Created – January 18, 2018 by DunRan
Modified – December 17, 2021 by Olaniyi Osatuyi
Prerequisites –

This K-Page is for Users with the SOPHOS Central eMail Gateway

Please note. More detailed help may be found through the Help menu once logged onto SOPHOS Central.

Overview

The SOPHOS eMail Gateway helps to protect the organization against spam, malware, ransomware and phishing attacks that come at you through eMail. It does this, by intercepting all incoming eMail in the SOPHOS “Cloud”, analyzing the messages (attachments, content, keywords and other criteria). Based on its decision, one of four actions are taken.

1. Success – legitimate eMail, released forward to the intended mailboxes
2. Quarantined – suspicious eMail, held in quarantine for user decision
3. Deleted – incoming eMail was from a Blocked eMail address or domain, therefore was deleted
4. Processing – still examining the eMail

Quarantine Summary Message

Each user with quarantined messages will receive a daily summary (Monday to Friday) of the new items quarantined, similar to this example (NOTE: you only receive a daily message if you had quarantined messages).

Items quarantined that perhaps should not be (called false positives) are generally more frequent when the software is first implemented as you need to teach the software the acceptable senders.

If you notice a quarantined message from a valid eMail address or domain (in this example, synnexmarketing.ca is eMail I would like to receive), you can tell your Gateway Administrator (or Logical Developments) to allow the eMail address (or entire domain in this case), and they can add it to the “whitelist” (meaning these will no longer be quarantined).

Releasing an eMail

You can release individual eMail by clicking the release option. When I do that for the synnexmarketing.ca message, I immediately receive this web page:

Self Service Portal

I can work with my messages by using the Self-Service (either the link in the web page above, or the Manage Quarantine Message link in the original eMail to me, or by going https://cloud.sophos.com/manage/self-service). For this, I will have to logon to SOPHOS Central.

Once logged in, I will see this screen.

On the next screen, I can select messages to Release or Delete.

So, as you can see, in this case I should inform my Administrator to whitelist “synnexmarketing.ca” (then none of their eMail will be quarantined) and any other like “safe senders”. This will reduce the amount of Self-Service maintenance that I need to do.

I can also provide “blacklist” domains – this will delete those eMails, so I will never see them at all – to my Administrator.

Regarding deleting eMails, few people worry about this, as the quarantine will automatically delete messages from the Q folder after 30 days.

Emergency Inbox

Another option available through my Self-Service Portal is the Emergency Inbox. Should the main eMail Server for the organization be unavailable because of a site Internet issue, maintenance window or other reason, the SOPHOS Gateway will collect my incoming eMail and hold it in the Emergency Inbox.

Via the Self-Service Portal, I can get at this queued eMail for viewing purposes.

• These eMails will be released to the main eMail Server automatically once it becomes available.

Smart Banners

When you turn on Smart banners, a banner is displayed at the top of inbound HTML format email messages to show if the email is trusted.

Smart banners use different colors and messages to show whether an email passed DNS checks.

To turn Smart Banner on/ off :

Navigate to email security, and click on Policies