<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-secure-email-gateway
description: >-
  Configure and harden secure email gateways including anti-spam, anti-malware,
  sandboxing, URL rewriting, attachment filtering, and transport rule enforcement
  for Exchange, M365, and Google Workspace.
domain: cybersecurity
subdomain: email-security
tags:
  - email-gateway
  - exchange
  - m365
  - anti-spam
  - sandboxing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1566.001"]
  tools: [exchange-powershell, m365-admin, postfix, rspamd]
---

# Configuring Secure Email Gateway

## Overview

Secure email gateways are the primary defense layer for email-borne threats.
Proper configuration includes anti-spam scoring, attachment sandboxing, URL
rewriting with time-of-click protection, transport rules for policy enforcement,
and connection filtering to block known-bad senders.

## Prerequisites

- Tools: Exchange PowerShell, Postfix, rspamd
- Administrative access to email gateway platform
- Understanding of mail flow and MX record configuration

## Key Concepts

- **Anti-spam scoring**: Multi-layered spam detection with confidence thresholds
- **Sandboxing**: Detonating attachments in isolated environments before delivery
- **URL rewriting**: Replacing URLs with safe links for time-of-click analysis
- **Transport rules**: Policy enforcement at the mail flow layer

## Workflow

### Step 1: Exchange Online Protection Configuration

```powershell
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@example.com

# Configure anti-spam policy
New-HostedContentFilterPolicy -Name "Strict Anti-Spam" \
  -SpamAction Quarantine \
  -HighConfidenceSpamAction Quarantine \
  -BulkThreshold 5

# Configure anti-malware policy
New-MalwareFilterPolicy -Name "Strict Anti-Malware" \
  -EnableFileFilter $true \
  -Action DeleteMessage

# Enable Safe Attachments (ATP)
New-SafeAttachmentPolicy -Name "Block Malicious" \
  -Action Block -Enable $true -Redirect $true \
  -RedirectAddress security@example.com
```

### Step 2: Transport Rules for Policy Enforcement

```powershell
# Block auto-forwarding to external domains
New-TransportRule -Name "Block External Auto-Forward" \
  -FromScope InOrganization \
  -MessageTypeMatches AutoForward \
  -SentToScope NotInOrganization \
  -RejectMessageReasonText "External auto-forwarding is not permitted"

# Require TLS for specific partners
New-TransportRule -Name "Require TLS for Partner" \
  -RecipientDomainIs "partner.com" \
  -RouteMessageOutboundRequireTls $true
```

### Step 3: Postfix Gateway Hardening

```bash
# /etc/postfix/main.cf hardening
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
smtpd_client_connection_rate_limit = 30
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/ssl/certs/mail.pem
smtpd_tls_key_file = /etc/ssl/private/mail.key
smtp_tls_security_level = dane

# Verify configuration
postfix check
postconf -n | grep -i tls
```

### Step 4: URL and Attachment Sandboxing

```powershell
# Safe Links policy (M365)
New-SafeLinksPolicy -Name "URL Protection" \
  -IsEnabled $true -ScanUrls $true \
  -DeliverMessageAfterScan $true \
  -TrackClicks $true -AllowClickThrough $false

# Apply to all recipients
New-SafeLinksRule -Name "All Users URL Protection" \
  -SafeLinksPolicy "URL Protection" \
  -RecipientDomainIs "example.com"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Gateway bypass | SMTP logs | Messages delivered without gateway processing |
| Transport rule change | Audit logs | Modifications to mail flow rules |
| Spam filter evasion | Gateway logs | Low-confidence spam reaching inbox |

```yaml
title: Email Transport Rule Modified
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects modification of email transport rules weakening security
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation:
      - "New-TransportRule"
      - "Set-TransportRule"
      - "Remove-TransportRule"
  condition: selection
falsepositives:
  - Authorized email administrator changes during maintenance
level: medium
tags:
  - attack.t1564
  - attack.defense_evasion
```

## Verification

- [ ] Anti-spam policy configured with appropriate thresholds
- [ ] Anti-malware blocks executable attachment types
- [ ] Safe Attachments sandboxing enabled and tested
- [ ] Transport rules enforce TLS and block auto-forwarding
- [ ] URL rewriting and time-of-click protection active

## References

- [Microsoft EOP Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/)
- [Postfix Configuration](http://www.postfix.org/BASIC_CONFIGURATION_README.html)
- [CIS M365 Benchmark](https://www.cisecurity.org/benchmark/microsoft_365)
