Sophos Email

Stop spam and unwanted emails

Email protection for Microsoft 365, Google Workspace and other email environments

Sophos Email checks messages for spam, phishing, malicious attachments and suspicious links. The cloud-based solution adds a centrally managed protection layer to your email environment. IT can define policies for users and groups and investigate why a message was delivered or held.

For Microsoft 365, gateway or mailflow integrations are possible depending on setup; other supported environments use gateway mode. The appropriate configuration depends on your email provider and required features. Sophos Email also includes Phish Threat for phishing simulations and user training. It is the base licence; Sophos Email Plus adds capabilities including longer histories and DMARC Manager.

Emergency inbox

If the email client is unavailable or the mail server cannot receive messages, incoming emails remain accessible through the emergency inbox. Once IT enables it, users can see messages from the last 30 days and download attachments.

The emergency inbox is not a complete replacement for the email client: replies cannot be composed there. Important incoming information can therefore be read even when access to the normal mailbox is restricted.

Impersonation protection

A familiar-looking sender address is not proof of authenticity. Sophos Email evaluates SPF, DKIM and DMARC, alongside signs of impersonated names or domains. This helps identify messages impersonating a known person or organisation.

IT defines which senders are protected and how suspicious messages are handled. These checks complement each other; basic DMARC checking is distinct from the separately licensed DMARC Manager.

Content filtering

Sophos Email combines spam and malware checks with policies for message content and attachments. Suspicious links can be checked again when clicked to detect destination pages that change later.

IT determines how detected messages are handled under each policy, for example quarantine or blocking. Content and data protection rules also help control the transmission of sensitive information. Regularly reviewing these settings keeps protection aligned with your business’s communication processes.

Email quarantine

Quarantine holds messages classified as spam, malicious or suspicious by the configured checks. Under the base licence, quarantined messages are retained for 30 days.

Administrators can check the reason and release legitimate messages. Quarantine summaries and the Self Service Portal help users review held emails; IT defines which actions users may perform themselves. Releasing a message should therefore not automatically create an exception for an unsafe sender.