow the steps in the following article: Setting up Email Security with M365 Exchange Connector. 

IMPORTANT
In order for Email Security to work, you need to make sure that the Email Security IP addresses are not blocklisted/greylisted by your environment or by your hosting company. Verify your firewall settings and allow SMTP from these IP Addresses.

• 20.213.125.208 (au-esec-01.heimdalsecurity.com / au-esec-02.heimdalsecurity.com)
• 20.213.125.209 (au-esec-01.heimdalsecurity.com / au-esec-02.heimdalsecurity.com)
• 20.213.125.210 (au-esec-outbound.heimdalsecurity.com)
• 20.213.125.211 (au-esec-outbound.heimdalsecurity.com)
• 20.50.183.144 (eu-esec-01.heimdalsecurity.com)
• 20.50.183.146 (eu-esec-01.heimdalsecurity.com)
• 20.50.183.145 (eu-esec-02.heimdalsecurity.com)
• 20.50.183.147 (eu-esec-02.heimdalsecurity.com)
• 20.50.183.148 (eu-esec-outbound.heimdalsecurity.com)
• 20.50.183.149 (eu-esec-outbound.heimdalsecurity.com)
• 20.50.183.150 (eu-esec-backup.heimdalsecurity.com) 
• 20.50.183.151 (eu-esec-backup.heimdalsecurity.com) 
• 20.88.177.217 (us-esec-01.heimdalsecurity.com / us-esec-02.heimdalsecurity.com)
• 20.88.177.218 (us-esec-01.heimdalsecurity.com / us-esec-02.heimdalsecurity.com)
• 20.88.177.208 (us-esec-outbound.heimdalsecurity.com)
• 20.88.177.209 (us-esec-outbound.heimdalsecurity.com)
• 172.166.114.48 (uk-esec-01.heimdalsecurity.com / uk-esec-02.heimdalsecurity.com)
• 172.166.114.49 (uk-esec-01.heimdalsecurity.com / uk-esec-02.heimdalsecurity.com)
• 172.166.114.50 (uk-esec-outbound.heimdalsecurity.com)
• 172.166.114.51 (uk-esec-outbound.heimdalsecurity.com)
• 20.233.55.176 (uae-esec-01.heimdalsecurity.com / uae-esec-02.heimdalsecurity.com)
• 20.233.55.177 (uae-esec-01.heimdalsecurity.com / uae-esec-02.heimdalsecurity.com)
• 20.233.55.178 (uae-esec-outbound.heimdalsecurity.com)
• 20.233.55.179 (uae-esec-outbound.heimdalsecurity.com)

In case your firewall includes special rules for inbound & outbound traffic, make sure you whitelist the following:

• 20.213.125.208, 20.213.125.209, 20.213.125.210, 20.213.125.211
• 20.50.183.133/29 (port 25 for Inbound traffic)
• 20.88.177.217, 20.88.177.218, 172.166.114.48, 172.166.114.49
• 20.50.183.144/29 (all ports for Outbound traffic)
• 20.88.177.208, 20.88.177.209,172.166.114.50,172.166.114.51
• 20.233.55.176, 20.233.55.177, 20.233.55.178, 20.233.55.179
• 172.166.114.48, 172.166.114.49, 172.166.114.50, 172.166.114.51

EMAIL SECURITY view

The Email Security page displays 2 views: the Homepage (which showcases relevant data from the Email Security product) and the Details (for in-depth data analysis). 

Homepage

The Homepage displays several stats and graphs that provide a streamlined understanding of the usage and activity of the email addresses and domains: 

• Summary Report - brief info about the total number of malicious, inbound, and outbound emails over the last 90 days. These are further broken down by Status and expressed in percentiles.
• User Anomalies - shows, sorted in descending order, the top 8 email addresses on which outliers have been detected (SPAM, Virus, and ATP); each entry (email address) will have 3 bars, displaying the number of emails from this category, over the last month, 2, and 3 months ago (from the current date). For more details regarding a certain email address, the dashboard user can click on the bar chart section, and a detailed linear graph is displayed below.
• Domain status - lists all the email domains, with their corresponding TAC risk score and their MX, SPF, and DMARC authentication methods’ statuses.

• The bottom row tiles display a month-to-month comparison of Quarantined, Rejected, Spam, Virus, and ATP emails. The stats are computed by comparing the past 30 days from the current date vs. the previous 30 days. Each tile displays the increase/decrease in the number of emails (both as a number and as a percentage) and a chart presenting the activity for each interval.
  
  

  After clicking on the hovered point in the chart tile, the timeframe interval of the redirected Details page is automatically set to one of the hovered data points.
  
   
  
  Moreover, this action also sets, in the Advanced filter, the Type or Status field to whatever Type or Status from the graph style from which the selected data point was clicked. Depending on the graph tile clicked, the following actions occur: clicking on the Rejected and Quarantined tiles automatically sets the Status of the Advanced filter, while clicking on the Spam, Virus, and ATP graph tiles automatically sets the Type field from the Advanced filter.
  If there is no recorded data when hovering over the chart data points and attempting to click on them, a toast notification will be shown to the dashboard user with the message "No data for the specific timeframe."
  

Details

The Details view displays all the information regarding the Inbound Mail Flow, Outbound Mail Flow, Domain Status, and M365 Users in your organization. 
On the top, you see a statistic regarding the number of Scanned Emails, the number of Spam Emails, the number of Virus detections, and the number of detected Advanced Threats. 

Inbound/Outbound

The Inbound view and Outbound view display all the emails that are being filtered by the Email Security engines:

The Advanced Filter allows you to filter your searches by Domain, To, From, Header From, Type, Status, Spam Classification, Minimum Spam Score, Maximum Spam Score, EFP Rule Category, AI Outlier and Delete Type.

The Type submenu has the following types:

• All
• Normal
• Botnet
• Spam
• Virus
• Encrypted
• ATP
• SPF Block
• DMARC
• Blocklisted
• Allowed
• Attachment Block
• Released to ATP
• Non-TLS block
• Newsletter
• EFP

The EFP Rule category submenu has the following categories:

• Targeted Spear Phishing
• Targeted Fraud
• Spear Phishing
• Phraseology attempt or General Fraud
• Modified or Malicious attachment

The AI Outlier category has the following categories: AI outlier detected, AI outlier not detected.

The Delete Type category has the following categories:

• All – displays all emails, regardless of deletion action
• Inbox Delete – shows emails removed from user inboxes
• Permanent Delete – displays emails permanently removed from mailboxes

In the Inbound view, you can see a list of all inbound emails, the recipient, the sender, the timestamp, the email subject, the type, the email status, and the details of each email (the Inbound view refreshes in real-time). Selecting one or more emails pops up a dropdown menu where you can select one of the following actions:

• Release - this action will release the selected email in case it has been quarantined and you think it is safe.
• Resend - this action will resend the selected email (this action works only for delivered emails).
• Report - this action will automatically mark the selected email as Spam, and an email notification will be sent to the Heimdal Security Team.
• Deny email release - this action will block the regular end users' ability to release quarantined emails from their QER report.
• Delete from Inbox – moves the email to Deleted Items and email remains preserved in cold storage (Grant Consent should be given for this action to be visible).
• Permanently Delete from Inbox – completely removes the email from Inbox, but preserves it in the cold storage (Grant Consent should be given for this action to be visible).
• Delete from ESEC / Delete from EFP repository – deletes the email from the ESEC/ EFP grid/ repository. The email is not deleted from the user's mailbox (Grant Consent should be given for this action to be visible).

In the Outbound view, you can see a list of all outbound emails, the recipient, the sender, the timestamp, the email subject, the type, the email status, and the details of each email (the Outbound view refreshes in real-time). Selecting one or more emails pops up a dropdown menu where you can select one of the following actions:

• Release - this action will release the selected email in case it has been quarantined and you think it is safe.
• Resend - this action will resend the selected email (this action works only for delivered emails).
• Report - this action will automatically mark the selected email as Spam, and an email notification will be sent to the Heimdal Security Team.

The Details button will display a pop-up with various email details (Main, Advanced, Header, Body and Audit Logs). In the Main tab, you can use the Choose a domain dropdown field to take actions for the specified domains.

• Add Sender to Blocklist - adds the sender (the one who sends the email) to the blocklist of the selected domain(s).
• Add Sender to Allowlist - adds the sender (the one who sends the email) to the allowlist of the selected domain(s).
• Add Domain to Blocklist - adds the sender's domain (the one who sends the email) to the blocklist of the selected domain(s).
• Add Domain to Allowlist - adds the sender's domain (the one who sends the email) to the allowlist of the selected domain(s).
• Add Email based on subject to Allowlist - adds the sender's email to the allowlist of the selected subject(s). Unchecking the SPF/DMARC scanning will still perform an SPF/DMARC check to increase security.
• Add Email based on subject to Blocklist- adds the sender's email to the blocklist of the selected subject(s).

Dashboard users have the option to create Allowlist/Blocklist rules either at a personal or global (domain) level.

If the dashboard user selects the “Personal” option, a new End User Console rule will be created (and also displayed in the End Users Allowlist & Blocklist table, which can be found in the Blocklist, Allowlist & Greylist section in Network Settings - Email Protection).

In the Advanced Status tab, you can use the Choose a domain dropdown field to take more actions for the specified domains.

• Add Source IP to Blocklist - adds the Source IP Address (the source IP Address of the sending server) to the blocklist of the selected domain.
• Add Destination IP to Blocklist - adds the Destination IP Address (the destination IP Address where the email is sent to) to the blocklist of the selected domain.
• Add Source IP to Allowlist - adds the Source IP Address (the source IP Address of the sending server) to the allowlist of the selected domain.
• Add Destination IP to Allowlist - adds the Destination IP Address (the destination IP Address where the email is sent to) to the allowlist of the selected domain.

In the Header tab, you see information about the Envelope-From the Header-From:

The Body and the Attachments tabs preview the body and the files that are attached to the email, whether the email has been quarantined, delivered, undelivered, or rejected. These options are available only if the domain has enabled the Email Archiving options feature in the Additional Domain Settings tab. In the Body tab, you can also download the email in EML format. To preview the Body and the Attachments tab, the HEIMDAL Dashboard user needs appropriate Access Control (View Email Security Data and View Email Security Sensitive claims enabled). 

IMPORTANT

The email's body and attachments must not exceed 25 MB. If the total size exceeds this limit, the Body tab section will be disabled and appear grayed out. Just the size of the body should not exceed 1 MB. If that happens, the Body tab will be grayed out.

The Audit Logs tab records:

• the user who initiated the delete action (visible only for Inbound emails)
• the delete type performed (Inbox Delete or Permanent Delete, visible only for Inbound emails)
• the exact timestamp of the action execution (visible only for Inbound emails)
• released by
• initial status
• initial responses from server

Domain Status

The Domain Status view displays all the domains registered in the HEIMDAL Dashboard (under Email Security) with their validation status (including SPF and DMARC checks).

M365 Users View

The M365 Users View delivers clear visibility into Microsoft 365 users, enabling accurate automated license tracking and billing. This helps organizations align Heimdal license consumption with actual mail-enabled M365 user activity in the configured Microsoft Entra (Azure AD) tenant.

The M365 Users view is available only when both of the following conditions are met:

• A valid Microsoft Entra Tenant ID is configured.
• Grant Consent Billing has been successfully provided under Network Settings -> Email Protection -> Email Security -> Grant Consent Billing.

Note: if the aforementioned conditions are not met, the view remains disabled, and a tooltip text is displayed on hover to inform the user of the missing requirements.

The M365 Users view presents a searchable and sortable grid containing the following columns:

• M365 User – displays the Microsoft 365 user identity (userprincipalname or UPN).
• Last Seen – indicates the timestamp of the user's most recent sign-in activity.

Note: only users who meet both of the following criteria are included in the grid:

• are Members in the Microsoft 365 organization.
• have an active Exchange Online service plan.

Data in the M365 Users view is automatically refreshed every week.

EMAIL SECURITY personal/individual console

The Email Security personal/individual console is available to end users if the End user console option (within the Network Settings -> Email Security -> Quarantine Settings) is enabled. This portal is accessible through the following URL: https://dashboard.heimdalsecurity.com/emailspamfilterlogs/index, through an authentication token (valid for 24 hours from the moment it was generated) that is being sent via email (if the email address is valid). 


The Email Security personal/individual console can be accessed from the Quarantine Report link at the bottom of the report.

Once authenticated in the Email Security personal/individual console, the end user can see all the details related to the email flows concerning their email address: the Inbound Mail Flow, the Outbound Mail Flow, the Blocklist, and the Allowlist. The collected information refers to emails that are DELIVERED, QUARANTINED, QUEUED, UNDELIVERED, or REJECTED. 
On top of that, you will see statistics regarding the number of scanned emails, spam emails, virus detections, and advanced threats. 
The Inbound view and Outbound view display all the emails that are being filtered by the Email Security engines, while the Blocklist and the Allowlist display the entries specific to each list. The Advanced Filter allows you to filter your searches by From/To, Header From, Type, Status, Spam Classification, Minimum Spam Score, and Maximum Spam Score.

Quarantined emails can be released from the Email Security personal/individual console by selecting the email and choosing the Release action from the top dropdown menu or the Details modal.

IT admins can block the end users' ability to release quarantined emails using the Deny email release action.

The emails that have been denied will have a warning icon in the Status field, and hovering the mouse over the status will display the message "Email is denied for release for end users. IT admins can still release the email from the dashboard".

After applying this action to an email, the Release button will be disabled for the end users, and placing the mouse over the button will display the message: "This action is not allowed by your IT admin."
The Details modal allows the end user to add items to the Allowlist and/or Blocklist. The blocklisted items are added with the default action from the HEIMDAL Dashboard -> Reject, and the end user cannot select a different action (due to security reasons). Once the items are added to the end user's Allowlist/Blocklist, they are displayed in the corresponding view (Allowlist/Blocklist).
Add Sender to Blocklist - add the sender's email address (FROM) to the Blocklist.
Add Sender to Allowlist - add the sender's email address (FROM) to the Allowlist.
Add Domain to Blocklist - add the sender's domain to the Blocklist.
Add Domain to Allowlist - add the sender's domain to the Allowlist.
Add Header Sender to Allowlist - add the sender's HEADER FROM email address to the Allowlist,
Add Header Domain to Allowlist - add the sender's HEADER FROM email address to the Allowlist.
Add Email based on subject to Blocklist - add the subject to the Blocklist.
Add Email based on subject to Allowlist - add the subject to the Allowlist.
Release - releases the quarantined email.

When using the Show details button from the Email Security Inbound and Outbound views, users will be able to visualize details related to EFP-detected emails in a dedicated new tab called EFP.
Note: The EFP tab is available (not faded) only if the Advanced Filter selection on Type is made for EFP-type emails.
The only action the end user can perform in the Allowlist/Blocklist views is the Delete action (deleting the entry/ entries from the table).

IMPORTANT

1. The settings are applied only to the mailbox of the end user and have priority over the general domain settings set up in the HEIMDAL Dashboard. 
Example: if test@domain.com is blocklisted in the domain settings, but added to the end user’s personal Allowlist (in the Email Security personal/individual console), the end user will receive emails from the mentioned whitelisted email address while, all the other users will not (unless they performed whitelist actions, on the same mailbox, in their Email Security personal/individual console) as the email will be blocklisted by the HEIMDAL Dashboard domain settings.
2. Another thing to mention is that end users have the default ability to add to the Allowlist/Blocklist a sender's email address/domain, even if the email was marked Normal. The reason behind this is that the Normal type is not included as a type in the Advanced Threat Protection list.
3 When adding an entry to the Email Security personal/individual Allowlist, the whitelist is performed on all engines, except the Virus scanning engine and the SPF/DMARC check engine.

EMAIL SECURITY settings

To set up Email Protection - Email Security in the Heimdal Dashboard, log in and access the Network Settings section:

Email Security - enables the Email Security module.
Authorize and install the Email Security Entra application - connects Heimdal Email Security to your O365/Azure tenant by installing the Heimdal Security ESEC enterprise application in Entra, allowing the Heimdal Dashboard to retrieve the mailbox count from the Microsoft Graph/Office 365 API.

Email Security supports two inbound setup methods, selectable per domain:

• MX record setup - route inbound mail to Email Security by pointing your domain's MX records to the Heimdal servers.
• M365 Exchange Connector setup - route inbound mail through a Microsoft 365 Exchange connector instead of changing MX records.

Mail Flow & Archiving

Domain Name

Domain Name - allows you to add a domain name (e.g., heimdalsecurity.com).
Inbound Traffic - set the Inbound Provider, the MX Records/Public IP of the mail server(s) Email Security should deliver inbound traffic to, the Port, and a TLS option (e.g., heimdalsecurity-com.mail.protection.outlook.com:25).
Outbound Traffic - set the Outbound Provider and the SMTP Server/Public IP by selecting an SMTP server from the dropdown or entering the public IP address of the SMTP server.

Archiving - the Email archiving options field lets you select the desired email archiving period and, implicitly, the timeframe corresponding to the Resend option. The Resend action, the Body, and the Headers are tied to the archiving functionality. If archiving is set to None, the Resend action is not available, and the email body and headers are also unavailable.

Outbound Relay Region Redirection - allows you to redirect a specified Outbound Domain to a chosen outbound relay Region, so outbound mail for that domain is relayed from the selected region.

Authentication & Filtering

General Settings

Temporary inbound email delivery pause - pauses email delivery. The system checks every 15 minutes whether the pause has been removed.

Authentication

SPF verification - checks whether an incoming email comes from a host that the domain's administrators authorize to send on behalf of the domain.
SPF Softfail verification - while enabled, inbound emails from a domain whose SPF records are set with SoftFail are quarantined for failing the SPF check. When disabled, inbound emails from a non-authorized sender fail regardless of whether the SPF records are set with SoftFail or HardFail.
Sender Rewriting Scheme (SRS) verification - allows the Email Security engine to rewrite the Envelope From address for all inbound emails (the Header From field remains unchanged), preventing SPF failures that commonly occur with forwarded mail. This bypasses the requirement to allowlist the Heimdal Email Security IP addresses on your organization's mail server, and is recommended only when you cannot allowlist those IP addresses.
DMARC verification - checks whether the incoming email comes from a sender authorized to send on behalf of the sending domain and that the email has not been modified in transit.
Advanced recipient verification - allows the Email Security servers to verify whether a recipient's email address exists before delivering the email. If a user does not exist, Email Security blocks the email before it reaches the mail server, improving the spam block rate by using resources more efficiently. Enabling it performs recipient verification on port 2525 (as Exchange does for receipt validation) instead of the configured port (25 or any other). When disabled, recipient verification is done on the configured port. (This feature is visible and configurable only by the Support Team.)

Anti-Spam

The Anti-Spam settings allow you to change the aggressiveness of the spam filter and to choose what actions to take on emails based on five classification levels and scores between -0.1 and 100.
Anti-Spam detection - enables or disables the anti-spam filtering engine on the selected domain.
Enhanced spam detection - enables additional spam-detection heuristics for stronger filtering on the selected domain.

CLASSIFICATION - each email filtered by the Heimdal Email Security module gets a classification from one of the anti-spam engines. Emails can be classified as Confirmed Spam, High Possible Spam, Possible Spam, Suspected Spam, and All other Emails.
SCORE LEVEL - a value between -0.1 and 100 that serves as the limit for the action taken on each email; a lower score makes the anti-spam engine flag emails less likely to be spam, and a higher score flags only emails more likely to be spam.
PREVIEW - redirects you to the Email Security view and applies search filters according to the Classification, Score Level, and configured domain.

ACTION - lets you choose an action for every classification (Reject, Quarantine, Tag Subject, None).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the anti-spam engine.

Examples:

• If the Score Level is set to >= 3, emails scoring 2 are not flagged (DELIVERED), while emails scoring 3 or higher are flagged as SPAM (Tagged, Quarantined, Rejected, or no action, depending on the set Action).
• If the Possible Spam classification has a Score Level of 2 and an action of Quarantine, all emails tagged "Possible Spam" with a Score Level equal to or higher than 2 are quarantined and flagged as SPAM in the Email Security view.

Anti-Spam sensitivity profiles - allow you to use the recommended presets for Anti-Spam settings: MODERATE (relaxed settings), DEFAULT (regular settings), and AGGRESSIVE (restrictive settings).

Email Fraud Prevention

Email Fraud Prevention - enables or disables the Email Fraud Prevention filtering engine on the selected domain.

Action on detection - lets you choose an action for every classification (None, Quarantine, Tag Subject, Reject).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the Email Fraud Prevention engine.

Antivirus

Antivirus detection - activates or deactivates the malware and virus detection engines. This can be used to diagnose false positives if Email Security detects legitimate emails and/or attachments as harmful or containing malware.

Action on detection - lets you choose an action for every classification (None, Quarantine, Tag Subject, Reject).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the Antivirus engine.

Advanced Threat Protection

Advanced Threat Protection (included in the Email Security Advanced licensing option) - activates or deactivates the detection systems against advanced threats. This can be used to diagnose false positives in the event of legitimate emails and/or attachments flagged as harmful or containing advanced threats.
Macro analyzer - executes macros and scripts within emails in a sandboxed environment for analysis and detection.
PDF analyzer - executes PDF files and other container files within emails in a sandboxed environment for analysis and detection.
SHA256 analyzer - quickly checks emails blocked by Email Security Advanced Threat Protection against the online malware analysis services VirusTotal and Payload Security, helping you gain more information on a specific malware sample. Email Security generates a SHA256 hash checksum for each file detected as suspicious/harmful/malicious. You can run searches or download email parts through the Messaging Logs interface: left-click the email, select Attachments, and check the attachments' checksum directly at VirusTotal or Hybrid Sandbox. You can download the full attachment for further investigation, but be aware that downloading it can be a security risk (confirmed via a dialog box before download).
Phishing protection - enables or disables the detection systems against phishing emails. This can be used to diagnose false positives if Email Security detects legitimate emails as phishing.
Post-release ATP scan - allows an email to be scanned by the ATP engines after being released from quarantine (having previously been detected by the Antivirus, Anti-Malware, or Anti-Spam engines). An email not confirmed malicious by Advanced Threat Protection is delivered but flagged as Released to ATP; if ATP confirms it is malicious, the email is quarantined and the type changes from Released to ATP to ATP.
Action on detection - lets you configure the actions taken by Email Security on emails containing threats, categorized by Malware, ATP, and Phishing (None, Quarantine, Tag Subject, Reject).

Non-TLS mail policy

Non-TLS mail policy - lets you tag, quarantine, and reject emails not transmitted through TLS. Quarantine stores the emails for 90 days on the fast storage servers; reject does not store them.
Action on detection - lets you choose an action for every classification (None, Quarantine, Tag Subject, Reject).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the Non-TLS mail policy engine.

Newsletter mail policy

Newsletter mail policy - scans for emails that are newsletters or look like newsletters.
Action on detection - lets you choose an action for every classification (None, Quarantine, Tag Subject, Reject).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the Newsletter mail policy engine.

File attachment policies

This feature lets you change the settings for emails with attachments. The attachment filters can be enabled for specific file extensions. Because an increasing number of threats try to bypass email filters through filename and/or file-parser manipulation, Email Security also provides an advanced attachment filter based on inspection and analysis of each attached file, safeguarding against users renaming or manipulating files to bypass your allowed-file-type policies. You can also select specific actions on detection for different file extensions.

• Executable file attachment interception - intercepts and takes action on emails with attached executable files (EXE files).
• Dangerous file attachment interception - intercepts and takes action on emails with attached files of the following extensions: .ac .air .apk .app .applescript .awk .bas .bat .cgi .chm .cmd .com .cpl .crt .csh .dld .dll .drv .elf .exe ._exe .fxp .hlp .hta .inf .ins .inx .isu .iqy .jar .js .jse .jsp .kix .ksh .lib .lnk .mcr .mem .mht .mpkg .mrc .ms .msc .msi .msp .mst .ocx .pas .pcd .pif .pkg .pl .prc .prg .py .pyc .pyo .reg .scpt .scr .sct .seed .sh .shb .shs .spr .sys .thm .tlb .udf .url .uue .vb .vbe .vbs .vdo .wcm .ws .wsc .wsf .wsh .xap .zlq .wmf.
• Password-Protected attachment interception - intercepts and takes action on emails with attached password-protected files (usually archives).
• Multiple file extension attachment interception - handles emails whose attachments have more than one extension, based on the selected Enforcement action.

Enforcement action for selected policies - lets you choose an action for every classification (None, Quarantine, Tag Subject, Reject).

• Reject rejects the email without storing it on the Heimdal servers.
• Quarantine quarantines the emails and stores them for 90 days on the Heimdal fast storage servers.
• Tag Subject adds a tag to the email's existing subject: # Warning: Possible Spam or Fraud! #.
• None lets the emails pass unaltered through the file attachment policy engine.

Custom file extension attachment interception - add your own file-extension definitions to be filtered by the Heimdal Email Security platform. Note that threats in attachments are often masked by false or corrupted file extensions compared to the real content of the attachment. Enter the file extension in the Custom file extension field without the "." (e.g., exe).

Outbound Traffic

Outbound mail rate limiting - sets a maximum outbound limit per mailbox, using the Outbound mails per minute [number] and Outbound mails per day [number] fields.
Block outbound emails containing a Danish CPR number only when no TLS is detected - blocks outbound emails containing a Danish CPR number even if Force TLS (encrypted) transmission is enabled for any domains.
Block outbound emails containing a Danish CPR number - scans the email for any Danish CPR number and blocks it if one is found.
DKIM Signing - generates and configures a DKIM signature to be included in the outbound email header. To create a signature, type a selector, choose the Key Length, and click Generate.

After generating it, add the DKIM signature to the domain's DNS records. Once added, validate it within the Email Security settings using the Check DNS button (DNS changes can take up to 48 hours to propagate). After validation, enable the configured selector using the enable tickbox.
SMTP AUTH Users - lets you add an SMTP Authenticated User for a printer or copy machine to send emails through Email Security. Specify a username, a password, and an IP address:

• Username: smtp (or any other username)
• Password: <your-password>
• Confirm Password: <confirm-your-password>
• IP Address: <your-IP-Address>

Press Add, then Save changes and Update Network Settings.

To test the SMTP Auth feature, use the following command in a PowerShell window, or the script below:

Send-MailMessage -From 'smtp@yourdomain.com' -To 'recipient@otherdomain.com' -Subject 'Test Email' -Body 'Testing the SMTP Relay Service' -SmtpServer 'eu-esec-outbound.heimdalsecurity.com' -Usessl -Port 587 -Credential (Get-Credential)

You will be prompted to enter the credentials (smtp@yourdomain.com and password) you added in the Heimdal Dashboard. Although the username does not include the domain in the Heimdal Dashboard, the authentication pop-up requires you to specify the domain.

[Net.ServicePointManager]::SecurityProtocol =[Net.SecurityProtocolType]::Tls12
$username = 'test@yourdomain.com'
$password = 'mypassword1234'
$securepassword = ConvertTo-SecureString $password -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ($username, $securepassword)

Send-MailMessage -From 'test@yourdomain.com' -To 'test@internet.com' -Subject 'Test Email' -Body 'Testing the SMTP Relay Service' -SmtpServer 'eu-esec-outbound.heimdalsecurity.com' -Usessl -Port 587 -Credential $mycreds

Use the Email Security outbound server corresponding to your region:

• au-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (customers in the Australian region).
• eu-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (customers in the Europe region).
• us-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (customers in the United States region).
• uk-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (customers in the United Kingdom region).
• uae-esec-outbound.heimdalsecurity.com with ports 25, 587, 2525 (customers in the United Arab Emirates region).

SEPO encryption

Inbound SEPO verification - uses the SEPO encryption service and delivers the email to the SEPO Inbound Scan Server.
Outbound SEPO verification - uses the SEPO encryption service and checks CPR, Abnormal, and Forced TLS delivery.
SEPO Version - lets you change the version used for the verification.

Quarantine Report

Quarantine Report Settings

Admin Quarantine Report - issues a complete spam report by email to defined administrators of your company. The report contains an overview of blocked spam for all your company's users (defined automatically by the intended recipient's email address). You can define how often your administrators receive an Admin Quarantine Report, and they can release blocked spam from it. To avoid spam-release conflicts, enabling the Admin Quarantine Report disables the Personal Quarantine Report.

Personal Quarantine Report

Personal Quarantine Report - sends a quarantine report to recipients of quarantined emails. Users who receive no quarantined emails do not receive a report. To avoid spam-release conflicts, enabling this feature disables the Admin Quarantine Report.
Personal Console - allows end users to access their personal Email Security portal to view emails received at their address, release quarantined emails, and add entries to the Allowlist/Blocklist. The portal is accessed at https://rc-dashboard.heimdalsecurity.com/emailspamfilterlogs/index, where the user enters a valid email address to get access through a temporary token valid for 24 hours. This option is available only if the Personal Quarantine Report is enabled.
Customize the Quarantine Report interval - allows users to generate a Custom Quarantine Report based on the selected time interval. The report can be generated using the "Get Report" button or directly in the General Quarantine Report email.

Quarantine Report Schedule

Allows you to schedule when the Quarantine reports are generated (Every hour, Daily, Weekly, or Monthly), including the day and Time Zone.

Quarantine Report Content

Lets you define which types of quarantined emails are included in the Quarantine Report (Spam, Malware, ATP, Attachment, SPF, Non-TLS, Newsletter, EFP) and whether to Preview, Release, or Allow the sender directly from the quarantined email within the Quarantine Report notification.

Allow Sender whitelist by 'Header From' in the Quarantine Report - enable this to have allowlist entries consider the HEADER FROM instead of the ENVELOPE FROM address. This changes which sender address is saved to a user's personal allowlist when they click Allow Sender inside a quarantine digest email. The ability to add the sender to the Personal Allowlist or Personal Blocklist from the Quarantine Report (or Personal Console) is available only if Personal Console is enabled.

Allowlist, Blocklist & Greylist

These functionalities let you add email addresses, domains, IP addresses, or email subjects to the Blocklist or the Allowlist, regulating which senders your organization always blocks or allows.

Allowlist

Lets you allowlist an email address, a domain, or a sender IP address sending emails to your domain, or allowlist an email based on its subject, and can be customized to bypass different scanning methods. Under normal circumstances it is not advisable to allow sender IP addresses, as this can open access for threats and spam if the sender's network or endpoints are compromised. To edit an existing allowlisting rule, click the pencil button:

In the Allowlist editor, you can edit the allowlisting settings applied to the email matching the rule and leave a note for any Heimdal Dashboard Administrator who reviews these settings.

• SPF/DMARC scanning - while unticked, the specified email address/domain/IP address is allowlisted for SPF/DMARC scanning.
• Spam scanning - while unticked, the specified email address/domain/IP address is allowlisted for Spam scanning.
• Virus scanning - while unticked, the specified email address/domain/IP address is allowlisted for Virus scanning.
• Attachment detection - while unticked, the specified email address/domain/IP address is allowlisted for attachment scanning.
• Advanced Threat Protection - while unticked, the specified email address/domain/IP address is allowlisted for Advanced Threat Protection scanning.
• Non-TLS block - while unticked, the specified email address/domain/IP address is allowed to send emails that are not sent with TLS.
• Check Header - while enabled, the header sender information is checked. The SPF/DMARC scanning engine is not allowlisted, for security reasons.

The Allowlist takes precedence over the Blocklist, so if you allowlist the sender's email address (test@example.com) and blocklist the sender's domain (example.com), the email is received by the recipient. Allowlisting an email based on the subject will NOT bypass the SPF/DMARC check, even if it is disabled in the allowlist.
The Import CSV functionality lets you import an allowlist from a CSV file (download a sample by hovering over the Allowlist info bubble).

Blocklist

Lets you blocklist an email address, a domain, or a sender IP address sending emails to your domain, or blocklist an email based on its subject and take action against it (Quarantine, Reject, Delete). To edit an existing blocklisting rule, click the pencil button:

In the Blocklist editor, you can edit the action applied to the email matching the rule and leave a note for any Heimdal Dashboard Administrator who reviews these settings.

The Allowlist takes precedence over the Blocklist, so if you allowlist the sender's email address (test@example.com) and blocklist the sender's domain (example.com), the email is received by the recipient.
The Import CSV functionality lets you import a blocklist from a CSV file (download a sample by hovering over the Blocklist info bubble).

Greylist

Domain greylist threshold [days] - lets you enable and set the domain greylisting interval from 1 to 90 days. Domain greylisting collects and stores data on sending domain names for the number of days set on the threshold slider. It works in conjunction with Tag greylisted emails, which adds a tag (# Unknown domain: Possible spam/phishing mail #) in the Subject field of each email from a sender's domain that has not sent emails to your organization in the last 1 to 90 days (per the threshold). We recommend activating the Domain greylist threshold for at least 30 days before enabling Tag greylisted emails, for better data collection. Data collection on sending domain names occurs only if all the following conditions are met:

• The recipient's domain is not the same as the sender's domain.
• The sender's domain is not in the list of common domains.
• The sender's domain was not allowlisted.

Tag greylisted emails - adds a tag (# Unknown domain: Possible spam/phishing mail #) in the Subject field of each email from a sender's domain that has not sent emails to your organization in the last 1 to 90 days (per the Domain greylist threshold). Each email is scanned in the background.

Copy settings - lets you copy the current domain's Email Security configuration to one or more other domains, so you can apply a consistent configuration without reconfiguring each domain manually.