Analysis Configuration
INKY's threat detection and email analysis features. Covers spoofing detection, spam/graymail controls, sender verification, and detection settings.
- Burst Detection
- VIP Spoofing ProtectionVIP Spoofing Protection escalates threats to Danger level when attackers impersonate your highest-risk targets—executives, board members, and frequently-spoofed employees. This is more aggressive than standard Internal Name Spoofing Protection.
- Internal Name Spoofing ProtectionINKY detects when attackers impersonate your employees by comparing email display names against your organization's directory (Microsoft 365 or Google Workspace). No manual lists required.
- Link RewritingINKY rewrites all links in emails to route clicks through real-time analysis. This catches threats that become active after delivery and helps users evaluate risks before reaching dangerous sites.
- Spam SettingsINKY combines its own spam detection with results from Microsoft EOP or Google Workspace. Configure how aggressively INKY classifies spam and whether to use upstream provider results.
- Graymail ProtectionINKY identifies legitimate bulk mail (newsletters, promotions, notifications) and moves it aside so users can focus on important messages. Unlike spam or phishing, graymail is mail users may have subscribed to but doesn't need immediate attention.
- Known External SendersMark trusted business partners and vendors as "Known External" so users see blue banners instead of gray on their authenticated emails.
- Trusted Third-Party SendersPrevent false spoofing alerts when third-party services send mail on behalf of your domain without proper authentication.
- Upstream ProviderTell INKY which security filter sits upstream so it can track the correct mail hop. INKY scans after the MX record, so it needs to know where mail came from to check that specific hop accurately.
- Additional Analysis SettingsConfigure specialized detection rules for QR codes, new domains, geographic blocking, and suspicious TLDs.
- Learning ModeLearning Mode adjusts INKY during initial deployment to encourage user feedback and reduce false positives while the system learns your email patterns.
- Internal Mail DetectionConfigure how INKY handles mail from your domains arriving through external systems—critical for accurate spoofing detection.
- Block Countries csv listsFind prebuild comma separated value lists for blocking countries from your tenant.