Working with Email Warning Tags

About Email warning Tags

Email Warning Tags are an optional feature that helps reduce the risks posed by malicious email. It is available only in environments using Advanced + or Professional + versions of Essentials. This feature must be enabled by an administrator. 

With this feature enabled, when Essentials determines, based on the configured email warning tags, that an inbound message may post a risk, it inserts a brief explanation and warning into the body of the message. This is supplemented with HTML-based banners that prompt users to take care when viewing or replying to the message or when downloading any of its attachments. and provide a reason for why the message should be treated with caution. An additional implementation-specific message may also be shown to provide additional guidance to recipients. Note that inbound messages that are in plain text are converted to HTML before being tagged.

If the user has authenticated themselves with Essentials, an optional "Learn More" link is available: this takes the user to a page offering more detailed information about why the message was tagged and allowing them to add such messages to their blocklist. The "Learn More" content remains available for 30 days past the time the message was received. 

If your environment sends outbound messages through Essentials, if a tagged message is replied to or forwarded to another user, the warning and "Learn More" links are removed. 

Note that archived messages retained their email warning tags, but downloaded versions of emails do not.  

Enabling the Email warning Tags Feature

On the Features page, check Enable Email Warning Tags, then click Save.

Setting up Email warning Tags

Click Security Settings, expand the Email section, then click Email Tagging. Enable the types of tags you want used in your environment (see below for a description of each of the available tag types) and specify whether you want to provide users with a "learn more" link, whether actions can be performed on messages when the "learn more" link has been used, and whether to include additional text below the warning tag. 

To see how the email tag will appear to users, in the Preview Warning Tags section of the Email Tagging page, select the tag and the desired language: a preview of the tag in that language is shown. 

Available Tags

Tag Name	Tag Type	Tag Meaning	What the User Sees
DMARC	Warning	Informs users when an email from a verified domain fails a DMARC check. Tag is applied if there is a DMARC fail. It does not require a reject.
Newly Registered Domain	Warning	Informs users when an email was sent from a newly registered domain in the last 30 days.
High Risk Geo IP	Warning	Informs users when an email was sent from a high risk location. (Cuba, Iran, North Korea, Sudan, Syria, Russian or China)
External Sender	Informational	Informs users when an email comes from outside your organization.

Note that messages can be assigned only one tag. If a message matches the criteria for more than one tag, for example, is both from an external sender and determined to be from a Newly registered domain, the message's tag is determined as follows:

• if the message matches both a Warning and an Informational tag, the Warning tag is applied.

• if the message matches more than one Warning tag, the one that is highest in priority is applied (in this order: DMARC, Newly Registered Domain, High Risk Geo IP)