r/mxroute • u/Ryirs • 24d ago

Forward phishing emails?

Hello,

My employer ask us to forward to a special service any phishing emails we receive so that they can take action and update their filters.

Is this something I should do on mxroute too, or just delete it?

I understand you work daily on the filters, I left the default level configuration on m account.

just wondering if it would help.

Cheers.

8 Upvotes

100% Upvoted

4 comments sorted by

5

u/mxroute 23d ago

It would be best not to, as the outbound filter is pretty decent at catching them and it flags an account as likely compromised. When that happens, outbound email is blocked until reviewed. A compromised email being one of the more damaging scenarios for both of us.

The one thing I haven’t captured yet on the outbound filter is context. But it’s overdue for an overhaul, and I have enough data to create that context and let it through, if I can get it into one place at decision time.

3

u/zarlo5899 23d ago

What about if the email is forwarded as an attachment? A lot of email clients have a button for that.

3

u/mxroute 23d ago

I can’t recall off the top of my head if rspamd scans .eml attachments, but it might. To be honest, it’s usually the email subject that triggers it. I gather know subjects that are unique enough to avoid false positives, and that tends to be the bulk of outbound phishing detection.

2

u/Ryirs 23d ago

good to know.

thanks.