What changed in the service, month by month: detection, the MailGuard portal, the platform underneath, and this website. Updates reach every customer automatically; there is nothing to install.
When you trust a sender, the rule-based score was already reduced, but the learning model could still add its full weight afterwards. For senders that pass authentication, the model's contribution is now scaled down in step with the whitelist.
Some tenants re-send inbound mail to the gateway (a forward-to-self rule, for example). We now recognise our own authentication seal on that mail and keep the original verdict instead of re-scoring it as a spoof, and a loop stops at a single delivered copy.
Campaign detection previously needed breadth: many recipients or many tenants. A new tier catches the same kit sent to one mailbox repeatedly over weeks from rotating senders. Built after a credential-harvesting kit targeting one user was traced across 19 copies.
Credential-harvesting pages were being delivered as .html files labelled as generic binary data to dodge inspection. The analyzer now opens any HTML-named attachment whose bytes look like HTML, whatever type the sender declared. Module library →
Genuine mail from Microsoft services such as Rewards and Advertising was flagged as Microsoft impersonation because only a handful of Microsoft domains were on record. Fourteen verified Microsoft-owned domains were added, and the display-name check reads the same list.
Onboarding and course platforms that send on a customer's behalf legitimately set the customer as Reply-To. That is no longer scored as header forgery when the platform's own authentication passes.
If your domain's DMARC record routes reports to a real mailbox, dozens arrive daily from dozens of providers. They are now recognised by their structure, scored as the routine reports they are, and never mistaken for a spam campaign. A forged "report" carrying a lure is still held.
Forms with filled-in customer fields, a brand's own domain naming the brand, and phrases like "for more information" were feeding a windfall-scam pattern. Those signals now require the fill-in instruction, blank fields or several fields together.
The Barracuda Reputation Block List joins Spamhaus and SpamCop in the real-time blocklist checks. SORBS, whose zones went dark in 2024, was retired.
Releasing many messages at once, or releasing in a quick burst, still delivers them but no longer teaches the system that each sender is trusted. Blocking rules created from spam reports now lapse after 90 days of catching nothing.
A plain-language tip about one current scam pattern, rotating every two weeks, shown to every user in the portal. Written for the person reading their mail, not for administrators.
New-account, password-reset and archive-access emails arrive in your language with the OpenEFA mark, signed by the administrator who sent them, with replies going to that person.
Passkey sign-in (fingerprint, face or security key) is open to every role, not only administrators.
The portal and its emails are available in English, Czech, Dutch, French, German, Italian, Polish, Portuguese, Slovak and Spanish. Each user picks a language from the top bar and it is remembered.
Significant public advisories (the CISA alert of 8 October, for example) appear as a plain-language banner in the portal with a link to the full write-up. Security advisories →
During onboarding, every copied message is now scored before the system learns from it, so a new customer's sender history is not seeded with spam that their previous filter let through.
The EFA Collective's IP listings are published as a DNS blocklist anyone can query, with a lookup page, a written listing policy, automatic expiry and human-reviewed removal. rbldb.org →
The gateway now runs its own recursive resolver, so blocklist and authentication lookups are no longer at the mercy of shared resolvers under load.
What your administrator configures on Microsoft 365, Google Workspace, Zimbra, Exchange Server and hosted providers, and how cutover and rollback work. Read it →
Every detection module in seven groups, with what each one catches. Read it →
Thirty days to 22 October: 99.23% F1, 98.46% precision, 1.52% false positives on 39,403 messages. Performance →
Per-user plans are the pricing, in our cloud or hosted on your premises at the same per-user price. Support is included in every plan. Pricing & Services →
Short brand names were matching inside ordinary words, so people named Rhonda or writing from Stanford were flagged as Honda and Ford impersonation, while genuine American Express mail was flagged because the two-word brand never matched its one-word domain. Both fixed; a brand's own domain only counts when authentication passes.
Patterns that matched fragments inside words ("fund", "commercial", "statement") were holding legitimate insurance and finance correspondence. Patterns are now word-anchored and bounded.
Messages dressed as replies to conversations that never happened are caught more reliably, including the variants seen in a thread-hijacking attempt on a customer.
Fake receipts, renewals and security alerts whose only call to action is a phone number are now scored on their context and the number itself. Previously these had no link to check and often slipped through. Module library →
Links that Outlook or Word write as plain text, which mail clients turn into links on display, are now rewritten through Time-of-Click protection like any other link. The visible text is never changed.
A newsletter with seventeen links to one deep tracking host was being charged for each link. Deep hostnames now count once per host and are discounted for authenticated senders.
Services that send from a new no-reply address every time (sign-in links, security alerts) kept restarting as unknown senders. Addresses of the same family at the same domain now share one trust history.
Authentication results carried by Microsoft, Google and Yahoo forwarders are accepted only when the chain verifies and the forwarder owned the hop; forged headers fall through to real validation. Our own results are stamped in the standard header format and sealed with ARC on every delivery.
A penalty meant for Google Groups messages sent to non-members was firing on every marketing platform campaign; it now requires real Groups markers. Separate fixes stopped boilerplate scripts in bank and utility templates, and customers whose first name happened to match an employee's, from being penalised.
Outlook writes forwarded links as https://x<https://real>. Those were being read as one malformed address and scored as lookalike characters. Also: a sender who earns trust at one of your domains no longer has that result mistakenly applied at another tenant.
Messages signed by both a sending platform and the sender itself were failing DMARC because only the first signature was examined. All signatures are now verified and alignment is judged on whichever one verifies. Two-thirds of previously failing platform-sent mail now passes.
The per-organization learner was ignoring what users released because its confidence gate only measured spam. Released mail now carries weight, shared footer hosts (CDNs, social links, tracking) are never learned as spam signals, and learning reads the full message rather than a short summary.
A sidebar layout with a message detail panel, release, block, whitelist and delete from the panel, and advisories in a notification drawer. The classic interface remains available for a transition period.
Releasing a message that has already been released now asks first, with who released it and when, instead of sending the recipient a duplicate.
When someone forges one of your domain's addresses and the message is blocked, your domain administrators receive a notice listing the attempts, daily or immediately. The impersonated user is never copied.
The convenience setting no longer keeps you signed in across sessions; it fills in your email address and nothing more.
The filter, the web application and the scoring service run in restricted sandboxes with no privilege escalation; anything that needs elevated rights goes through a narrow broker. Sessions are bound to the account's current credentials.
If the virus scanner is unavailable, mail with attachments is deferred and retried rather than delivered unscanned. Files that cannot be scanned are quarantined. Trusted and whitelisted senders are still scanned.
Long header lines (message threading identifiers, unsubscribe links) are sent exactly as the sender wrote them, so replies thread correctly in the recipient's client and the sender's signature stays valid.
The filter now stays resident between messages instead of starting from scratch for each one, removing several seconds of start-up from every delivery. Updates deploy without a gap in service.
OpenEFA™ throughout, pending registration.
Two new checks for lures sent through compromised but fully authenticated accounts: a brand's template or an e-signature notice sent from a domain that does not own it, and a message handed into an organisation's own mail relay from outside it, often from another country.
Messages consisting of one HTML part were being analysed as raw markup. They are now converted to text first, so the language and intent models see what the reader sees.
A message that asks you to reply to a different free-mail address than the one that wrote is scored for it, with the address checked against the Collective's known drop boxes. Retail mail from free-mail customers is unaffected.
Link targets are compared with Google Safe Browsing data served through the EFA Collective, without sending your mail to Google.
A scam wave hid pages of benign prose with styling tricks to dilute analysis. New hiding techniques are detected, hidden text is scored on first-contact senders, and high-confidence evasion is never discounted by good authentication.
The campaign scorer now shares the tagger's fingerprinting and sees messages already graduated to confirmed spam, so an active wave scores from its first variants. Unanimous votes from the learning model carry more weight.
Mail from recognised transactional infrastructure (order confirmations, receipts, notifications) is capped when the sender's authentication passes, so a stack of individually reasonable penalties can no longer hold a receipt.
Analysis, indicators and user guidance for a malware campaign delivered through real, compromised government mail infrastructure that passed SPF, DKIM and DMARC. Read the advisory →
QR-code scanning skips oversized images and downscales very large ones so a single message cannot stall processing.