Backup MX
Temporarily queues eligible email received through the secondary MX while your primary mail server is unavailable and retries delivery. All packages include queuing and recovery support.
Backup MX and Email Protection, with optional SMTP Relay. Email Protection offers link, BEC, Office, ZIP and QR/OCR controls; Google Web Risk integration is optional.
Two base packages and optional SMTP Relay
SecuraWall MailFlow is our cloud-based email security and continuity platform. Keep your current mail server and mailboxes, choose Backup MX or Email Protection, and add SMTP Relay if needed. Verify your domain in the portal, configure the package-specific MX route and delivery destination, and test delivery.
SecuraWall MailFlow is an email security and continuity platform developed in Türkiye by Doz Teknoloji, drawing on our hands-on experience and technical expertise.
SMTP Gateway
Email Protection routes incoming email through the primary MX gateway to your destination mail server. The optional SMTP Relay add-on provides a separate, approved and authenticated route for outgoing mail.
AntiSpam
Email Protection applies spam scoring and sender checks according to enabled policies, with quarantine for eligible suspicious messages. Backup MX does not include content inspection or quarantine.
Antivirus
Email Protection inspects incoming messages and attachments according to enabled global and domain settings. Encrypted or unsupported content may not be fully inspected; an incomplete inspection is not a clean result.
Base packages and the SMTP Relay add-on
Choose Backup MX or Email Protection for your domain. SMTP Relay is an optional add-on for either base package. Prices are per domain, per calendar month, and include taxes. Both base packages include Free Setup Assistance and Unlimited Technical Support Tickets.
Backup MX
15 USD / domain / month
- Keep the existing primary MX records and add a less-preferred secondary MX.
- Eligible mail is temporarily queued during primary-server outages, with delivery retried on recovery.
- AntiSpam, Antivirus, content inspection, quarantine and SMTP Relay are not included in the base price.
Email Protection
45 USD / domain / month
- Publish only gate.securawall.com as MX and configure your destination mail server as a separate manual target.
- Enabled AntiSpam, Antivirus, sender checks and quarantine, with outage queueing.
- Office VBA, ZIP, QR/OCR, BEC and link protection, subject to enabled policies and analysis limits.
- SMTP Relay is an optional add-on, purchased separately from this base package.
SMTP Relay
25 USD / domain / month
- USD 25 per domain per month, billed in addition to the base package.
- Requires active Backup MX or Email Protection for the same customer-owned domain.
- Administrator approval, authorized server credentials, TLS and SPF/DKIM setup are required.
- Customer, domain and device recipient quotas apply per minute, hour and day, alongside enabled outgoing policies.
- Does not add incoming inspection to Backup MX or change the incoming route. Inbox placement and blocklist removal are not guaranteed.
Checked on SecuraWall.com on 19 October 2026. SMTP Relay is billed in addition to the base package; the base service and add-on have separate prices and manual renewal periods. Checkout confirms the payable currency and exact amount. There is no automatic card charge.
Setup and email flow
Verify your domain
Verify your account and domain ownership with a TXT record, then select your package and service period.
Configure the receiving route
Keep the primary MX records for Backup MX. Protection packages publish only the gateway as MX and use a verified manual destination for the real mail server.
Monitor queues and delivery
Use the portal to monitor destination health, queues, delivery history and service periods. Content protection and quarantine belong to Email Protection; SMTP sending and domain DKIM management require the Relay add-on.
Enable the SMTP Relay add-on
Keep a base service and the Relay add-on active for the same domain. Obtain administrator approval and assigned quotas, then configure authorized server credentials, TLS and SPF/DKIM records.
Email protection with visible decisions
Package 2 applies SPF, DKIM and DMARC sender checks, spam scoring, antivirus inspection and link/attachment policies according to enabled controls. Open the message associated with a Queue ID in the portal to review its recorded score, decision and contributing rules. A missing result does not mean the check passed.
- Spam tagging, rejection and quarantine behavior depend on the applied policies.
- Encrypted content and unsupported formats may not be fully inspected.
- Logs separates Mail traffic from Account activity. Setting changes show named fields and old/new values where recorded; older records may contain less detail.
- Delivery history distinguishes SMTP rejections, actual delivery attempts and queue observations; rejected message bodies and attachments are not retained.
Office VBA analysis and attachment policies
Email Protection inspects supported file contents for actual VBA macros and suspicious static indicators. Separate Accept, Quarantine or Reject actions can be configured for macro presence, suspicious heuristics and incomplete analysis.
- This is static analysis; files are not executed in a sandbox. Filename-extension policies and actual VBA analysis are independent checks.
- Analysis depends on enabled controls and supported format, time and size limits. Backup MX and authenticated SMTP sending are excluded.
Advanced Threat Signatures
Enabled Advanced Threat Signatures add an inspection layer to protection packages. Policies support observation, spam scoring, quarantine or rejection. Domain controls are managed under Domain / Settings.
- Message security details distinguish signature matches and selected rule policies from the final recorded decision.
- Releasing elevated-risk quarantined messages requires authorized IT review and fresh antivirus checks.
Click-time link protection and Google Web Risk
With Email Protection, opt-in link wrapping checks current domain authorization and policies when a link is clicked. Bounded static inspection reviews supported destinations and redirects. When enabled, Google Web Risk Lookup adds URL reputation checks for phishing, malware and unwanted software, with a fresh check on Continue.
- Inspection does not execute JavaScript. Incomplete inspection, an enabled API check that fails, or an exhausted local quota offers no Continue. No match is not a safety verdict.
- Full checked URLs, including their paths and query parameters, are sent to Google and may contain personal data or access tokens. This API check does not submit email bodies, attachments, sender or recipient details.
- Inspection follows up to four redirects. GET requests can consume one-time links, and rewriting can affect original DKIM/ARC signatures.
BEC and impersonation checks
Email Protection uses protected display names and approved sender addresses configured for your domain. Lookalike sender and Reply-To domains are assessed alongside English and Turkish payment-request, bank-change and urgency indicators.
- Separate policies cover identity, lookalike domains, payment risk and incomplete analysis.
- Protected names must be configured. False positives are possible; these checks do not verify a payment or identify every compromised sender.
ZIP and static attachment threat analysis
Optional attachment analysis applies bounded static rules to decoded attachment content and supported ZIP members in memory. It supplements Antivirus and Advanced Threat Signatures, with separate Accept, Quarantine or Reject actions for suspicious content and incomplete analysis.
- ZIP inspection is limited to two levels, 32 entries, 16 MiB total expansion and a 100:1 declared expansion ratio.
- Encrypted, corrupt, unsupported or over-limit content may remain partial. There is no sandbox execution or guarantee of complete malware detection.
QR and image text analysis
For eligible incoming mail with Email Protection, supported images are decoded for QR content and processed for OCR text. OCR also covers the first three PDF pages. Configured global and domain blocked targets can select the applicable policy action.
- The image scanner does not open URLs or use an automatic URL reputation feed. This is separate from click-time link protection.
- Uninspected pages, unsupported formats and resource limits mean partial coverage. No finding is not a clean-mail verdict.
Optional outbound text DLP for SMTP Relay
Disabled by default, outbound text DLP flags candidate Turkish identity numbers, TR IBANs and supported payment-card formats using format and checksum checks. Its scope is the subject, visible body text and supported text attachments of eligible authenticated SMTP Relay messages.
- Eligible messages with an external-domain recipient can use Observe or SMTP Reject; incomplete inspection can use Observe or a temporary failure. Matched values are excluded from DLP output.
- PDF, Office files, images, archives and attached messages are outside coverage. Native SMTP enforcement and mailbox delivery require separate deployment validation.
IT review and release requests
Mailbox users can request IT review of eligible held messages. IT administrators can view pending requests in the Release requests tab, which displays a request count. They can receive configured email notifications and deny requests or authorize release within their permissions.
- Users can track whether a request is Pending, Released or Denied. Requesting review does not automatically release a message.
- Authorized release applies fresh security checks. Submission to the delivery queue and destination SMTP acceptance are separate outcomes.
Protection against authentication attacks
Brute Force Protection tracks authentication failures for portal sign-in, authenticated SMTP and SSH separately. Administrators manage restrictions and review history; IT administrators have read-only access to recognized failures associated with their customer account.
- Incoming SMTP on port 25 is outside this authentication-protection scope.
Works with your existing email platform
Platform-specific setup guides cover Google Workspace, Microsoft 365, Microsoft Exchange, Carbonio, Zimbra and Linux SMTP environments. Verify the actual receiving server and delivery destination before changing DNS; plan firewall and connector restrictions for the domains involved.
- Backup MX keeps the primary MX records; protection packages publish only SecuraWall as MX.
- SMTP Relay submission uses STARTTLS on port 587 or TLS on port 465. TLS, authorized sender domains and SPF/DKIM configuration are required.
Portal and mailbox-user quarantine
Follow queues, the last delivery error, message age and delivery history in the portal. In Package 2, authorized users can view their quarantine and release, delete or request IT review of eligible messages according to policy and permissions. Office-policy and elevated-risk signature holds require IT review.
- Primary and alias addresses share the same personal quarantine allocation.
- Messages exceeding personal allocation remain held for IT review; they are not automatically delivered.
- Destination SMTP status-change notifications can follow available customer and administrator preferences. Notification submission does not prove mailbox delivery.
Data retention and service scope
Messages can remain in the delivery queue for up to 14 days; placing a message on hold or pausing the service does not reset its age. The active queue copy is removed after the destination server accepts the message over SMTP. Captured headers and text bodies are retained for 90 days without attachments; they are not a restorable original-message backup.
- Detailed delivery and security history is retained for 90 days; administrative and quarantine-action audit records for 180 days.
- Quarantine retention follows the customer setting and administrator limit, never exceeding 14 days. Recovery copies have separate retention rules.
Operational infrastructure and service limits
SecuraWall operates on cluster VPS infrastructure. Cloudflare protects proxied web traffic for the website and customer portal. OVHcloud supplies the hosting infrastructure’s network-level Anti-DDoS layer. SMTP traffic does not pass through the Cloudflare web proxy; it reaches the hosted gateway. Daily infrastructure backups and snapshots for the last 7 days support operational recovery; they do not establish a mailbox backup or application-level automatic failover guarantee.
- Temporary delivery queue: up to 14 days; retries approximately every 3 minutes.
- Complete encoded message size: up to 50 MiB; a domain may have a lower limit.
- Storage is finite and shared; acceptance depends on available resources and active service.
- Destination SMTP acceptance removes a message from the queue; it does not guarantee inbox placement or reading.
Review the right package for your domain
Review the base packages, optional SMTP Relay, DNS preparation and current service conditions at SecuraWall.com. Use the domain checker to inspect your existing records.
Visit SecuraWall.com