You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/email-security/setup/index.mdx
+83-33Lines changed: 83 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,57 +5,107 @@ sidebar:
5
5
order: 11
6
6
---
7
7
8
-
import { DirectoryListing } from"~/components"
8
+
import { Markdown } from"~/components";
9
9
10
-
You can set up Email Security via:
11
-
12
-
<DirectoryListing />
10
+
Before you start the onboarding process, you will have to choose a deployment path. Email Security provides two deployment modes: [post-delivery](/cloudflare-one/email-security/setup/) (for API and BCC/Journaling), and [pre-delivery](/cloudflare-one/email-security/setup/#pre-delivery-deployment) (for MX/Inline).
13
11
14
12
## Post-delivery deployment
15
13
16
-
With post-delivery deployment, Email Security scans emails **after** they reach users' inbox.
14
+
### How it works
15
+
16
+
When you choose post-delivery deployment, Cloudflare scans emails **after** they reach a users' inbox.
17
17
18
-
Post-delivery deployment includes [Microsoft Graph API](/cloudflare-one/email-security/setup/post-delivery-deployment/api/) and [BCC](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/gmail-bcc-setup/)/[Journaling](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/).
18
+
If you are a Microsoft 365 user, this is done via Microsoft's Graph API or journaling.
19
19
20
-
With Microsoft Graph API, you authorize Email Security to scan domains via your email provider credentials. With BCC/Journaling, you send messages to Email Security via BCC or Journaling configurations within your email provider.
20
+
If you are a Google Workspace or Microsoft Exchange user, this is done via BCC.
21
21
22
-
When you set up Microsoft Graph API, you get access to the following features:
22
+
### Why you should consider post-delivery deployment
- Auto pull EMLs for [reclassification](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) whose disposition is "None".
28
-
- Manually move messages to different inboxes.
24
+
Post-delivery deployment is time-efficient, because it does not involve MX changes. Post-delivery deployment does not disrupt mail flow. Post-delivery deployment allows you to enable [auto-move events](/cloudflare-one/email-security/auto-moves/) and synchronize your [directory](/cloudflare-one/email-security/directories/) when you use Microsoft Graph API or Google Workspace.
29
25
30
-
If you set up Email Security via BCC/Journaling and you want to access the features listed above, you will need to [associate an integration](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-auto-moves/).
26
+
:::note
27
+
When you choose post-delivery deployment:
28
+
The threat is removed **after** the message has been delivered to the inbox.
29
+
It requires API scopes, or journaling rule configuration.
30
+
Auto-move is only available in BCC/Journaling if you associate an integration.
31
+
:::
31
32
32
33
## Pre-delivery deployment
33
34
34
-
With pre-delivery deployment, Email Security scans emails **before** they reach users' inbox.
35
+
### How it works
36
+
37
+
When you choose pre-delivery deployment, Cloudflare scans emails **before** they reach a users' inbox. The MX record points to Cloudflare.
38
+
39
+
### Why you should consider pre-delivery deployment
40
+
41
+
Pre-delivery deployment provides you with the highest level of protection. It enforces [bannering](/cloudflare-one/email-security/detection-settings/configure-text-add-ons/) or link rewrite at delivery.
42
+
43
+
Pre-delivery blocks threats in transit, and it adds banners or texts before the user views the email.
44
+
45
+
:::note
46
+
When you choose pre-delivery deployment:
47
+
You must edit MX records or create a connector.
48
+
You can enable auto-move events only once you associate an integration.
49
+
Cloudflare [egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/) are allowed on downstream servers.
50
+
:::
51
+
52
+
## Dispositions
53
+
54
+
Email traffic that flows through Email Security is given a final disposition, which represents Email Security's evaluation of that specific message. Refer to [Dispositions and attributes](/cloudflare-one/email-security/reference/dispositions-and-attributes/) to learn more.
55
+
56
+
Dispositions allow you to configure policies and tune reporting. For example, you can configure a policy to move suspicious emails to your junk folder.
57
+
58
+
## Impersonation registry
59
+
60
+
Most [Business email compromise(BEC)](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/) targets executives or finance roles. You must add addresses of roles who are likely to be impersonated. Refer to [Impersonation registry](/cloudflare-one/email-security/detection-settings/impersonation-registry/) to learn how to add a user to the impersonation registry.
61
+
62
+
Roles you may want to include in the impersonation registry are:
63
+
64
+
C-suites
65
+
Finance roles
66
+
HR
67
+
IT help-desk.
68
+
69
+
You should review your impersonation registry on a quarterly basis as roles change.
70
+
71
+
## Reclassifications
72
+
73
+
A reclassification is a change to an email's disposition **after** initial scanning. It is Cloudflare's built-in feedback loop for correcting false positives/negatives **and** training the detection models to get smarter over time.
74
+
75
+
### Who can reclassify messages
76
+
77
+
[Security teams](/cloudflare-one/email-security/email-monitoring/search-email/#team-submissions) and [end users](/cloudflare-one/email-security/email-monitoring/search-email/#user-submissions) can submit a reclassification. Refer to [Reclassify messages](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) to learn how to reclassify a message.
35
78
36
-
MX/Inline allows you to send messages to Email Security to scan before they reach your users' inbox. You may need to update your MX records.
79
+
### Why you should reclassify messages
37
80
38
-
With MX/Inline, you will not be able to auto-move emails.
81
+
Reclassifications are critical because:
39
82
40
-
However, you will need to associate an integration to access the following features:
83
+
**They help improve model accuracy**: Every validated reclassification teaches Cloudflare's machine learning to recognise new lures, language, infrastructure and benign patterns.
84
+
**They reduce alert fatigue**: Correcting Suspicious or Spam emails that users actually want tailors detections to your organization, cutting noise in the dashboard.
85
+
**They close the remediation loop**: When a disposition is upgraded to Malicious, Cloudflare auto-moves those emails out of every inbox (Graph API or Google Workspace API integrations).
86
+
**They can help you log activity taken on any reclassification**: Each reclassification displays a submission ID, details about original, requested and final dispositions, and more. Refer to [Reclassify messages](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) to learn more about reclassifications.
- Auto pull EMLs for reclassification for disposition "None".
45
-
- Manually move messages.
88
+
To make the most of reclassifications:
46
89
47
-
### Associate an integration
90
+
1. Review reclassifications on a weekly basis.
91
+
2. Ensure you have an integration associated with any MX/Inline deployment. When you associate an integration, you will not need to upload the EMLs every time, and we can use APIs to receive a copy of your email messages.
92
+
3. Investigate any increase in [user submissions](/cloudflare-one/email-security/email-monitoring/search-email/#user-submissions) (users may have found a phish that bypassed filters) and confirm that analyst-final dispositions align with your policies.
48
93
49
-
To associate an integration:
94
+
A correct use of reclassifications ensures that Email Security delivers a stronger protection with less manual tuning.
50
95
51
-
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/) > **Email Security**.
52
-
2. Go to **Settings** and locate your domain.
53
-
3. Select the three dots > **Associate an integration**.
54
-
4. Select the integration you want to associate, then select **Associate**.
96
+
## Configuration checklist
55
97
56
-
To enable post-delivery response and phish submission response:
| Associate an integration with an MX/Inline domain || Required |
102
+
| Add/verify domains | Required | Required |
103
+
|[Update MX records/connector](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/), then allow Cloudflare [egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/) on downstream mail server || Required |
| Configure [text add-ons](/cloudflare-one/email-security/detection-settings/configure-text-add-ons/) and [link actions](/cloudflare-one/email-security/detection-settings/configure-link-actions/)|| Required |
108
+
| Send a test email and verify it appears in **Monitoring** > [**Email activity**](/cloudflare-one/email-security/email-monitoring/#email-activity) with expected disposition | Required | Required |
57
109
58
-
1. Go to **Settings** > **Moves**.
59
-
2. Go to **Auto-moves**, select **View** > **Configure**.
60
-
3. Select **Post-delivery response (Recommended)** and **Phish submission response (Recommended)**.
61
-
4. Select **Save**.
110
+
[^1]: Alternatively, you can create a service account and add BCC rules.
111
+
[^2]: Still used for directory/auto‑move insight if desired as well as authorizing free API CASB
0 commit comments