Email Security Administration Guide

Important Information

Related Documents

Introduction to Email Security

Getting Started

Creating an Account in the Check Point Portal

This topic provides an overview of the Check Point Portal and points to additional documentation for creating an account.

Accessing the Email Security Administrator Portal

Accessing the Email Security Administrator Portal

Finding the Portal Identifier of your Email Security Tenant

Licensing the Email Security Product

Managing Email Security Licenses

License Assignment with a Commercial Contract

Limiting License Consumption and Security Inspection to a Specific Group

Manual Changes to License Assignment

Trial Period for Email Security in the Check Point Portal

Managing Users, Roles and their Permissions

Activating SaaS Applications

Minimum License Requirements to Activate SaaS Applications

Activating Office 365 Mail

Office 365 Mail - Required Roles and Permissions

Required Application Roles

Reducing the Assigned Microsoft Application Role

Automatic Mode Onboarding - Microsoft 365 Footprint

Mail Flow Rules (Transport Rules)

Check Point - Protect Outgoing Rule

Check Point - Protect Internal Rule

Check Point - Protect Rule

Check Point - Whitelist Rule

Check Point - Junk Filter Low Rule

Check Point - Junk Filter Rule

Check Point- Encryption

Check Point Inbound Connector

Check Point DLP Inbound Connector

Check Point Internal Inbound Connector

Check Point Outbound Connector

Check Point DLP Outbound Connector

Check Point Journaling Outbound Connector

Connection Filters

Distribution Lists

Spoofed Senders Allow List

Trusted ARC Sealers

Reported Phishing Emails

Delegated Token

PowerShell Scripts

Connecting Multiple Portals to the Same Microsoft 365 Account

Connecting Multiple Email Security Tenants

Connecting Multiple Tenants to the same Microsoft 365 Account - Microsoft 365 Footprint

Deactivating Office 365 Mail

Activating Microsoft Teams

Activating Office 365 OneDrive

Activating Office 365 SharePoint

Activating Google Workspace (Gmail and Google Drive)

Activating Gmail

Activating Google Drive

Google Workspace Footprint

Changing the Google Application Role

Performing Actions on Behalf of Users

Inbound Gateway

SMTP Relay Service

Content Compliance Rules

Google Drive Permissions Changes

Activating Slack

Onboarding Next Steps

Configuring Security Engines

Data Loss Prevention

Creating a Custom Regular Expression DLP Data Type

Validating Regular Expression

Dictionary DLP Data Types

Compound DLP Data Types

Creating a Custom Compound DLP Data Type

Other Custom Data Types

Configuring Advanced Data Type Parameters

Configuring DLP Engine Settings

Storage of Detected Strings

Minimal Likelihood

Click-Time Protection

Configuring Click-Time Protection Engine

Rewritten Check Point URL

Hiding Original URL Full Path

Obfuscation and Validity of Rewritten URLs

Replacing Links Inside Attachments - Supported File Types

Click-Time Protection Against Malicious Files Behind Links

Click-Time Protection - End-User Experience

Email Protection

Office 365 Mail

Office 365 Mail Security Settings

Configuration Templates for Office 365 Mail

Protecting Microsoft 365 Groups

Adding a New Domain to Microsoft 365

Overriding Microsoft's False Positive Detections

Emails Falsely Quarantined by Microsoft

Emails Falsely Sent to Junk by Microsoft

Viewing Office 365 Mail Security Events

Viewing Security Events for Microsoft Quarantined Emails

Visibility into Microsoft Defender Verdict and Enforcement

Activating and Deactivating Gmail

Gmail Security Settings

Configuration Template Google Gmail

Viewing Gmail Security Events

Configuring Email Policy

Threat Detection Policy

Threat Detection Policy for Incoming Emails

Excluding Members of Microsoft 365 Groups from a Prevent (Inline) Policy

Manually Controlling IP Exceptions in Microsoft 365 Mail Flow Rules

When are my changes overridden

Threat Detection Policy for Internal Emails

Inline Protection for Internal Emails (Office 365 Mail) - Manual Configuration Required

Fallback Workflows for Internal Traffic

Threat Detection Policy for Outgoing Emails

Supported Workflow Actions

Prerequisites to Avoid Failing SPF Checks

Threat Detection Policy Workflows

Malware Protection

Phishing Protection

Customizing the Subject Prefix for Phishing Warning Emails

Configure the Subject Prefix

Password Protected Attachments Protection

Requesting Passwords from End Users - End-User Experience

Quarantine. User is alerted and allowed to restore the email workflow

Password Protected Attachments - Administrator Experience

Attachment Cleaning (Threat Extraction)

Configuring Attachment Cleaning (Threat Extraction) for Office 365 Mail or Gmail

Attachment Cleaning (Threat Extraction) Clean Attachments and Workflows

Threat Extraction Exceptions

Adding a Threat Extraction Allow-List Exception

Deleting a Threat Extraction Allow-List Exceptions

Attachment Cleaning (Threat Extraction) – File Types and Attachments

Viewing Emails with Cleaned Attachments

Sending the Unmodified Emails to End Users

Attachment Cleaning (Threat Extraction) - End-User Experience

Smart Banners for Non-Clean Emails

Supported Workflows for Smart Banners

Spam Protection

Trusted Senders

Automatic Trusted Sender and Block-List Management

Trusting Senders - End User Experience

Graymail Workflows

Graymail Dedicated Folder

Delivering Graymail Emails to the Dedicated Folder for Google Gmail

Deliver to Dedicated Folder - End User Footprint

Quarantined Emails - End-User Experience

Customizing Attachment Cleaning ( Threat Extraction ) Attachment Name

Customizing Attachment Cleaning (Threat Extraction) Message

Data Loss Prevention (DLP) Policy

Sync Times with Microsoft

Enhanced DLP Policy using Microsoft Purview Sensitivity Labels

Configure DLP Policy with File Type Criteria

Configuring Misdirected Email Prevention

Misdirected Emails Categories

Configuring the Maximum Alerts shown to the End Users

DLP Policy for Outgoing Emails

DLP Subject Regular Expression (Regex)

Add a regular expression condition to a DLP policy

Subject Regular Expressions Syntax

Unsupported Regex Patterns in DLP

DLP Workflows for Outgoing Emails

DLP Alerts for Outgoing Emails

Prerequisites to Avoid Failing SPF Checks

Outgoing Email Protection - Office 365 Footprint for DLP

DLP Policy Sensitivity Level

DLP Policy for Incoming Emails

DLP Workflows for Incoming Emails

DLP Alerts for Incoming Emails

Encrypting Outgoing Emails

Microsoft Encryption for Outgoing Emails

Encrypting Outgoing Emails using Check Point Email Encryption

Activating Check Point Email Encryption

Accessing Check Point Email Encryption Encrypted Emails

External Recipients Interacting with Emails Vaulted by Check Point Email Encryption

Storage of Emails by Check Point Email Encryption

Configuring Check Point Email Encryption Parameters

Emails Encrypted by Check Point Email Encryption - End User (External Recipient) Experience

To view the secured email, the external recipient must do these

Click-Time Protection Policy

Notifications and Banners

Sending Email Notifications to End Users

Customizing the From address for Email Notifications

Warning Banners

Warning banner samples

Attaching Smart Banners to Emails

Customizing Smart Banners

Enabling/Disabling Specific Smart Banners

Automatically Enabling New Smart Banners

Excluding Specific Sender Domains from Smart Banner

Adding Smart Banners to Allow-Listed Emails

Supported Smart Banners

Notification and Banner Templates - Placeholders

Email Archiving

Activating Email Archiving

Archived Emails

Customizing the Retention Period of Archived Emails

Viewing Archived Emails

Importing Emails to Archive

Exporting Emails from Archive

Support for S/MIME-Signed Emails

Messaging Apps Protection

Microsoft Teams

Required Permissions

Activating and Deactivating Microsoft Teams

Microsoft Teams Security Settings

Configuring Malware Policy for Microsoft Teams

Configuring DLP Policy for Microsoft Teams

Secured Microsoft Teams Messages

Unblocking Messages

Viewing Microsoft Teams Security Events

Activating and Deactivating Slack

Slack Security Settings

Configuring Malware Policy Slack

Configuring DLP Policy for Slack

Configuring DLP Policy for Slack

Configuring Malware Policy

Viewing Slack Security Events

File Storage Protection

Office 365 OneDrive

Activating and Deactivating Office 365 OneDrive

Office 365 OneDrive Security Settings

Configuring Malware Policy for Office 365 OneDrive

Configuring DLP Policy for Office 365 OneDrive

How to View OneDrive Security Events

File Cleaning (Threat Extraction) for Office 365 OneDrive and Office 365 SharePoint

Configuring File Cleaning (Threat Extraction) for Office 365 OneDrive or Office 365 SharePoint

Cleaned Office 365 OneDrive / Office 365 SharePoint Files

Restoring the Original File

Restoring Files that are Cleaned Multiple Times

Viewing Cleaned Files for Office 365 OneDrive and Office 365 SharePoint

Office 365 SharePoint

Activating Office 365 SharePoint

Deactivating Office 365 SharePoint

Office 365 SharePoint Security Settings

Configuring Microsoft Teams File Scanning for E1/E3 Tenants

Configuring Malware Policy for Office 365 SharePoint

Configuring DLP Policy for Office 365 SharePoint

Viewing SharePoint Security Events

File Cleaning for OneDrive and SharePoint

Configuring File Cleaning (Threat Extraction) for Office 365 OneDrive or Office 365 SharePoint

Cleaned Office 365 OneDrive / Office 365 SharePoint Files

Restoring the Original File

Restoring Files that are Cleaned Multiple Times

Viewing Cleaned Files for Office 365 OneDrive and Office 365 SharePoint

Configuring Microsoft Teams File Scanning for E1/E3 Tenants

Supported Protection Policies

Enabling Microsoft Teams File Scanning through OneDrive

Enabling Microsoft Teams File Scanning through SharePoint

Required Permissions

Activating Google Drive

Deactivating Google Drive

Google Drive Security Settings

Configuring Malware Policy for Google Drive

Configuring DLP Policy for Google Drive

Viewing Google Drive Security Events

Action on Files Placed in Vault

Vault Action in Externally Shared Drives

Handling DLP Detections on Externally Shared Drives

Shared Files from Unprotected Drives

Compromised Account (Anomaly) Detection

Compromised Accounts (Anomaly) Workflows

Supported Anomalies

Suspected Anomalies

Configuring Anomaly Detection Workflows

Automatically Blocking All Outgoing Emails

Configuring Settings for Specific Anomalies

Anomaly Exceptions

Partner Risk Assessment (Compromised Partners)

Cloud SMTP Relay

SMTP Relay Configuration Flow

Access the Domains Section

Configure a Domain

Configure DNS Records

Configure the SPF Record

Configure the DKIM Record

Re-checking DNS Records

Access the Relay Sources Section

Relay Sources Table

Configure a Relay Source

Activate Cloud Email Relay

Managing Domains and Relay Sources

Deleting a Domain

Disabling a Relay Source

Deliverability Reporting

Sender Domain Selection and DNS Requirements

Sender Domain Evaluation

Managing Security Exceptions

Security Engine Exceptions

Anti-Phishing Exceptions

Viewing Anti-Phishing Exceptions

Adding Anti-Phishing Exceptions (Allow-List or Block-List Rule)

Interaction between Check Point Allow-List and Microsoft 365 Allow-List

Overriding Microsoft / Google sending emails to Junk folder

Applying Microsoft Allow-List also to Check Point

Importing Allow-List or Block-List from External Sources

Deleting Anti-Phishing Exceptions

Anti-Malware Exceptions

Anti-Malware Block-List

Password-Protected Attachments Allow-List

Adding DLP Allow-List

Click-Time Protection Exceptions

Configure Click-Time Protection exceptions

Link Shorteners and Re-Directions

URL Reputation Exceptions

From the URL Reputation Exceptions page

From the Microsoft Teams / Slack message profile page

Threat Extraction Exceptions

Adding a Threat Extraction Allow-List Exception

Deleting a Threat Extraction Allow-List Exceptions

Trusted Senders - End-User Allow-List

Adding Trusted Senders

To upload a CSV file with trusted senders:

To edit the trusted senders

Global IoC Block List (IOC Management)

Accessing Global IoC Block List

Managing IoCs and IoC Feeds

Managing Security Events

Dashboards, Reports and Charts

Overview Dashboard

Security Widgets

Business Email Compromise (BEC)

Compromised Users

User Interaction

Security Events

Application Protection Health

Login Events Map

Email Security Flow Charts

Detection Flow Chart

Malicious Detections Chart

Analytics Dashboard

To view analytics for a SaaS application

Customizing the Analytics Dashboard using AI Copilot

Customize the Analytics dashboard using Infinity AI Copilot

Office 365 Email and Gmail

Office 365 OneDrive

Check Point's Approach to Shadow IT in Email Security

Shadow IT Dashboard and Events

Shadow IT severity classification

Shadow IT event actions

User Interaction Dashboard

User Interaction Dashboard Widgets

Extending the Time Frame of the Analytics

Security Checkup Report

Security Checkup Report Recipients

Generating a Security Checkup Report

Last 30 Days Security Checkup Report

Scheduling the Security Checkup Report

Configuring a Report Schedule

Default Weekly Report

Sending a Scheduled Report Immediately

Editing a Report Schedule

Deleting a Report Schedule

Reviewing Security Events

Accessing the Events

Filtering the Events

Acting on Events

Dismissing Events

Adding a Note to a Security Event

Attachment Preview

Previewing Email Attachments

Reviewing Phishing Events

Acting on Phishing Events

Post-delivery Email Recheck

Reviewing Malicious Links

Reviewing Malware Events

Acting on Malware Events

Automatic Ingestion of End User Reports

Retention of Security Events

Searching for Emails

Acting on Filtered Results in Mail Explorer

Creating and Saving a New Query

Filtering the Query Results

Updating the Query Details

Exporting a Query Results to your Email Address

Scheduling an Export of Query Results to your Email Address

Modifying the Query Columns

Performing Bulk Actions on Query Results

Quarantining a Query Results

Restoring a Query from Quarantine

Sending a Query Alerts and Reports to Users

Manually Sending Items to Quarantine

Remediating Compromised Accounts

Blocking a User Account

Resetting a User Account Password

Unblocking a Blocked User Account

Resetting Password and Unblocking a Blocked User Account

Monitoring and Auditing Actions on Users

System Settings

SIEM / SOAR Integration

Source IP Address

Configuring SIEM Integration

Extending Formats to Include Additional Information

Forwarding Logs in Syslog Format

Forwarding Audit Logs to SIEM

Supported Security Events for SIEM

SIEM Integration Field Mapping Reference

Forwarding Events to AWS S3

Configuring AWS S3 to Send Email Security Logs to Splunk

Recommended Configuration for known SIEM Platforms

Configuring Integration with Cortex XSOAR by Palo Alto Networks

CrowdStrike Integration

Step 1 - Create a CrowdStrike Data Connection

Step 2 - Configure CrowdStrike SIEM Integration

Managing Quarantine

All Quarantined Emails (Admin View)

Emails with Modified Attachments

Sending the Unmodified Emails to End Users

Dedicated Quarantine Mailbox / Folder

End-User Daily Quarantine Report (Digest)

Enabling the End-User Quarantine Digest

Emails Included in the Quarantine Digest

Configuring Recipients for the End‐User Quarantine Digest

Restricting End Users from Receiving the Digest

Configuring the Available End User Actions in the Daily Quarantine Digest

Scheduling and Coverage Timeframe for the Quarantine Digest

Allowing End Users to Manually Request a Quarantine Digest on Demand

Configuring a Custom Sender for the Quarantine Digest

Customizing the Text of the Quarantine Digest

Customizing Action Labels

End-User Portal (Email Security Portal)

To enable the Harmony Email Collaboration portal for end users

Accessing the Email Security Portal

Enable or disable an authentication method

Authorizing Login Access for the Organization

Accessing the Email Security Portal from Outlook

Accessing the Email Security Portal from Outlook - End-User Experience

To access the Email Security Portal from Outlook:

Required Permissions for Microsoft/Google Login Authorization

Limiting End User Portal Access to Specific Users

Including Blocklisted Emails in the End User Portal

Read and Unread Status of Emails in the End User Portal

Filtering Emails by their State

Acting on Emails

To manually mark emails as read

Managing Restore Requests

Quarantine Restore Requests

Automatic Handling of Quarantined Restore Requests

Re-evaluated Verdict of Quarantined Restore Requests- Administrator Experience

Requesting a Restore from Quarantine - End-User Experience

To request a restore from quarantine:

Restore Requests for Emails Sent to Groups - End-User Experience

Restoring Emails Without Administrator Approval - End-User Experience

Admin Quarantine Release Process

Cleaned Attachments Restore Requests

Restoring Quarantined Emails - End-User Experience

Who Receives the Emails Restored from Quarantine

Notifying End Users about Rejected Restore Requests

Restore Requests - Notifications and Approvers

Office 365 Email

Authentication for Email Notifications

Adding a Custom Logo

Adding a Branded Header and Footer to Admin Email Notifications

Customizing Time Zone for Email Notifications and Reports

Customizing End User Browser Pages Language

Customizing Retention Period of Emails and Auditing

SmartConfig Recommendations

Incident Response as a Service (IRaaS)

DMARC Management

RUA Mailbox Hosted by Check Point

Discovering Domains from RUA Reports

Virtual RUF Reports

Adding a New Domain

Reviewing the DMARC Status of your Domains

Annotating / Tagging Domains and Sending Sources

Investigating Domains and Sending Sources

Viewing Specific RUA Reports

Improving your Domains' DMARC Enforcement

Monitoring SPF and DMARC Changes

Annotating / Commenting on SPF and DMARC Changes

Manually Adding New Source to SPF Records

Configuring and Defining the SPF Record

Managing Sending Sources

DKIM Management

Activating DKIM Management

Manually Adding New DKIM Selector to your Domain

Managing Selectors

Alerts and Reports

Adding a New Alert

Security Posture Management (SSPM)

Leaked Credentials

Resetting Passwords for a Compromised User Account

Blocking a Compromised User Account

Security Awareness Training

Creating Security Awareness Training Policy

Customizing Security Awareness Training Policy

Daily Sending Frequency

Customizing the Sender of Security Awareness Training Notifications

Custom Phishing Simulation Templates

Custom Phishing Simulation Templates – Placeholders

Importing Template Email Details from an EML

Assigning Custom Phishing Simulation Templates to Users

Adding a Banner to Phishing Simulation Emails

Authorizing Training Module Access for the Organization

Security Awareness Training Email Headers

Branding the Security Awareness Training Web Page

Security Awareness Training Domains

Monitoring User Interactions with Phishing Simulations

Monitoring User Training Progress

Monitoring Phishing Simulations

Monitoring User Awareness Training Progress

Searching for Security Awareness Training Related Emails in Mail Explorer

Security Awareness Training - End User Experience

Supported Languages for Phishing Simulations and Training Modules

Phishing Simulation Email - End User Experience

Available Training Modules

Video Tutorials

How to Onboard Office 365 Mail with Email Security

How to Onboard Microsoft Teams with Email Security

How to Onboard Office 365 OneDrive with Email Security

How to Onboard Office 365 SharePoint with Email Security

How to Onboard Gmail with Email Security

How to Onboard Google Drive with Email Security

How to Contact Check Point Support and Incident Response Team from the Email Security Administrator Portal

Phishing Email End-User Experience with Email Security

Password-Protected Attachments End-User Experience with Email Security

Check Point Email Encryption End-User (External Recipient) Experience with Email Security

How to Enable Smart Banners to Emails with Email Security

How to Configure Daily Quarantine Report (Digest) in Email Security and Allow End Users to Generate a Report on Demand

How to Configure Security Awareness Training Policy in Email Security

How to Configure Outlook Add-In with Email Security

User Interaction Administrator Experience with Email Security

How to Request to Restore Quarantined Phishing Emails End User Experience with Email Security

How to Respond to Misdirected Email Warnings in Outlook

How to Report a Phishing Email in Outlook

How to Access the Email Security Portal from Outlook

Smart Banners and Trusted Senders End-User Experience with Email Security

Appendix A: Check Point Manual Integration with Office 365 Mail

Step 1 - Authorize the Manual Integration Application

Step 2 - On-boarding (Monitor only and Detect and Remediate)

Step 3 - Check Point Contact

Step 4 - Journal Rule

Step 5 - Connectors

Step 6 - Connection Filter (All Modes)

Step 7 - Protect (Inline) Protection Mode Policy Configuration on Email Security

Step 8 - Connectors (Protect (Inline) Mode)

Step 9 - Transport Rules (Protect (Inline) Mode)

Check Point - Protect External

Check Point - Protect Internal

Check Point - Protect

Check Point - Allow-List

Check Point - Junk Filter

Check Point - Encryption

Transport Rules

Step 10 - Sending User Reported Phishing Emails to an Internal Mailbox

Reverting Manual Onboarding / Switching to Automatic Onboarding

Unified Quarantine for Manual Mode On boarding with Office 365 Mail

Appendix B: Check Point Manual Integration with Google Gmail

Step 1: Add Groups

Step 2: Adding a Host

Step 3: Updating Inbound Gateway

Step 4: Adding SMTP Relay Host

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Google Gmail

Appendix C: Manual Steps for Enabling Gmail Prevent (Inline) DLP Policy

Step 1: Adding a Host

Step 2: Updating Inbound Gateway

Step 3: Adding SMTP Relay Host

Step 4: Add Groups

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Gmail Prevent (Inline) Policy

Appendix D: Securing FedRAMP Organizations

Supported and Unsupported Features in the FedRAMP Region

Appendix E: DLP Built-in Data Types and Categories

Appendix F: Supported Languages for Anti-Phishing

Appendix G: Data Retention Policy

Appendix H: Activating Office 365 Mail in Hybrid Environments

Appendix I: Permitted IP Addresses to access the Check Point Azure Application

Appendix J: Supported File Types for DLP

Appendix K: Troubleshooting

Appendix L: Outlook Add-In

Configuring the Outlook Add-In

Generating the Add-In XML

Deploying the Outlook Add-In through Microsoft 365 Admin Center

Outlook Add-In - Supported Outlook Types and Platform

Automatic Localization of the Outlook Add-In Experience

Appendix M: Configuring Postfix as an Internal SMTP Relay for Non‐TLS Senders to Check Point Cloud SMTP Relay

Postfix Configuration

Restart Postfix to Load the New Configuration

Example Postfix Configuration File

Testing and Debugging Postfix

21 July 2026

© 2022 - 2026 Check Point Software Technologies Ltd.