When a message arrives at a corporate mailbox, it passes through several layers of checks before it ever reaches the recipient's inbox. Each layer intercepts its own class of threats: reputation analysis filters out spam, SPF/DKIM/DMARC checks block spoofing, sandboxing detects malicious attachments, and anti-phishing analysis catches fraudulent links. Together, these layers close off most email-borne attack vectors.
In this article, we break down how each protection layer works and in what order it's applied. If you're interested in how to choose such a solution for your organization, start with the article What Is Mail Security.
How a Message Moves Through the Protection System
An incoming message moves through a pipeline of checks. The order of steps varies depending on the solution's architecture, but a typical sequence looks like this.
- Connection check. Before the message is even accepted, the gateway checks the reputation of the sending server's IP address. If the IP appears in threat databases, the connection is dropped — the message is never accepted at all.
- Sender authentication. The gateway checks SPF, DKIM, and DMARC records. A message that fails these checks is tagged accordingly and handled according to policy — rejected or quarantined.
- Domain reputation analysis. The sender's domain and message headers are analyzed for signs of known spam campaigns.
- Content filtering. The message text and metadata are checked for signs of phishing, BEC, and fraud.
- Link inspection. Links in the message body are scanned at delivery time; if time-of-click protection is available, they're scanned again when the user clicks.
- Dynamic attachment analysis. Suspicious files are sent to an isolated environment (a sandbox) for behavioral analysis.
- Verdict and quarantine. Based on the results of all checks, the message is delivered to the inbox, held in quarantine, or blocked. The results are logged for auditing and retrospective analysis.
Sender Authentication: SPF, DKIM, DMARC
The first line of defense against spoofing is email authentication mechanisms. Each one closes off a distinct forgery vector.
SPF (Sender Policy Framework) specifies which IP addresses are allowed to send mail on behalf of a domain. The receiving server checks whether the sending server's IP is on that list. If it isn't, the message fails SPF.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message headers. The receiving server verifies the signature using a public key published in the domain's DNS records. The signature confirms that the message was genuinely sent by the domain owner and wasn't altered in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance) combines SPF and DKIM into a single policy and tells the receiving server what to do with messages that fail at least one of the checks: deliver, quarantine, or reject. DMARC also configures reporting on check results, which helps track attempts to spoof the domain.
Using all three mechanisms together closes off most direct spoofing scenarios — From-field forgery, which attackers use in BEC attacks. For more on these attacks, see the article Protection Against Phishing and BEC.
Reputation Analysis and Content Filtering
After authentication, the message undergoes deeper content analysis.
Reputation analysis scores the sender's domain and IP against databases that aggregate information on spammers, phishing campaigns, and botnets. Messages from sources with poor reputations are blocked or flagged as suspicious — this happens quickly and doesn't require a full breakdown of the content.
Content filtering examines the message itself: header structure, subject line, body, language, and metadata. Heuristic rules and machine learning models detect signs of phishing — telltale text patterns, false urgency, requests to enter credentials, and atypical senders.
This layer is especially important for BEC attacks: such messages contain no links or attachments, so only content and context analysis can catch them. For example, a mismatch between the display name in the From field and the actual email address is a telltale sign of executive impersonation.
Dynamic Attachment Analysis in a Sandbox
Signature-based antivirus checks files against a database of known threats. New malware samples don't appear in these databases until they've been discovered and studied. Dynamic analysis exists precisely for these cases.
How the sandbox works. A suspicious file — a document, archive, or executable — is run in an isolated virtual environment that mimics a typical workstation. The system observes the file's behavior:
- whether it contacts external servers or command-and-control servers;
- whether it spawns child processes;
- whether it modifies system files or the registry;
- whether it tries to hide its activity or disable protection.
If the behavior matches a malware profile, the file is blocked and the message is held in quarantine.
Static and dynamic analysis. Some solutions combine static analysis (file structure, strings, metadata) with dynamic analysis. This speeds up inspection: clearly malicious files are blocked faster, and only files for which static analysis produced no conclusive result get sent to the sandbox.
Evasion techniques. Modern malware uses tricks to detect an analysis environment: delaying activity, checking the number of running processes, waiting for user actions before activating. Advanced sandboxes account for these tricks and adapt the analysis environment so the malicious code is fooled into believing it's running on a real device.
Anti-Phishing Link Analysis
Links in emails are one of attackers' primary tools. A phishing page is often created just before the mailing goes out and doesn't appear in any threat database at the time of the initial check.
Check at delivery. When a message is received, the system rewrites its links (URL rewriting): the original address is replaced with a proxy link that gets re-checked when clicked. The original link is analyzed against reputation databases and checked for signs of typosquatting (domains resembling legitimate ones) and phishing patterns.
Time-of-click protection. The link is checked at the moment the user clicks it, not just when the message is delivered. If a phishing site becomes active, or the domain gets added to a malicious list, between delivery and the click, the user gets a warning or the click is blocked.
Deep analysis. The system unwraps redirect chains, checks the final destination address, and analyzes the landing page content — signs of impersonating legitimate services, credential-entry forms, and data-stealing scripts.
Quarantine and Retrospective Analysis
Some messages don't receive a clear-cut verdict right away — they're held in quarantine.
Quarantine is an intermediate holding area where a message waits for all checks to complete. The administrator sees a list of quarantined messages with the reasons they were held and decides whether to release the message or confirm the block. In some implementations, the user receives a notification and can request the release themselves.
Retrospective analysis. Threats aren't always detected instantly. If the threat database is updated after a message is delivered and a link or file from that message is later flagged as malicious, the system raises an alert and removes the message from users' inboxes, either automatically or on the administrator's command.
This matters most for delayed-activation attacks: the phishing site or malicious file was harmless at delivery time but became dangerous after passing the initial check. Retrospective analysis closes this window.
Employee Training as a Layer of Defense
Technical measures cover most threats — but not all of them. Targeted emails, social engineering, and convincing executive impersonation are designed to exploit human reaction, not to bypass technical filters.
Some email protection solutions include phishing simulation modules: the system automatically sends employees test phishing emails and tracks who clicked the link or entered credentials. Additional training is assigned based on the results. Simulations help not only train staff but also gauge the organization's actual readiness before an attacker uses the same method for real.
BI.ZONE Mail Security combines technical filtering mechanisms with security awareness tools — for guidance on choosing a solution that covers all these layers, read the article How to Choose a Corporate Email Protection Solution.
Frequently Asked Questions
How does signature-based antivirus differ from a sandbox?
Signature-based antivirus compares a file against a database of known threats. It quickly catches familiar malware but misses new samples. A sandbox observes the file's behavior in an isolated environment and detects threats that aren't in any database yet.
What is time-of-click protection and why is it needed?
Time-of-click protection checks a link from an email at the moment the user clicks it, not only when the message is delivered. This closes off attacks where the phishing page is activated only after the message has already passed its initial check.
What happens to a message in quarantine?
The message is held in an isolated store and doesn't appear in the recipient's inbox. The administrator reviews it and decides whether to deliver or block it. Some systems notify the user about the held message and let them request its release.
Why are BEC emails harder to detect than regular phishing?
BEC emails most often contain no links or attachments — the attacker relies solely on text and imitation of a real sender. Signature analysis and attachment scanning won't catch them. They're detected through content analysis: checking headers, message structure, and text semantics for signs of impersonation.
Does DMARC protect against all forms of spoofing?
DMARC closes off direct domain spoofing — when an attacker forges the From field with your domain. But it doesn't protect against lookalike-domain attacks (typosquatting): an attacker registers a new domain like bi-zone.com or bizone.com and sends mail from it. These cases require anti-phishing link analysis and employee training.
Hands-On Practice in BI.ZONE Cybersecurity Labs
It's easier to understand protection mechanisms through real examples. In the course, you work with live BI.ZONE Mail Security infrastructure: configuring filtering policies, analyzing sandbox reports, and figuring out why specific messages were quarantined — and how to catch them faster.