Email Protection - Bitdefender TechZone

You must perform several key configuration steps to ensure reliable mail flow within your environment. You should start by securing your incoming traffic. You create a dedicated inbound connector within the Exchange Admin Center (EAC) to restrict delivery only to messages filtered by Extended Email Security. You also establish a specific mail flow rule for the Extended Email Security IP ranges. This rule allows filtered email to be delivered safely. It also prevents potential issues caused by double filtering from Microsoft's native protection.

Next, you address your outgoing communications to maintain a sender reputation. You configure an Outbound Smarthost for Gateway and Unified deployments. This ensures that your outgoing email routes through the filtering engines. This layer protects your domain reputation and prevents your organization from being flagged as a source of spam. If you use Microsoft 365 or Exchange, you also set up an outbound filtering configuration to facilitate this secure routing.

You can also empower your users to participate in the security process through the Outlook report button. This button allows your employees to share potential false negatives or false positives directly with your helpdesk. You activate this feature by configuring settings within the Microsoft Security Center.

While you configure your policy templates, you define exactly how the system responds to every scanned email. The engine assigns specific labels based on the detected intent. You assign a specific action for each verdict to automate your response. You manage outcomes for Clean, Impersonation, Infomail, Malware, and Phishing. You also control results for various Spam levels. You can set the system to Deliver, Quarantine, Reject, or take No Action. For example you might deliver clean mail by default but quarantine phishing attempts.

You further customize your security within the same template using attachment and geographic controls. You use Banned Attachments to quarantine or apply banners to specific file types. You block categories such as Executable or Encrypted files. You also manage Video, Audio, Compressed, Macros, and HTML files. You activate Geo-filtering based on physical location or the Top-Level Domain of the sender address. This allows you to block traffic from regions that your organization does not frequently contact.

The Cold Outreach toggle lets you filter unsolicited sales and marketing emails more aggressively. This is recommended for policies targeting your management teams. Zero Trust enables a quarantine by default approach. This reclassifies Clean and Infomail verdicts as Spam-Likely unless the sender is a known contact. A known contact is a sender the recipient has previously sent outbound emails to, and the system identifies these automatically for Unified and 365 models. You must use the Outbound Smarthost for the Gateway model to identify known contacts.

Finally, you adjust the Spam Filtering Sensitivity to set your threshold for spam detection. Medium is the default setting. You can set it to Low to be less restrictive, or you can choose High for maximum security across the organization or for high-risk mailboxes.

Detailed information about policy templates configurations can be found at our Bitdefender Support Center here.

You can create allow, block, and custom rules to bypass or override your global template configuration. These rules provide the flexibility to manage exceptions at various levels. You can apply rules globally for all MSP customers or specifically for individual accounts, domains, and mailboxes.

Allow rules focus on trusted sender addresses and domains to streamline delivery. For example, you may see senders with misconfigured SPF or DKIM settings. These errors can result in legitimate emails being quarantined. You can create allow rules for high-priority senders to prevent these problems. To maintain a strong security posture, these rules never bypass critical verdicts like phishing, malware, or banned attachments. You should utilize a custom rule when a total exception for these categories is required.

Block rules allow you to block emails from a specific sender address or domain. You can apply block rules globally, organizationally, or at the domain and user levels.

Custom rules are your most flexible tool for incident response. You use them when a scenario requires more than a simple allow or block decision. Unlike standard rules, custom rules support multiple conditions in a single entry. You build these using sender addresses, IP ranges, subject lines, URLs, and headers. You even create rules for particular attachment types. This approach allows you to build complex configurations that standard rules cannot handle. For example, organizations using security awareness tools often need to whitelist specific IP ranges. You can enter these addresses in CIDR notation within a custom rule to ensure simulated phishing tests are delivered correctly.

Detailed information about rules configurations can be found at our Bitdefender Support Center here.

Detailed information about Policy & Rule Hierarchy can be found at our Bitdefender Support Center here.

Emails remain in the quarantine for 28 days. You cannot remediate or release messages once they exceed this period. Automated email digests empower your end-users to manage their own low-risk mail. You can enable or disable these digests globally at the MSP level, per customer, or for specific mailboxes. You can configure the frequency and select which email types appear in the reports.

Users only receive a digest if the system identifies new quarantined emails since the last summary. If a user wants to check for new information immediately, they can use the digest on demand option. This manually triggers a fresh digest with the latest information. When a user requests an email release, you control where the notification is sent. Emails awaiting approval show a pending status in the Live Email Tracker.

The digest includes options to deliver, delete, or preview messages. The preview button allows users to read quarantined emails safely within a browser window. The system removes all images and converts all links to plaintext. Users can also select the Manage Your Quarantine button to log into a dedicated portal. They sign in using local credentials or Microsoft SSO. In this portal, users view a personal Live Email Tracker for their own addresses. They can also manage their personal policy page to create and edit allow or block rules.

The service provides more than a binary "spam or clean" result. Through machine learning classification models, it delivers a detailed bitmask verdict that categorizes the threat for more granular security orchestration. This enables security teams and automated systems to accurately prioritize and respond to emails based on specific classifications:

By providing a threat probability score alongside these categories, Bitdefender enables an adaptive security posture, allowing organizations to tune their email protection sensitivity.