Architecture and operating model
An anti spam gateway evaluates incoming email before forwarding it to your mail server. Cloud filtering brings policy, quarantine and delivery records into a central service while allowing you to retain existing mailboxes.
Separate the roles of connection reputation, sender authentication, content, attachments and URL checks. SPF, DKIM and DMARC contribute to domain authentication; a successful result does not prove that a message is safe. Invoice fraud sent from an authenticated account can still require investigation. NIST's trustworthy email guidance provides a technical foundation for authentication and transport security.
A cloud service can reduce the capacity planning and maintenance required for local filtering servers. Evaluate data processing location, administrator access, outage behavior and an exit plan alongside that benefit. Doz Teknoloji treats selection as an operational decision shaped by the existing mail platform and business workflow; one product may not meet every requirement.
Review high-risk, suspicious and accepted messages separately at the start. Give each policy band an action, owner and appeal path. Instead of trusting an entire sender domain, define authentication conditions, recipient scope and expiry for exceptions. Finance teams should retain independent confirmation of payment changes and a reporting process alongside filtering.
- 1Incoming SMTP connection
- 2Authentication and risk checks
- 3Domain policy decision
- 4Delivery or review
Design parameters
- Policy scope
- Record domain, recipient group, rule priority and default action. Make the checks affected by an exception visible.
- Quarantine ownership
- Define reviewers, release rights and out-of-hours handling. Distinguish malicious content from suspicious business correspondence.
- False-positive measurement
- Measure confirmed legitimate blocked messages in a controlled sample; the total block rate alone is not a success metric.
- Microsoft 365 integration
- Assess how the intermediate gateway affects source IP interpretation. Validate Enhanced Filtering for Connectors for the actual topology.
- Operations and exit
- Review policy export, record retention, support scope and migration steps through both the contract and a pilot.
Worked example
In an illustrative weekly pilot, 420 of 12,000 messages enter quarantine. If reviewers confirm that 21 of those are legitimate, the false-positive share within the quarantined sample is five percent. Do not present it as the rate across all email: 21/12,000 uses a different denominator. State the sample, review method and observation period in the report.
Try a policy change with 15 volunteer users first. Compare equivalent weekdays and note campaigns and new suppliers. When a purchase order is blocked, examine the rule identifier and make a temporary change limited to that workflow. Avoid changing domain-wide thresholds without a review schedule and a named rollback owner.
Troubleshooting
| Observation | Likely cause / distinction | Verification |
|---|---|---|
| Legitimate supplier email is blocked | Authentication trouble or a broad rule may be responsible. | Compare original headers, rule identifiers and an accepted message from the same sender. |
| Less spam but more business complaints | The block rate may hide operational harm. | Report false positives, review time and affected business teams together. |
| A delivered message has no gateway record | An alternative inbound route may bypass the control. | Review all receiving paths and connector scopes on the destination platform. |
Acceptance checks
- Establish a traffic and false-positive baseline.
- Validate the action for every policy band in a pilot group.
- Give exceptions an owner, authentication condition and expiry.
- Exercise quarantine review and appeals with a user.
- Correlate gateway, destination and user evidence for one message.
- Document maintenance, outage handling and service exit.
Related concepts
Trust boundary and failure domain
A trust boundary separates components governed by different access decisions; a failure domain groups resources that one event can affect together. Two VLANs do not create a strong trust boundary when routing between them is unrestricted. Backups in different folders still share a failure domain if one administrator can delete both. Assess physical location, identity provider, management account, network path and power source separately. Test which access paths and recovery options remain available when a component is lost.
Authentication and sessions
Authentication proves who a user or workload is; authorization determines what that identity may do. Successful sign-in does not grant access to every resource. User sessions, service identities, API tokens and device certificates have different lifecycles. Design session duration, token renewal, employee departure, lost-device handling and emergency access alongside initial sign-in. Measure which existing sessions remain usable and which new access attempts are denied when the identity provider becomes unavailable.
Least privilege and separation of duties
Least privilege limits the permissions needed for a task to specific resources and time periods. Giving everyone the same administrator role complicates access reviews and investigations. Separate daily-use identities from privileged accounts, and restrict interactive use and unnecessary network access for service identities. An access matrix should show which operation an identity may perform on each resource. Test whether an application keeps working after a permission is removed: unnecessary privileges sometimes become visible only during controlled reduction.
Telemetry and time correlation
Telemetry combines logs, metrics and events that explain system behavior. A log describes an event, a metric shows behavior over time, and a distributed trace follows a request across components. Clock differences can make one event appear to occur at several times. Use synchronized clocks, reliable source identifiers and consistent time-zone handling. Alarm design should consider duration and user impact alongside thresholds. Monitor gaps in collection separately: absence of logs must not be interpreted as absence of incidents.
Policy lifecycle
A policy needs management as its scope changes, not just when it is enabled. Separate drafting, observation, pilot deployment, enforcement and periodic review. Every exception needs an owner, reason, scope and expiry date. A successful pilot can still cause production false positives if test data does not represent real user behavior. Identify affected users and applications before deploying with measurable acceptance criteria. A rollback path should identify who may reverse the change and under which conditions, rather than merely locating an interface button.
TLS and certificate validation
TLS protects confidentiality and integrity in transit; certificate validation helps verify the peer’s identity. Evaluate names, chains, validity periods and trusted roots together. Encryption does not prove correct application authorization. If a reverse proxy or inspection device is used, show where TLS terminates. Disabling validation is not a permanent troubleshooting solution: investigate hostname mismatch, missing intermediate certificates and incorrect device clocks separately.
Primary documentation
Explore cloud email security and continuity
Review cloud email security and Backup MX options with SecuraWall MailFlow, operated by Doz Teknoloji. Assess setup requirements against your existing mail infrastructure.
Prepared by the Doz Teknoloji technical team using the primary references below. Calculations and lab scenarios state their assumptions; validate the applicable product version before rollout.