One report pulls a phishing campaign from every inbox.
Tracemark scores inbound mail, quarantines what looks like phishing, and removes a whole campaign from every mailbox in one step. Outside the inbox it grades your mail domains and watches lookalikes, exposed hosts, threat indicators and leaked accounts.
From the first suspicious mail to the attacker's domains.
Email security and threat intelligence share one set of signals. A lure your staff report can become an IOC indicator, a reported campaign raises the score of the same mail in other inboxes, and every finding lands in one console.
Inbound mail scan
Each new message is scored on sender authentication, lookalike names, links, attachments, known indicators and campaigns your staff already reported.
Quarantine
Mail above your threshold moves to a hidden folder in the same mailbox. People ask for it back from Outlook; an analyst releases or keeps it.
Remove from every mailbox
Every copy of a campaign moves to Deleted Items, in Exchange Online and on-premises Exchange. Every move can be put back.
Business email compromise
Lures with no link and no attachment: a borrowed executive name, a supplier asking for new bank details, gift cards, urgency.
Links, attachments, QR codes
Links are checked against public threat feeds and followed through shorteners. Attachments are read for macros, HTML smuggling, disk images and scripts in PDFs.
Account takeover
Inbox rules that forward or hide mail, sign-ins from a new country or an impossible journey, and phishing sent from your own mailboxes.
Domain posture and DMARC
An A to F grade for every mail domain, DMARC aggregate reports grouped by sending service, and a guided path to p=reject.
Report button in Outlook
Staff report suspicious mail from classic Outlook or Outlook on the web. Reports of one lure are grouped into a campaign.
Attack surface
Hosts under your domains that the internet can see, with risk taken from the web scanner's open findings.
Outbound holds
Mail the email DLP gateway stopped waits for review, so a detector's mistake costs minutes instead of a lost business email.
Phishing waits outside the Inbox.
Start in monitor mode and see what reaches your people. Switch to quarantine and every new message at or above your score moves out of the Inbox into a hidden folder of the same mailbox. Nothing is deleted.
- Your threshold. 80 is likely phishing; a lower score holds more phishing and more legitimate mail.
- Release on request. People ask for a message back from Outlook, and an analyst releases it or keeps it.
- Whole campaigns. Release or keep every copy with the same sender domain and subject at once.
- Allow lists. Senders that must never be quarantined are still scored and listed, never moved.
- Real time. With Graph change notifications an Inbox is scanned within a minute; polling every five minutes keeps running underneath.
The first report starts the response for everyone.
One person presses the button. Everyone who received the same lure is cleaned up.
Report
A user reports from Outlook. Their copy moves to Deleted Items.
Signals
Authentication, lookalikes, links and attachments are checked and shown as hints.
Verdict
An analyst judges the campaign. Later reports of the same lure take that verdict.
Removal
Every copy moves to Deleted Items, with progress per mailbox and an undo.
Feedback
Each reporter can get a short mail with the verdict.
A mailbox that is no longer its owner's.
An attacker with a password forwards mail quietly, signs in from far away and phishes colleagues from a trusted address.
Inbox rules
Swept daily across every mailbox for rules that forward outside, hide replies, or mark mail read and file it away.
Sign-ins
Entra ID sign-ins read every 15 minutes. A new country, or two located sign-ins over 500 km apart at more than 900 km/h.
Risky users
Users flagged by Entra ID Protection, read together with the sign-ins where your licence includes it.
Phishing from inside
Likely phishing sent from one of your own authenticated addresses, caught by the inbound scan.
The next step
Each signal says what to do: remove the rule, reset the password, revoke the sessions, require MFA.
No silent sources
A source without its permission or licence says which one is missing, so it never passes for a clean result.
Know which of your domains can be spoofed.
A domain without an enforced DMARC policy lets anyone send mail in its name. Tracemark reads public DNS for each mail domain every day, grades it A to F, and raises an alert when a check gets worse.
- Six checks per domain. MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT, with the exact record to publish when one is missing.
- DMARC reports, read for you. Aggregate reports are collected from a report mailbox every hour, or uploaded as files.
- Senders by service. Each sending service is named, with the fix for one that fails alignment.
- A safe path to reject. The next enforcement step is offered only once enough identified mail passes.
- Hosted MTA-STS. Tracemark serves the policy file and reads SMTP TLS reports; you publish three DNS records.
Find the domains registered to pass for yours.
Attackers register a name one letter away from yours and send invoices from it. Tracemark generates the likely variants of every domain you watch, checks DNS for them daily, and searches Certificate Transparency for new certificates that name your brand.
- Many kinds of variant. Look-alike characters, missing, doubled and swapped letters, hyphens, brand plus word, other endings.
- Risk from what a name has. A lookalike with a mail server can phish today.
- Quiet first run. The first check records what already exists; only names found after that raise alerts.
- Lookalikes in the inbox too. The inbound scan flags mail from a sender domain that imitates yours or a supplier's.
What is included.
Email & Threat Intel is a set of modules that share signals and one console. Turn on the ones you need.
Every Exchange Online mailbox is followed through Microsoft Graph and each new message is scored. When a campaign is confirmed, it leaves every mailbox in one step.
- Scan every five minutes, or within a minute with change notifications
- Sender authentication, reply-to tricks and display-name spoofing
- VIP names, first-time senders and payment language
- Links, attachments and QR codes in images
- Defender for Office 365 alerts read in, with removal from an alert
- Removal moves mail to Deleted Items and can be undone
Two queues for two directions. Inbound phishing is held in the recipient's own mailbox. Outbound mail held by the email DLP gateway waits for review.
- People ask for a quarantined message back from Outlook
- Release a message or a whole campaign to the Inbox
- Allow lists for senders that must never be moved
- Outbound holds show why: categories, label, outside recipients
- The outbound queue never shows the message body to reviewers
- Owners, review targets and notes on each held message
What public DNS says about your mail domains, who sends mail as them, and what stands between you and p=reject.
- MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT, graded A to F
- An alert when a domain's posture gets worse
- Parked domains checked too
- Aggregate reports read hourly from a mailbox, or uploaded
- Senders grouped by service, with the fix for each
- Guided enforcement, hosted MTA-STS and SMTP TLS reports
Signals that a Microsoft 365 mailbox is used by someone else, by mailbox and worst first, each with the next step.
- Rules that forward outside or hide mail
- Rules that mark mail read and file it away
- Sign-ins from a new country and impossible journeys
- Risky users from Entra ID Protection
- Likely phishing sent from your own mailboxes
- Confirm or dismiss, with the decision recorded
Who is attacked most, what kind of attacks arrive, who reports them, and how fast mail is cleaned up.
- Most-attacked people, with VIPs marked
- Threats by kind: credential phishing, BEC, malware
- Weekly trend and top attacking domains
- Time from delivery to quarantine, removal and review
- Who reports phishing, and how often they are right
- A baseline of who you correspond with
A report button in classic Outlook and in Outlook on the web. Reports arrive in one queue, with signals as hints and the verdict left to the analyst.
- The reporter's copy moves to Deleted Items
- Reports of one lure grouped into a campaign
- Verdicts: phishing, spam, not phishing, simulation
- Sender domains, links and hashes turned into indicators
- Optional verdict mail back to each reporter
- Reports from Microsoft's own button fed into the same queue
Lookalike domains of the domains you watch, found in DNS and in Certificate Transparency, ranked by what each name has set up.
- Look-alike characters, missing, doubled and swapped letters
- Hyphens, brand plus word, other endings
- Brand keywords searched in new certificates
- Checked daily, with a quiet first run
Hosts under your watched domains that the internet can see, discovered passively. Discovery sends no request to any host.
- Hosts found from Certificate Transparency logs
- New hosts marked as they appear
- Risk taken from the web scanner's open findings
- Unscanned hosts shown as not assessed
Indicators from outside, hunted for in what ran on your devices, what moved and where it went. Each feed alerts, adds an audit rule, or blocks a matching file when it runs.
- File hashes, domains, IP addresses and URLs
- Text or CSV lists by URL, TAXII 2.1, or a paste
- Feeds fetched every six hours
- Devices hunted every quarter hour
- Indicators from reported phishing added in one step
- Matches for the last 30 days in one view
Company mailboxes found in third-party breaches, from Have I Been Pwned's domain search with your own key, plus lists you import.
- Checked daily, with a quiet first run
- Urgent when the breach held passwords set before it
- Judged against the directory account today
- No passwords are sent or stored
What works where.
Microsoft 365, on-premises Exchange and hybrid organisations are supported. In a hybrid setup each mailbox is tried in Exchange Online first, then on-premises.
| Capability | Microsoft 365 | On-premises Exchange |
|---|---|---|
| Inbound scan and quarantine | Every mailbox, through Microsoft Graph | Not scanned |
| Remove from every mailbox | Through Microsoft Graph | Through the Tracemark Deployer, with its own Windows identity and no stored Exchange password |
| Report button | Classic Outlook and Outlook on the web | Ask us about your setup |
| Account takeover | Inbox rules, Entra ID sign-ins and risky users | Not available |
| DMARC reports | Read hourly from a report mailbox | Uploaded as report files |
| Domain posture, brand, attack surface | Public DNS and certificate logs, independent of your mail platform | |
| Outbound DLP holds | The Tracemark email gateway, placed in the outbound mail flow | |
Questions.
Do we have to change our MX records?
No. Inbound scanning reads mailboxes through Microsoft Graph after delivery, so mail keeps flowing the way it does today.
What happens to a message we remove?
It moves to Deleted Items in each mailbox. Nothing is hard-deleted, and a removal can be put back.
We already have Defender for Office 365. Does this get in the way?
Tracemark detects which mailboxes Defender covers and can leave them to it, or scan them as well. Defender's email alerts are read into the console, and a message an alert names can be removed from every mailbox from there.
Does it work with on-premises Exchange?
Removal does. The Tracemark Deployer calls Exchange Web Services with its own Windows identity and the impersonation role you grant it, so Tracemark stores no Exchange password. The inbound scan covers Exchange Online mailboxes only.
Can reviewers read colleagues' mail in the outbound queue?
No. The queue never shows the message body. Reviewers see why a message was held: the detected categories, the label and the outside recipients. The body is kept only so the mail can be delivered if it was held by mistake.
What does the leaked accounts check need from us?
A Have I Been Pwned subscription key and your domains verified there with a DNS record. Without one, you can import a list. No passwords are sent or stored.
Works well with
See it on your own tenant.
We connect a test mailbox, grade your domains and show the lookalikes already registered against your brand.