Email Protection

Zoho eProtect has a spam control system that provides multiple options to customize the email protection settings to suit your organization's needs. You can customize the actions to be taken on unverified emails, set up allowed or blocked lists, define the quarantine controls for outgoing and incoming emails, and so much more.

Anti-Spam in Zoho eProtect

Spam Processing

The Spam Processing settings get configured when you set up your organization in Zoho eProtect. However, you can customize the settings that best suit your organization's requirements at any point of time from the Email Protection section. Follow these steps to modify the Spam processing settings:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Anti-spam and select Spam Processing. The configuration you chose while setting up your organization appears.
   
3. Select the type of spam processing that you want to set up:
   • Add header and forward - eProtect updates the email header with the content provided by admins and then forwards the email to the intended recipient.
   • Add subject tag and forward - eProtect appends the subject with the content provided by admins and then forwards the email to the intended recipient.
   • Quarantine - eProtect quarantines the email which can then be scrutinized by admins.
4. If you choose Add header and forward, follow these sub-steps:
   1. Enter a Header Name and Header Value.
   2. Click the + icon to add multiple headers as per your requirements.
   3. To delete a header row, click the delete icon.
5. If you select Add subject tag and forward, enter a Subject Tag.
6. If you choose Quarantine, eProtect quarantines the email. Admins can moderate these emails from the Quarantine section.
7. Click Save.

You have successfully configured the Spam Processing settings.

Spam Control Lists

Zoho eProtect lets you set up spam control lists specific to your organization. You can configure allowed lists, trusted lists, and blocked lists. To each of these lists, you can add domains, email addresses, IP addresses, etc. 

Allowed List

As an administrator, if you do not want certain emails to be marked as spam, you can add the domain and specific email addresses to the Allowed List. However, in case there is an SPF failure, and there is no action set for SPF failure, the emails from allowed list domains or addresses will not be marked as 'Not Spam'. In the case of SPF failure, the email may be a possible spoofed email, and hence the email address/domain added to the allowed list will not be effective in that case.

Follow these instructions to configure Allowed List:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Anti-spam and select Allowed List. The Email ID tab appears with a list of email addresses that you have already configured.
   
3. To add a new email address to the list, follow these steps:
   1. Click the Add button in the Email ID tab.
   2. Add one or more email addresses separated by a comma.
   3. Click Add email address.
   4. Alternatively, you can add email addresses in bulk by selecting the Import button on the top pane.
   5. Click Browse CSV Files, and select the file containing the email addresses. The email addresses in the CSV file get added to the allowed list.
4. To add a new Domain to the Allowed List, navigate to the Domain List tab and follow these steps:
   1. Click Add and enter one or more domain names separated by a comma.
      
   2. Click the Add domain button.
   3. Alternatively, you can also import domains by clicking on Import.
   4. Click Browse CSV Files, and select the file containing the domain names. The domain names in the CSV file will get added to the allowed list.
5. To allow emails from a certain IP address range, navigate to the IP Addresses tab and do these steps:
   1. Click on Add to enter the IP addresses.
   2. Enter the IP addresses and select the IP mask, depending on the IP range that you'd like to add. Refer here to know more about IP masks.
   3. Finally, click Add IP Address.
   4. Alternatively, you can also import IP addresses by clicking on Import.
   5. Click Browse CSV Files, and select the file containing the IP addresses. The IP addresses in the CSV file will get added to the allowed list.

Trusted List

The trusted list is where you can add any email addresses, domains, or IP addresses that you want to exclude from any sort of spam processing. None of the usual spam checks will be conducted on emails that are received from the entities added to the trusted list and they will not be validated for SPF, DKIM, or block list checks. While adding values to the trusted list, be doubly cautious since the organization could be exposed to spam or phishing attacks, as there is no spam check.

Follow the below instructions to define the trusted list for your organization:

1. Log in to the Zoho eProtect and select Email Protection on the left pane.
2. Navigate to the Trusted List section under Anti-spam. You will land in the Email List tab.
   
3. To add specific email addresses to the trusted list, follow these steps:
   1. Click Add and enter one or more email addresses separated by a comma and click Add email address.
   2. Alternatively, you can also import email addresses by clicking on Import.
   3. Click Browse CSV Files, and select the file containing the email addresses. The email addresses in the CSV file will get added to the trusted list.
4. To add one or more domains to the trusted list, click on the Domain List tab and follow these steps:
   1. Click Add and enter one or more domain names separated by a comma and click Add.
      
   2. Alternatively, you can also import domains by clicking on Import.
   3. Click Browse CSV Files, and select the file containing the domain names. The domain names in the CSV file will get added to the trusted list.

Blocked List

A Blocked list can also be defined commonly for the entire organization. The administrators can add entire domains, TLDs, specific email addresses, IP addresses, or recipient email addresses to the blocked list. In these cases, even if the domain passes the SPF test, the email from that domain will be marked as spam.

Additionally, while defining the blocked list, the admin can also choose the action to be taken on the blocked emails. They can either:

• Mark it as spam - The email will be moved to the respective user's spam folder.
• Move it to quarantine - The email will be quarantined from where the admin will have to process the email further.
• Reject the email - The email will be permanently rejected.

Follow the below instructions to define the blocked list for your organization:

1. Log in to the Zoho eProtect and select Email Protection on the left pane.
2. Select Anti-spam, and select Blocked List. You will land in Emails tab.
   
3. To add specific email addresses to the blocked list, do these steps:
   1. Click Add and enter one or more email addresses separated by a comma.
   2. Select the action to be taken on these emails and click Add email address.
   3. Alternatively, you can also import email addresses by clicking on Import.
   4. Select the action to be taken on these emails.
   5. Click Browse CSV Files, and select the file containing the email addresses. The email addresses in the CSV file will get added to the blocked list.
4. To add one or more domains to the blocked list, click the Domains tab and follow these steps:
   1. Click Add and enter one or more domain names separated by a comma.
      
   2. Select the action to be taken on these emails and click Add Domain.
   3. Alternatively, you can also import domains by clicking on Import. 
   4. Select the action to be taken on these emails.
   5. Click Browse CSV Files, and select the file containing the domain names. The domain names in the CSV file will get added to the blocked list.
5. To block emails from a certain IP address range, select the IP Addresses tab and follow these instructions:
   1. Click Add to enter the IP addresses.
      
   2. Enter the IP addresses and select the IP mask, depending on the IP range that you'd like to add. Click here to know more about IP masks.
   3. Select the action to be taken on these emails and click Add IP Address.
   4. Alternatively, you can also import IP addresses by clicking on Import. Select the action to be taken on these emails.
   5. Click Browse CSV Files, and select the file containing the IP addresses. The IP addresses in the CSV file will get added to the blocked list.
6. A Top-level Domain (TLD) is the last segment of a domain name. For example, in the domain name zylker.com, .com is the TLD. To block a TLD, click the TLDs tab and do these steps:
   1. Click Add and enter one or more TLDs separated by a comma.
      
   2. Select the action to be taken on these emails and click Add TLD.
   3. Alternatively, you can also import domains by clicking on Import.
   4. Select the action to be taken on these emails.
   5. Click Browse CSV Files, and select the file containing the TLDs. The TLDs in the CSV file will get added to the blocked list.
7. If you want to block emails addressed to certain org members, click the Recipient Emails tab and do these steps:
   1. Click Add and enter one or more email addresses separated by a comma.
      
   2. Select the action to be taken on these emails and click Add recipient email address.
   3. Alternatively, you can also import email addresses by clicking on Import. Select the action to be taken on these emails.
   4. Click Browse CSV Files, and select the file containing the email addresses. The email addresses in the CSV file will get added to the blocked list.

IP Addresses and IP Masks

If you are entering the entire IP address that denotes a specific machine, you will have to select the subnet as 32 from the dropdown list. If you mention just the network to denote all the computers that come under that network, enter the network part of the IP address and select the subnet depending on the number of bits that you have used in the IP address. 

For example, if you are entering 172.20.0.0 and select 30 from the dropdown list, it will refer to IP addresses in the range 172.20.0.0 - 172.20.0.3. This will denote a total of 4 IP addresses. This can be derived by calculating 2(32-n). In this case, the value of n will be 30, and by performing the calculation we derive at 22, which will be 4. Hence the 4 IP addresses will be added to the respective List. Similarly, you can add a consecutive range of IP addresses by selecting the relevant value from the dropdown list. 

Blocked List Patterns

Blocked List Patterns in Zoho eProtect will allow the administrator to add the usual patterns in which the spam emails get delivered to the users in the organization. The patterns that can be added are:

• Sender pattern
• Subject pattern
• Content pattern

Sender Pattern

You can add texts or regular expression patterns to this list to make sure that the emails containing these patterns in the sender's email address are marked as spam. You can set the Email delivery action to mark the email as spam or move the emails to quarantine.

To configure a pattern click on Add and provide any text/regex as the pattern value. You can set an expiry date for the pattern. You can also choose to add the pattern as a regular expression. Click Add to save the pattern.

You can also Edit/ Delete a pattern using the icons provided over the saved patterns.

Subject Pattern

You can add text or regular expression patterns to this list to make sure that the emails containing these patterns in the subject of the email are marked as spam. You can set the Email delivery action to mark the email as spam or move the emails to quarantine.

To configure a pattern click on Add and provide any text/regex as the pattern value. You can set an expiry date for the pattern. You can also choose to add the pattern as a regular expression. Click Add to save the pattern.

You can also Edit/ Delete a pattern using the icons provided over the saved patterns.

Content Pattern

You can add text or regular expression patterns to this list to make sure that the emails containing these patterns in the content of the email are marked as spam. You can set the Email delivery action to mark the email as spam or move the emails to quarantine. You also have the option to Mark blank emails as spam.

To configure a pattern click on Add and provide any text/ regex as the pattern value. You can set an expiry date for the pattern. You can also choose to add the pattern as a regular expression. Click Add to save the pattern.

You can also Edit/ Delete a pattern using the icons provided over the saved patterns.

International Spam

Language-based spam

You can allow or reject emails based on the language of the email. You can set the languages according to your preference in the Zoho eProtect.

Follow these steps to add languages:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Select Anti-spam, and navigate to International Spam. You will land in the Language tab.
   
3. Select the action that you'd like to take in the Spam processing action drop-down. 
4. Select either Allowed languages only or Block chosen languages.
5. Select the languages, and finally click Apply.

Based on the preferences set, emails in the languages that you've entered will either be blocked or allowed.

Country-based spam processing

Based on the location of the origin of emails, you can either reject the email, mark it as spam or move it to the quarantine list.

Follow the below steps to add locations:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Select Anti-spam, select International Spam, and select the Country tab.
   
3. Click on Add.
4. Select the countries, and choose the respective action that you'd like to take on emails from these countries.
5. You can either mark the emails as spam, move it to quarantine or reject it.

Emails from the respective countries will be processed according to the preferences that you have set.

Anti-Phishing

Zoho eProtect lets you customize the actions that need to be taken when certain emails fail verification of protocols such as SPF, DKIM, DMARC, etc. You can choose an action that best suits your organization's requirements from the actions permitted.

Table of Contents

• Spoof Protection
• SPF Verification
• DKIM Verification
• DNSBL Verification
• DMARC Verification

Spoof Protection

The Spoof Protection section in Zoho eProtect contains multiple settings with which you can configure your organization's spoof protection. Listed below are the spoof control settings available in eProtect:

SPF Verification

SPF or Sender Policy Framework is the DNS record that defines the email servers that are allowed to send emails based on the particular domain. For incoming emails, the SPF validation is based on the sending domain's published SPF Record and the IP from which the emails are received. In case of a conflict, the SPF validation returns soft fail or fail for the emails. The administrator can choose to 'Temporary Reject' or 'Reject' or 'Allow (Process further)' or 'Move the emails to Quarantine' for the SPF Soft Fail and Fail cases. 

To customize the action on emails that have failed SPF validation, follow the below instructions:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Spoof Protection under Anti-Phishing.
   
3. Under SPF Verification, select the actions for SPF failure and SPF soft failure.
   • Permanent reject: To directly bounce back the emails, if the SPF fails/ soft fails based on the option chosen.
   • Temporary reject: To temporarily reject emails with 4xx errors. The retries will be checked for SPF Again and will be accepted if the sender has corrected or updated the SPF records.
   • Move to quarantine: To move the email to the spam quarantine, for review by the administrator.
   • None: To move the email to further spam processing, without rejecting the email.

DKIM Verification

When an incoming email has a DKIM signature in the header, the DKIM validation happens for the email. In case the DKIM is found not valid, then the administrator can choose one of the available actions for such emails.  

To customize the action on emails that have failed DKIM validation, follow the below instructions:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Spoof Protection under Anti-Phishing.
   
3. Under DKIM Verification, select the desired action.
   • Permanent reject: To directly bounce back the emails, if the DKIM validation fails based on the option chosen.
   • Temporary reject: To temporarily reject emails with 4xx errors. The retries will be checked for DKIM again and will be accepted if the sender has corrected or updated the DKIM records.
   • Move to quarantine: To move the email to the spam quarantine, for review by the administrator.
   • None: To move the email to further spam processing, without rejecting the email.

DMARC Verification

DMARC policy is an email authentication protocol built on the widely deployed SPF and DKIM protocols. If there is an authentication failure, and the DMARC policy is set to quarantine, the administrator of the recipient domain can choose one of the available actions to perform on the emails.

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Spoof Protection under Anti-Phishing.
   
3. Under DMARC Verification, select the desired action.
   • None: To move the email to further spam processing, without rejecting the email.
   • Move to spam: To mark the email as spam, without any further checks.
   • Move to quarantine: To move the email to the spam quarantine, for review by the administrator.

DNSBL Verification

Zoho maintains a consolidated Blocklist based on User Spam Marking, Abuse patterns, and certain third-party Blocklists subscribed by us. Similar to SPF and DKIM, the organization administrator can add rules to control the execution of the Zoho Blocklist. The administrator can control the delivery of emails based on his organization's requirements. 

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Spoof Protection under Anti-Phishing.
   
3. Under DNSBL Verification, select the desired action.
   • Permanent reject: To directly bounce back the emails, if the sending domain/ email address or IP address is present in the Zoho Blocklist.
   • Temporary reject: To temporarily defer the emails, if the sending domain/ email address or IP address is present in the Zoho Blocklist.
   • Move to spam: To mark the email as spam, without any further checks.
   • Move to quarantine: To move the email to the Spam Quarantine, for review by the administrator.

Cousin Domains

Cousin Domains are domain names that are very similar to any other valid domain name. If you expect a domain to send genuine emails, but want to mark an email from any other variations of the domain name as spam, you can add it in this section.

For example, if 'zylker.com' sends genuine emails, but emails from 'zylker1.com' need to be processed for spam, you can add zylker.com here. Follow these steps to add Cousin Domains:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Cousin Domains under Anti-Phishing and enable Cousin Domain Verification.
   
3. In the Email Delivery Action dropdown, select the actions for emails that have look-alike domain names.
   • If you select None, no action will be taken.
   • If you select Move to spam, the email will be moved to the spam folder of the email recipient.
   • If you select Move to quarantine, the email will be moved to the quarantine list, from where the admin will have to process it further.
4. You can also choose to Include Internal Domains, which means that all of your organization's domains will undergo the cousin domains check by default. So, any domain name that is similar to yours will undergo the specified action.
5. Click Add, enter the domain names for which the cousin domain check has to be done and click Add domain.
6. You can also choose to include the domain names by clicking on Import, and selecting a CSV file which has all the domain names. 
7. In the Email Delivery section, select the action for emails that have similar domain names.
8. In the Domain List, enter the names of domains for which the cousin domain check has to be done.

The Cousin Domains feature is especially useful in cases where an email sender might try to trick recipients with a valid domain name.

For example, you might expect the domain webhosting.com to send valid emails to your org users. So, when an email arrives from user@vvebhosting.com, your org members might consider it legitimate, but the email sender has tricked the recipient by replacing the 'w' in webhosting.com with 'vv'. In cases like these, the Cousin Domains feature comes into play. 

VIP Display Names

Administrators can control the fraudulent usage of display names by setting up the respective conditions for emails that violate your customization. You can set up a display name and associate one or more email addresses with this display name in the Zoho eProtect.

For example, consider the email address ceo@mydomain.com, you can ensure that if an email with the display name 'CEO' arrives from any other email address, the action defined by you is taken on this email address.

Follow the below steps to add a policy to prevent display name fraud:

1. Log in to Zoho eProtect and select Email Protection on the left pane.
2. Navigate to VIP Display Names under Anti-Phishing.
   
3. In the Email Delivery Action drop-down, select the action for emails that have spoofed display names.
   • If you select None, no action will be taken.
   • If you select Move to spam, the email will be moved to the spam folder of the email recipient.
   • If you select Move to quarantine, the email will be moved to the quarantine list, from where the admin will have to process it further.
4. Click Add, enter the display name, and the email addresses that can be associated with this name, and click Add users.

You will be able to see a list of the Display Names and the respective Email Addresses that you have added to the list.

Inbound Rules

Connection Filtering for Inbound Rules

With the help of connection filtering rules, you can decide which emails get to reach your inbox and filter out unnecessary emails right at the authentication level. In order to filter out emails, you have to establish a set of conditions against which the incoming emails of your organization will be validated before transferring them to the respective inboxes.

Create a Connection Filtering Rule

To create a connection filtering rule, 

1. Log in to the Zoho eProtect and select Email Protection on the left pane.
2. Navigate to Inbound Rules and click Connection filter (Level 1).
3. Click the Create button and select the preferred option:
   • Create new rule
   • Quarantine emails from external senders
   • Reject emails from specific senders or domains
   • Quarantine emails for users belonging to a group
     
4. Enter the rule name, provide an optional description and click Proceed.
5. Choose the Condition type.
   • AND - Only if the incoming emails satisfy all the conditions you provided, the preferred action will be performed.
   • OR - Even if the incoming emails satisfy one of the conditions you provided, the preferred action will be performed.
   • Advanced - You can combine both AND & OR condition types, within a single condition, for the preferred action.
   • No Condition - When chosen, all the emails you receive will go through the preferred action.
6. Select your condition, operating parameter and enter the appropriate value in the Add values field.
7. Click the + icon to add multiple Conditions. 

8. Select the desired action and click Proceed.

   Action	Description
   Move to spam	All the emails that satisfy the given condition/s will be moved to the spam folder of the recipient's inbox.
   Permanent Reject	All the emails that satisfy the given condition/s will not be accepted by our servers and will be rejected permanently removing the chances of delivery retries.
   Move to quarantine	The emails that satisfy the given condition/s will be moved to quarantine for the administrator's approval.
   None (Allow email)	No action will be taken for emails that satisfy the given condition/s.

9. In the APPLY TO page, you can choose to which users you want the rule to be applied. You can select one of the options below:
   • All Users - The rule will be applied to all the users in your organization.
   • Selected Users - The rule will be applied to the specific set of users you add.
   • All users except selected users - The rule will be applied to all the users except the ones added to the list.
10. To add users to the Selected Users or Excluded users list, simply select the respective option, and click the Add button. Select the users you want to add to the list and click Proceed. You can also remove a user from the list by clicking the Delete icon next to the user.
11. Once done, click Proceed. On the preview page, you can review your rule and set an expiry date if needed.
12. After reviewing your rule, you can,
    • Create & Enable Rule - Your rule will not only be created but also be activated automatically to start processing emails with respect to its conditions and actions.
    • Create Rule - Your rule will only be created and not activated. That means if you want the rule to be applied to the emails you receive, you will have to manually activate it.

Available Conditions

You can set up more than one condition in a single rule depending on your requirement.