Protect against display name impersonation attacks where threat actors use display names similar to trusted users (such as executives, vendors, or colleagues) to trick recipients into taking actions like transferring money or revealing sensitive information. This feature provides comprehensive protection through multiple layers of defense:
Core Detection Engine: Uses advanced name similarity detection (Jaro-Winkler algorithm) to identify when an email's display name closely matches a protected user but originates from a different email address. Administrators can configure a similarity threshold (0.0 - 1.0) where 1.0 requires an exact match and lower values enable fuzzy matching to catch variations like "Jon Smith" vs "John Smith".
Protected User Management: Administrators can designate high-value targets (executives, finance personnel, HR staff) for monitoring. Each protected user can maintain a personal address list of legitimate alternate addresses to prevent false positives when they email from personal accounts.
Free Email Provider Actions: Apply stricter policies to messages from free email providers (Gmail, Yahoo, Outlook.com, Hotmail, ProtonMail, iCloud, AOL, and many others) where impersonation attacks commonly originate. Configure separate actions specifically for these high-risk sources.
Flexible Response Actions: Choose from multiple response options including rejecting messages, quarantining for security review, adding warning headers (X-SecurityGateway-DisplayNameSpoofed), tagging subject lines with [SPOOFED], or filing to spam folders. Different actions can be configured for general matches versus matches from free email providers.
Granular Exclusions: Prevent false positives with multiple exclusion options: allowlisted IP addresses, authenticated sessions, domain email servers, and a configurable sender exclusion list supporting wildcard patterns (*@company.com, user*@domain.com, admin@*.com).
Sieve Integration: Advanced users can create custom policies using the new
vnd.mdaemon.display_name_spoofed and vnd.mdaemon.sender_is_free_email Sieve tests.
Configuration is available under Security | Anti-Spoofing | Display Name Protection in the web interface.
Connection pooling reuses existing database connections instead of creating new ones for each operation, includes automatic retry logic with exponential backoff for transient failures, and provides circuit breaker protection to prevent cascade failures during database outages. The pool automatically prunes idle connections to optimize resource usage.
Dashboard Monitoring: Global administrators can monitor database connection pool health in real-time from the dashboard. Statistics include current pool size, maximum pool size, active connections, idle connections, circuit breaker status, and consecutive failure count. The DB Connection Pool statistics display on the dashboard can be disabled under Main | My Account | Settings.
Windows Performance Monitor: Database connection pool metrics are exposed as Windows Performance Monitor counters under the SecurityGateway object, enabling integration with external monitoring tools and alerting systems.
Restrict administrator login access to specific IP addresses or IP ranges, providing an additional layer of security for administrative accounts. This feature helps prevent unauthorized access by limiting where administrators can authenticate from.
Global and Per-Domain Configuration: Configure IP restrictions for global administrators separately from domain administrators. Domain administrators can login from IPs in their domain-specific allow list OR the global allow list, providing flexibility for multi-domain environments while maintaining centralized security policies.
Flexible IP Matching: Supports individual IP addresses, IP ranges, and CIDR notation. Localhost access (127.0.0.1 and ::1) is always permitted to ensure local access is never blocked.
Comprehensive Logging: All administrator access attempts (granted and denied) are logged to the HTTP log with IP address and administrator email for security auditing and compliance requirements.
Configuration is available under Setup / Users | Accounts | Administrators | IP Restriction Option.