TotalHealMailShield

How it works

1. ConnectGrant MailShield API access to Microsoft 365 or Google Workspace; MX records and mail flow do not change.
2. ReadNew inbox mail in every mailbox is read every minute, with a cursor per mailbox.
3. AnalyseSender, SPF / DKIM / DMARC, links, attachments and wording are scored; every reason is kept with its weight.
4. QuarantineMalicious mail moves to a hidden quarantine folder; campaigns across mailboxes are contained in one action.
5. RespondAlerts join the incident queue; releases of malicious mail need a second person.

Reference architecture

Key capabilities

• API-based, no MX changeConnects to Microsoft 365 through Microsoft Graph (an app with Mail.ReadWrite and User.Read.All, or keyless with a federated credential) and to Google Workspace through a service account with domain-wide delegation. Mail flow and MX records stay exactly as they are.
• Every mailbox, every minuteEvery user mailbox of the connection is listed automatically and new inbox mail is read every minute, round robin, with a cursor per mailbox so nothing is analysed twice or skipped.
• Sender impersonationLook-alike sender domains of your own domains, your suppliers and more than 40 global and Indian brands (typos, homoglyphs, extra words: micros0ft-support.com, tata-steeel.com, docusign-notice.net); a brand or one of your executives named in the display name of outside mail; a Reply-To or Return-Path that differs from the sender; a display name that shows a different address; a sender writing to your organisation for the first time.
• AuthenticationSPF, DKIM and DMARC results as your mail service recorded them; mail that claims your own domain but fails authentication is flagged as spoofed.
• LinksEvery link checked against TotalHeal threat intelligence and your own indicator feeds (URL and domain); links whose text shows one site but go to another; look-alike, punycode, raw IP-address and URL-shortener links.
• AttachmentsClamAV scanning when a ClamAV server is configured; SHA-256 of every attachment checked against known-malicious hashes; HTML smuggling (a page that builds a file in the browser); HTML sign-in forms that post to another site; executables, scripts, disk images and shortcuts from outside; a document extension hiding an executable (invoice.pdf.exe); password-protected archives that cannot be scanned.
• Business email compromiseRequests to change bank or payment details, urgent payment and transfer requests, gift-card requests and credential requests (“your password will expire”, “verify your mailbox”, KYC and PAN updates), in English and Indian business phrasing.
• A score with every reasonEach message gets a score from 0 to 100 and a verdict — clean, suspicious or malicious — with a category (phishing, malware, business email compromise, impersonation) and every reason listed with its weight.
• Automatic quarantineMalicious mail (or suspicious mail too, if you choose) is moved to a hidden TotalHeal Quarantine folder or label; detect-only mode alerts without moving anything.
• Release with four-eyesSuspicious mail can be released by one person with a reason; releasing malicious mail needs a second person — never the requester, never a service account.
• CampaignsThe same message from one sending domain reaching several mailboxes is grouped as a campaign, alerted once it reaches three mailboxes in a day, and quarantined everywhere in one action.
• User-reported phishingEmployees forward suspicious mail to your report mailbox; MailShield analyses the original message inside the forward and always sends it to your SOC.
• Your policyYour domains, the executives attackers impersonate, your supplier and partner domains, allow and block lists. Malware is caught even from allowed senders.
• Alerts in the same incident queueEvery finding is an alert mapped to MITRE ATT&CK (T1566 phishing, T1684.001 impersonation, T1684.002 email spoofing), correlated with endpoint, identity and cloud alerts, and sent on to your SIEM, ticketing and playbooks.
• Privacy by designMessage bodies and attachments are analysed in memory and never stored: MailShield keeps the headers, link hosts, attachment names and hashes, and the verdict. Credentials are sealed per organisation and never shown again.

In the console

Deployment options

System requirements

Technical specifications