Knowledge Base

61 articles

Configure Office 365 for EMS

To successfully add Office 365 customers, you will need to perform three steps: Configure Cloud USS for the Office 365 accounts. Configure Inbound mail on Office 365 to reject non-EMS emails. Configu…

Updated 6 hours ago

Safelisting Email Security IP addresses in Office 365

If you are using USS Email Security and delivering clean email to Office 365, it is essential to bypass Exchange Online Protection (EOP) to ensure smooth delivery of email. Failure to add the bypass…

Updated 1 year ago by admin

Configure GMail using Google Workspace for EMS

To successfully add GMail using G Suite and configure Email Security (EMS), you will need to perform three steps: Configure EMS for GMail using G Suite accounts. Configure Inbound mail on GMail using…

Updated 2 years ago by admin

MX records and IP addresses for EU customers

This article lists the MX records and IP addresses used by the USS Email Security service. These records are for customers located in Europe or for customers that require email processing to take pla…

Updated 1 year ago

MX records and IP addresses for USA customers

This article lists the MX records and IP addresses used by the Email Security service. These records are for customers located in the USA or for customers that require email processing to take place…

Updated 1 year ago by admin

MX records and IP addresses for UAE customers

This article lists the MX records and IP addresses used by the Email Security service. These records are for customers located in the United Arab Emirates or for customers that require email processi…

Updated 1 year ago by admin

MX records and IP addresses for all regions

This page has recently been updated. Please use the following articles instead: MX records and IP addresses for customers in North America or rest of world. MX records and IP addresses for customers…

Updated 2 years ago

Reporting spam or false positives

If you believe Email Security has generated a false positive report for an email message, or if you have received a spam message, you can report the email to the Email Security operations team. The q…

Updated 4 years ago

Configure outbound email for Exchange 2007/2010

It is important that you configure your Exchange connectors to send outbound email out through the MailSafe service. This ensures that both your outbound traffic is scanned and your traffic is profil…

Updated 5 years ago

Configuring TLS encryption

You can use TLS to encrypt the tunnel between sending and receiving SMTP servers. This increases the security of your emails, and makes interception less likely. Email Security provides two options f…

Updated 5 years ago

LinkScan: on-demand URL protection

The reputation of URLs contained in an email is checked at the time of processing using the URL Scanner Rule condition. With LinkScan , further checks are conducted the moment the end-user clicks the…

Updated 2 weeks ago

Bulk Email & Fair Usage

Clients that make use of Email Security for sending outbound email must respect the terms and conditions below, pertaining to bulk email and fair usage. If you wish to send bulk email, customers and…

Updated 3 years ago

Queue retention and retry times

Email Security has a set of standard retry and retention times, which dictate how long an undelivered email will remain in the email queue. If a connection results an error message in the 5xx range,…

Updated 3 years ago

Personal Safe Lists and Personal Deny Lists

As well as the Global Safe Lists and Global Deny Lists , Each Email Security user has access to their own Personal Safe List and Personal Deny List as well. You can grant users the ability to view th…

Updated 5 years ago

Configure outbound DMARC

Email Security provides the ability to participate in DMARC (Domain Message Authentication Reporting and Conformance) for email authentication. Below configuring any DMARC DNS entry, you must ensure…

Updated 2 years ago

Configure outbound DKIM

Domain Key Identified Mail or DKIM verifies that email is from the domain-configured source and has not been changed in transmit. By configuring DKIM outbound it will increase your domain reputation…

Updated 2 years ago

Configure outbound email for Exchange 2016

It is important that you configure your Exchange connectors to send outbound email out through the MailSafe service. This ensures that both your outbound traffic is scanned and your traffic is profil…

Updated 5 years ago

CEA - Data storage explained

The Compliant Email Archive (CEA) captures and stores every message sent or received in a separate, secure, tamper-proof database in the cloud. Archived messages are de-duplicated, compressed, indexe…

Updated 5 years ago

Reject message due to message “550 5.1.8 sender denied”

The Email Security (EMS) product will generate this response from the Deny rule at the connection level and is enforced through Connection Rules. This rule looks at the company and personal deny list…

Updated 2 years ago by admin

Insufficient system resources message on inbound email delivery

The 452 4.3.1 Insufficient system resources error originates from the Microsoft Exchange server due to the server either running out of disk space or free memory. In Exchange Server, the transport se…

Updated 5 years ago by admin

Email Sandbox - Supported file types

The following file types are supported by the Email Sandbox product. File detection techniques are used to determine the real type of the file even if the extension has been manually changed. The max…

Updated 2 years ago by admin

Outbound Delivery error: 550 Unable to relay

All outbound emails are authenticated. This is achieved in one of two ways, Server based or User based. If you receive the error <server>.scanscope.net #550 Unable to relay it means that authenticati…

Updated 5 years ago by admin

[Marketing Medium] or [High Medium] prefixed to the subject of mails

The Email Security (EMS) product detects marketing emails and has three levels of detection. These are: High Reputation Marketing Typically, email campaigns issued from a professional and known routi…

Updated 5 years ago by admin

DMARC Failure Reporting

If you receive an abuse report based on your DMARC DNS options, you'll be directed to this article. DMARC messages show a pass or a failure for each component, depending on your DMARC reporting optio…

Updated 4 years ago

Image Analysis for Email supported image types

The following file types are supported by the Image Analysis for Email product. The maximum file size that can be scanned is 50 Mb. This can be changed in the Product Configuration / Image Scanning m…

Updated 5 years ago by admin

Powershell Script to list Office 365 Shared Mailboxes

Run the following Powershell script to connect to Office 365 and export a list of Shared Mailboxes: $UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -Co…

Updated 5 years ago by admin

What happens when my Email Security license is suspended or deleted?

The following article describes the behaviour if your Email Security license is suspended or deleted. License Suspended. Mail flow will continue however any customer defined or standard rules will be…

Updated 1 year ago by admin

Example Spam Digest or Quarantine Report

If Digests have been enabled, the Email Security product will email end-users a summary of their personal quarantine directly to their inbox. It is possible to change the branding of the Digest email…

Updated 4 years ago by admin

No Valid MX Record NDR message

When you email a recipient over the Internet, the MX records specified in the domain DNS for the address you are sending to are checked. If those MX records are incorrect and point to an IP address d…

Updated 4 years ago by admin

How to onboard users into the End User Portal

The End User Portal is a minimal version of the Email Security administrator dashboard that allows end users to manage their own email quarantine, safe and deny lists, and any other relevant services…

Updated 3 years ago by admin

Installing the Outlook add-in for Email Security

The Outlook add-in for the Email Security product allows end-users to perform common tasks like reporting phishing attacks, managing quarantine and safe/deny lists directly from their inbox. Please n…

Updated 6 months ago by admin

How to avoid multiple disclaimers being added when forwarding or replying to emails

If configured, the Email Security rules engine will add the disclaimer (also known as a text banner) to outgoing messages for all or specific domains. If there are many replies to the same message, t…

Updated 4 years ago by admin

Cisco Fixup Protocol

SMTP inspection engine (also known as a "fixup" in the Cisco docs) is fairly notorious for interfering with email transfer and preventing successful delivery. You may even experience mysteriously mis…

Updated 4 years ago by admin

Adding images to email disclaimers

Email disclaimers can consist of plain text or HTML. A disclaimer can contain an image but only if it is referenced as an absolute URL using a standard HTML <img> tag. To insert an image into a HTML…

Updated 4 years ago by admin

Reject Top Level Domains

This article describes how to reject email from top level domains (TLD's) using a connection rule and Custom Rule Data. Consider also using the "Sender IP Geolocation" condition in a Connection Rule…

Updated 4 years ago by admin

Adding an alias to a primary mailbox

The Email Security product supports adding aliases to a primary mailbox so that email destined for variants of the primary mailbox address can be accepted through the DHA rule. An alias should only r…

Updated 4 years ago by admin

Outlook add-in is not the newest version

If the Outlook add-in has not refreshed within 24 hours of an update being available, it could be cached locally by the Outlook client. The following steps can be followed to clear the cache and forc…

Updated 2 years ago by admin

Temporary Server Error

If you are using Email Security but you are not receiving emails to your Exchange 2013 server and you see the following error in the Server Logs: 451 4.7.0 Temporary server error. Please try again la…

Updated 4 years ago by admin

Unable to Relay error on outbound email

All outbound emails are authenticated in one of two ways: Server based. User based. . If you get the error <server>.scanscope.net #550 Unable to relay it means that authentication has not been config…

Updated 1 year ago by admin

Notify Recipient/Sender Actions

The Notify Recipient and Notify Sender actions can be used in Message Rules to send a notification to the recipient, sender or a specific address. For example, you may want to notify a recipient that…

Updated 1 year ago by admin

Managing DNS in Office 365

If your email domain is managed by Office 365 then the ability to add or update the DNS records is disabled by default. In order to use the Email Security product, you will need to add or change the…

Updated 4 years ago by admin

Upgrading to LinkScan version 2

LinkScan version 2 has a number of improvemnets including: Improved detection engine including enhanced threat intelligence, the ability to follow redirects and scan embedded links in cloud hosted do…

Updated 4 years ago by admin

MX records and IP addresses for India customers

This article lists the MX records and IP addresses used by the Email Security service. These records are for customers located in India or for customers that require email processing to take place in…

Updated 1 year ago by admin

DLP Dictionaries

The Email Security product provides a number of built-in dictionaries to assist organisations with Data Loss Prevention (DLP). The dictionaries are used to detect potentially high risk data egressing…

Updated 2 years ago by admin

Executive Tracking with Subject

Our Email Security Threat Detection team has identified a trend in Executive Tracking style emails, that instead of using the Outlook display name, they use the subject line to impersonate users with…

Updated 1 month ago by admin

Activate the Quarantine Portal for Spam Digest users

The Quarantine Portal is an isolated environment that any recipient of a Spam Digest email can use to manage quarantined messages, without needing to log in to the End User Portal. Whilst the End Use…

Updated 1 year ago by admin

DMARC Abuse Report received even though it passes DMARC

This article explains why you may receive a DMARC abuse report even though the message passes DMARC. You receive the follow message to the email address configured for failure reporting: This is an e…

Updated 4 years ago by admin

Display Name Detection

This article explains how you can create a rule to detect unusual patterns in the display name; the area that shows who sent the email in most email clients. For example, some spammers will try and c…

Updated 4 years ago by admin

Unable to forward emails from Microsoft 365 accounts

If you are having issues with forwarding emails from Microsoft 365 accounts and you are receiving the following errors, this article discusses possible solutions depending on your configuration. ‎550…

Updated 1 week ago by admin

How to configure Authenticated Received Chain (ARC) Inbound

Authenticated Received Chain (ARC) is an authentication system designed to allow an intermediate mail server forwarding service to sign an email's original SPF and DKIM authentication results. To con…

Updated 7 months ago by admin

Why do I see No SMTP transport in Email activity?

This article explains the meaning of the "No SMTP Transport" tooltip when hoovering over a greyed out email address in Email Activity -> Message Details panel, as seen below. The Email Security produ…

Updated 1 month ago by admin

How to use Custom Rule Data (formerly Dictionaries)

This article explains how to use the Custom Rule Data feature of Email Security. Custom Rule Data entries are used in Message Rules to detect or insert text as part of conditions or actions. They can…

Updated 2 years ago by admin

HTML attachments

A low-level trend has been identified where an email containing very little content and an HTML file attachment is delivered to the recipient. These HTML files are malware and zero day. This article…

Updated 3 years ago by admin

How to block double extension filenames

To block double extension filenames like.exe.html you can create the following Message Rule. Navigate to Products , Email Security and then Message Rules. Click the + button to create a new rule. Add…

Updated 2 years ago by admin

Upgrade Outlook Add-in for reporting spam and phishing email

A new version of the Outlook add-in for Email Security has been released to use new infrastructure for spam reporting. The update/upgrade is not automatic, this article explains how to re-install the…

Updated 2 years ago by admin

Manage Mailboxes using the API

This article describes how to connect to the Platform API and manage Mailboxes as shown in the Email Security -> Mailboxes section. You will need: an admin user credential that has been assigned a Cu…

Updated 1 week ago by admin

How to use the Domain Name Detection rule

This default rule, which is disabled by default, is designed to detect external spoof emails that use your company domain within the Display Name (generated by the FROM header) to trick users into be…

Updated 3 weeks ago by admin

Email Security: Best Practice Guide

Email Security: Best Practice Guide. Follow this best practice guide to using Email Security. Download the digital PDF version.

Updated 2 years ago by admin

How to work with System Locked rules

Locked rules, identified with (Locked) in the rule name, are rules that cannot be disabled or removed from the Message or Connection Rules list. By default, there are three Locked Connection rules wh…

Updated 5 months ago by admin

How to detect simplified Chinese character sets

This document explains how to detect simplified Chinese character sets in email messages using the Email Security rules engine. Other character sets can be used for detection. For more details on the…

Updated 2 years ago by admin

How does DMARC work?

DMARC (Domain-based Message Authentication, Reporting and Conformance) relies on the established SPF and DKIM standards for email authentication. It also piggybacks on the well-established DNS (Domai…

Updated 4 years ago by admin