Skip to content

[Email Security] Reorder dispositions #22273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 8, 2025
Merged

[Email Security] Reorder dispositions #22273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion ...nt/docs/cloudflare-one/email-security/reference/dispositions-and-attributes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,12 @@ Detection is the process Email Security does to identify what threat an email ma

Any traffic that flows through Email Security is given a final disposition, which represents our evaluation of that specific message. Each message will receive only one disposition header, so your organization can take clear and specific actions on different message types.

You can use disposition values when [setting up auto-moves](/cloudflare-one/email-security/auto-moves/).
You can use disposition values when [setting up auto-moves](/cloudflare-one/email-security/auto-moves/).

### Available values

The following disposition values follow an order of maliciousness:

<Render file="email-security/dispositions-and-attributes" />

## Attributes
Expand Down
4 changes: 2 additions & 2 deletions src/content/partials/cloudflare-one/email-security/dispositions-and-attributes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
- **Malicious**: Traffic associated with active threat campaigns. Malicious messages invoked multiple phishing verdict triggers and met thresholds for bad behavior.
- **Recommendation**: Block.
- **Spoof**: Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or has mismatching `Envelope From` and `Header From` values.
- **Recommendation**: Block after investigating (can be triggered by third-party mail services).
- **Suspicious**: Traffic associated with phishing campaigns (and is under further analysis by our automated systems).
- **Recommendation**: Research these messages internally to evaluate legitimacy.
- **Spam**: Traffic associated with non-malicious, commercial campaigns.
- **Recommendation**: Route to existing Spam quarantine folder.
- **Spoof**: Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or has mismatching `Envelope From` and `Header From` values.
- **Recommendation**: Block after investigating (can be triggered by third-party mail services).
- **Bulk**: Traffic often associated with newsletters or marketing campaigns. Refer to [Graymail](https://en.wikipedia.org/wiki/Graymail_%28email%29) for more details.
- **Recommendation**: Monitor or tag.