Multi-engine antivirus
Every message is scanned by ClamAV plus Check Point and Bitdefender via ICAP — layered detection that no single engine matches.
Platform features
One platform, end-to-end email defence
From the moment a message hits your MX to the day you need to retrieve it from the archive, mxflo protects, contains and records every email — inbound and outbound.
Inbound filtering
Block threats before they reach the inbox
Spam & malware filtering
A tuned filtering engine with centralised Bayesian learning and sender-reputation intelligence shared across the whole fleet.
11-category threat taxonomy
Threats are classified — phishing, malware, scam, spam and more — so dashboards and reports are instantly meaningful.
Click-time URL protection
Links are rewritten and re-checked at the moment of click against denylists, newly-registered domains and threat intelligence.
Quarantine & release
Held mail is retained and searchable; your team can review and release false positives in a click.
Sender rules
Per-sender allow / block by domain, IP or CIDR, with require-authentication controls to defeat spoofing.
Anti-phishing & BEC
Defend against targeted, no-malware attacks
Impersonation detection
Catches executive and display-name impersonation used in business email compromise — even when the message carries no attachment or link.
External-sender banners
Automatically flags mail from outside the organisation so users think twice before trusting a look-alike sender.
Spoof & forged-sender defence
Authentication-aware checks separate genuine senders from forged ones, cutting false phishing flags on legitimate mail.
Outbound & account security
Protect your sending reputation
Compromise containment
Behavioural scoring detects hijacked mailboxes and can auto-suspend them in cPanel or Zimbra before your IPs get blocklisted.
Graduated enforcement
A reversible escalation ladder — watch, throttle, hold, suspend — so responses are proportionate and never over-react.
Outbound rate limiting
Per-mailbox and per-domain limits stop a single compromised account from blasting spam at scale.
Exfil-forwarder detection
Surfaces malicious auto-forwarders and filters that quietly siphon a victim's mail to an attacker.
Central DKIM signing
Outbound mail is signed from a central key authority, keeping DKIM valid across every edge and egress IP.
Auto-NDR & queue control
Over-quota and undeliverable mail is handled cleanly with proper bounce notifications and queue insight.
UEBA for email
User & entity behaviour analytics
mxflo baselines how every mailbox and entity normally behaves, then scores deviations in real time — the analytics layer that turns a quiet compromise into an alert and an action.
Behavioural baselines
Per-mailbox models of normal sending volume, timing, recipients and content — so anomalies stand out immediately.
Login & auth analytics
Brute force, password spray, distributed logins and impossible travel, surfaced from real login telemetry.
Account risk scoring
One explainable risk score per account, combining sending, authentication and content signals.
Entity & correspondent mapping
Profiles who each mailbox talks to and flags posture changes across your traffic.
Anomaly-driven enforcement
Rising risk triggers a graduated, reversible response — watch, throttle, hold, then suspend.
Evidence & audit trail
Every incident keeps the signals that fired it — ready for review, reporting and customer assurance.
Authentication & deliverability
Keep every domain aligned
DMARC report monitoring
Ingests and visualises aggregate DMARC reports so you can see who is sending as your domains — and tighten policy safely.
DKIM health monitoring
Continuously audits published DKIM keys and alerts on drift before it causes silent delivery failures.
SPF management
Guidance and enforcement to keep SPF records covering the right egress across a multi-edge deployment.
MX cutover console
Bulk, staged MX migration with low-TTL snapshots and one-click revert — cut over customers with confidence.
Visibility & intelligence
Prove the value, catch the anomalies
Real-time dashboards
Live threat, volume and utilisation charts by domain and mailbox.
Auth-anomaly detection
Login telemetry surfaces brute force, password spraying and account-takeover patterns as they happen.
Communication map
Fingerprints the mail platforms your correspondents run and flags posture changes across your traffic.
Relay & queue health
Passive health per backend server plus queue-by-reason and age insight across the fleet.
Mail-log search
Fast, structured search across message history by sender, recipient, subject, IP and verdict.
Scheduled PDF reports
Management and technical reports you can hand to a customer to show exactly what mxflo blocked.
Managed service
We run it, you stay informed
Deployed & tuned for you
We stand mxflo up in front of your mail and tune protection to your traffic.
Monitored around the clock
Our team watches for threats and compromise, and responds fast.
Clear reporting
Dashboards and scheduled reports show exactly what we blocked.
Guided onboarding
A staged, low-risk MX cutover with one-click revert.
See mxflo on your own domains
Send us your mail platform and domain count and we'll tailor a walkthrough.