No single test decides whether a message is safe. Every email passes through authentication and reputation checks, attachment and link inspection, impersonation and intent analysis, and a behavioral comparison with the sender's own history. The decision engine then weighs all of it and shows you exactly which modules fired and why.
A compromised Microsoft 365 mailbox passes SPF, DKIM and DMARC and has a clean reputation. What gives it away is everything else: a first-ever contact, a wire request, a reply that belongs to no thread, a template seen at three other organizations this week. Each module sees one of those things. Together they see the attack.
Every message goes through all four layers in order. A message that passes authentication still faces behavior, intent and the decision engine, which is how fully authenticated phishing is caught.
Who sent it, from where, and does the infrastructure check out. Authentication, blocklists, DNS, URLs and attachments.
Is this normal for this sender and this recipient. First contact, earned trust, relationship graph, cadence and volume.
What the message is trying to make the reader do. Impersonation, payment and credential lures, urgency, evasion.
A machine-learning ensemble weighs every module's contribution against the organization's threshold and writes down the reasons.
Grouped by what they look at. Filter by group, or read straight through.
Layer 01. Who sent it and whether the infrastructure behind it checks out.
Every DKIM signature on a message is verified, not only the first, so mail signed by both a marketing platform and the sender counts as aligned. DMARC policy is read from DNS and applied exactly.
Authentication results carried by trusted intermediaries such as Microsoft, Google and Yahoo are accepted only when the chain verifies and the sealer owned the hop. Our own seal is recognized on mail that loops back through a forwarder.
Sending IP and domain are checked against Spamhaus, Barracuda and SpamCop through a private recursive resolver, so answers are the lists' real answers.
Reverse DNS, MX sanity, domain age and domain-name entropy. Brand-new or machine-generated domains carry more risk than established ones.
Every link is checked for known-bad hosts, lookalike characters borrowed from other alphabets, and abused shared-hosting platforms. Other gateways' link rewriters in quoted threads are recognized, not penalized.
Links in delivered mail are rewritten through the MailGuard click service. A page that turns malicious after delivery is still blocked at the moment the user clicks, and the visible link text is never altered.
Link targets are compared with Google Safe Browsing data served through the EFA Collective, without sending your mail to Google.
Mismatched Return-Path, Message-ID host and Reply-To, and injected headers, with allowances for the relay patterns of known email service providers so legitimate newsletters are not penalized.
Walks the relay path and flags a message that was handed into a sender organization's own mail relay from outside it, the fingerprint of a compromised account used from another country.
Layer 01. What is attached, what is embedded, and what the HTML really does.
Every attachment is scanned with ClamAV regardless of its declared type. If the scanner is unavailable the message is deferred and retried, never delivered unscanned. A file that cannot be scanned is quarantined.
JavaScript, launch actions, embedded files, phone numbers, QR codes and credential lures inside PDF attachments.
Credential-harvesting kits delivered as .html files, including files declared as some other type to slip past filters. Detects forms that post to chat services and anonymous endpoints.
Hidden text, deceptive links where the text names one brand and the target is another, embedded forms and scripts in the message body.
Decodes QR images in the body and attachments and runs the target address through the same URL checks as a written link.
Per-organization blocking by file extension and MIME type: executables, scripts, macro-enabled documents and archives that hide them.
Constructs that trigger known vulnerabilities in webmail clients, in address headers, calendar invitations and share notifications, are stopped at the gateway.
Messages that consist of a single image and no text, a common way to keep the words away from content analysis.
Layer 03. Is the message really from who it says, and is it dressed up as something it is not.
Display-name spoofing of executives and vendors, lookalike domains, payment and wire-transfer language, urgency and secrecy cues. Findings are tiered from low to critical, and critical findings force a hold.
A database of 1,000+ brands and the domains they legitimately send from. A brand in the display name or body that does not match an owned domain is flagged. Senders with an established history under that name are exempt.
Display names that match your own staff, from your directory or learned from your outbound mail, arriving from outside addresses.
Short brand words are matched as whole words, so Rhonda is not Honda and Stanford is not Ford. A brand's own domain is recognized only when authentication passes.
Default onmicrosoft.com tenant addresses used to pose as an organization that has its own domain.
A known brand's email template, or an e-signature or file-share notice, sent from a domain that does not own that brand.
"Re:" subjects and quoted conversations with no matching thread in your history, the signature of thread-hijacking attacks. Read the signal →
Marketing platforms legitimately set a customer's Reply-To. Anyone else steering replies to a free-mail address, or asking in the body to write to a different address, is not legitimate.
Mail claiming to come from one of your own domains that arrives from outside without authentication is held, and your administrators receive an impersonation alert listing the attempts.
Layer 03. What the message is trying to make the reader do.
A full NLP model extracts people, organizations, amounts and places and parses sentence structure. Every content module below reads its output rather than raw keywords.
Classifies what the message asks the reader to do: pay, log in, call, open, reply, buy. The ask matters more than the words used to make it.
Document-share lures, fake invoices, credential prompts, windfall and inheritance scams, and form fields the reader is asked to fill in.
Fake receipts, renewals and security alerts whose only call to action is a phone number. No link to check, so the message is judged on its context and the number itself.
Changed banking details, new remittance instructions, gift-card requests and wire-transfer language, weighed against who is asking and whether they ever have before.
Time pressure, threats and emotional manipulation are measured as language patterns, not matched as keywords. Read the signal →
Zero-width characters, letters interleaved with invisible ones, text hidden by styling, and pages of benign prose added to dilute analysis. High-confidence evasion is never discounted by good authentication.
Unicode substitutions, encoded words, and text in scripts the sender has no reason to use.
Unsolicited bulk mail, SEO and lead-generation pitches and cold commercial approaches. Learns per organization which senders are actually wanted.
Dedicated detectors for business funding and loan offers, refund scams, romance and dating, janitorial and cleaning bids, and government grant fraud.
The language of the message against the languages the recipient normally receives, and the country the message really came from.
Per-organization learning from what users release and report. Phrases and link hosts that keep appearing in spam gain weight; weights that turn out wrong decay.
Layer 02. Is this normal for this sender, this recipient and this organization.
Has this sender, or this domain, ever written to this organization before. New relationships get more scrutiny and less benefit of the doubt. Read the signal →
Senders build trust from authentication, delivery history and user feedback. Trust lowers scores, is withdrawn when a sender turns bad, and follows a service's rotating no-reply addresses. Read more →
Per-sender history across every protected organization, so a sender that behaved badly at one does not get a clean slate at the next.
Cadence, volume, timing and recipient patterns for each sender. A departure from the pattern is how a compromised account looks before anyone knows it is compromised. Read the signal →
Who writes to whom. An isolated sender with no two-way history scores differently from a long-established correspondent.
Replies inside genuine threads inherit the thread's trust. Thread context is learned from inbound and, where enabled, outbound mail.
What each mailbox normally receives. A retail orders address and an executive's inbox are judged against different baselines.
A known correspondent whose vocabulary, pacing or structure suddenly changes. Read the signal →
Copies of your outbound mail teach the system who you write to, so replies are trusted from day one. Before cutover, a prelearning period builds the same history from a copy of your inbound mail.
Layer 02. What is happening across senders, organizations and deployments at once.
Identical templates, link sets and attachment names seen across senders and organizations. Catches snowshoe waves from many domains and, separately, the same kit hitting one mailbox slowly over weeks.
A burst of spam against one organization raises its defenses automatically for the duration of the attack.
Sender, IP, URL and template intelligence contributed by every OpenEFA deployment and consumed by all of them. Only sender-side signals are shared; your recipients' mail never leaves your deployment. Read the signal →
Genuine DMARC aggregate reports addressed to your reporting mailbox are recognized by their structure, so dozens of reports from dozens of receivers are never mistaken for a campaign.
Domains with no real users receive and analyze attacker mail that is never delivered anywhere, feeding the Collective with fresh templates, senders and infrastructure.
Layer 04. Turning seventy opinions into one verdict, and writing down why.
Five classifiers (LightGBM, XGBoost, CatBoost, Random Forest and logistic regression) stacked over 130 features and retrained from production feedback. A unanimous vote carries more weight than a split one.
Each module's confidence is calibrated against real outcomes, so a signal that is often wrong stays a weak signal however loudly it fires.
Every organization sets its own threshold. Messages in untrusted threads face a lower one, established correspondents a higher one. Read the signal →
Soft content signals are discounted for fully authenticated senders with an established history. Hard signals such as evasion, malware and credential kits never are. Read the signal →
Every quarantined or delivered message shows the modules that fired, their weights and the evidence, in the portal and in the message headers. Why this matters →
Users release, report and trust senders from the MailGuard portal or the daily digest. Each action trains the system, with safeguards so a bulk release does not teach it anything by accident.
Verification codes and genuine DMARC reports from authenticated senders are capped below the threshold, so the mail people are waiting for always arrives.
Addresses that do not exist are refused during the SMTP conversation, before any content is accepted, so dictionary attacks never reach the filter and never bounce back out to a forged sender.
The Signals series explains the behavioral ideas behind the modules in plain language. The Performance page shows what they caught over the last 30 days of production traffic, and which modules did the catching.