How to configure Phishing and Malware protection in Zoho Mail Admin Console

What are Cousin Domains in Zoho Mail and how do you block look-alike domains?

Cousin Domains are domain names that are very similar to any other valid domain name. If you expect a domain to send genuine emails, but want to mark an email from any other variations of the domain name as spam, you can add it in this section.

For example, if 'zylker.com' sends genuine emails, but emails from 'zylker1.com' needs to be processed for spam, you can add zylker.com here.

These variations are commonly used in phishing attacks to trick recipients into trusting fraudulent emails. Zoho Mail lets admins add trusted domains and automatically flag or quarantine emails arriving from any look-alike variations of those domains. Below are the steps to configure Cousin Domain in Zoho Mail Admin Console:

1. Login to the Zoho Mail Admin Console.
2. Go to the Security & Compliance menu, and select Phishing & Malware .
3. Select the Cousin Domains option.
4. In the Email Delivery Action dropdown, select the actions for emails that have look-alike domain names.
   1. If you select None, no action will be taken.
   2. If you select Move to spam, the email will be moved to the spam folder of the email recipient.
   3. If you select Move to quarantine, the email will be moved to the quarantine list, from where the admin will have to process if further.
5. You can also choose to Include Internal Domains, which means that all of your organization's domains will undergo the cousin domains check by default. So, any domain name that is similar to yours will undergo the specified action.
6. Now, click Add, enter the domain names for which cousin domain check has to be done, and click Add.
7. You can also choose to include the domain names by click on Import, and selecting a CSV file which has all the domain names.
8. All the added domains will be listed under Domain Name section.
   

What is Display Name Spoofing in Zoho Mail and how do you prevent it?

Display Name Spoofing occurs when an attacker sends an email using a trusted person's name, such as a CEO or manager, but from a completely different email address, tricking recipients into acting on fraudulent requests. Zoho Mail lets admins define which email addresses are authorized to use specific display names, so any email using that name from an unauthorized address is flagged or quarantined.

For example, consider the email address ceo@mydomain.com. You can ensure that if an email with the display name 'CEO' arrives from any other email address, the action defined by you is taken on this email address.

Follow the below steps to add a policy to prevent display name fraud:

1. Login to the Zoho Mail Admin Console.
2. Go to the Security & Compliance menu, and select Phishing & Malware .
3. Select the Display Name Spoofing option.
4. In the Email Delivery Action section, select the action for emails that have spoofed display names.
   1. If you select None, no action will be taken.
   2. If you select Move to spam, the email will be moved to the spam folder of the email recipient.
   3. If you select Move to quarantine, the email will be moved to the quarantine list, from where the admin will have to process if further.
5. Now, click Add>>Add using email addresses.
    
    
6. Enter the display name, and the email addresses that can be associated with this name, and click Add.
   

You will be able to see a list of the Display Names and the respective Email Addresses that you have added in the list.

For users with alias email address, you can quickly add the user's primary email address along with their alias addresses without having to manually enter each email address. Follow the below steps:

1. Click Add > Search and add organization users. 
   
2. A list of your organization users appears as a pop-up window.
   
3. Select the user you wish to add. If you wish to provide a different display name for the user, you can enter it in the Display name text box. Else, you can leave that box empty.
4. Click Add with Aliases if you want to add the user's alias email address along with their primary email address.
5. Click Add without aliases if you want to associate only the user's primary email address with their display name. 
   

You will be able to see the Display Name and the respective Email Addresses that you have added in the list.

Furthermore, to avoid display name spoofing, Zoho Mail will show the sender's display name only if the sender is in your contacts or if you have had a previous conversation with the sender. Otherwise, only the sender's email address will be shown. For example, consider you get an email from rebecca@zylker.com who has Rebecca as her display name. The display name Rebecca will be shown only if rebecca@zylker.com is already in your contacts or if you have had a previous conversation with her. Otherwise, only the email address rebecca@zylker.com will be shown to avoid display spoofing.

What is Malware Processing in Zoho Mail and how does it protect against email-based threats?

Malware Processing in Zoho Mail Admin Console lets admins configure spam checks based on specific content types and HTML tags commonly used to embed malicious code in incoming emails. Admins can flag emails containing web bugs, JavaScript, macros, or bulk email markers, as well as emails with HTML tags such as frame, object, embed, or form, all of which are frequently used in malware attacks.

How to configure Content-based Spam Settings in Zoho Mail Admin Console

The Content-Based Spam Settings section lists four high-risk content types:

• Web Bugs
• Bulk emails
• JavaScript
• Macros

Admins can select these options to automatically move matching incoming emails to spam. This is particularly useful for blocking emails that carry hidden tracking elements or executable scripts designed to compromise user devices or extract sensitive data.

Follow the below steps to configure Content-Based Spam Settings:

1. Login to the Zoho Mail Admin Console.
2. Go to the Security & Compliance menu, and select Phishing & Malware .
3. Select the Malware Processing option.
4. In the Content-based Spam Settings option, you can see 4 content types (Web Bugs, Bulk emails, JavaScript, Macros)  listed.
5. Select the types that you think might be harmful, and emails containing the content types selected will be moved to spam.

How to configure HTML Tags-based Spam Check in Zoho Mail Admin Console

The HTML Tags-Based Spam Check section lets admins flag incoming emails containing specific HTML tags like frame, object, embed, and form, that are commonly used to embed malicious content or redirect users to phishing sites. Selecting any of these tags ensures that emails containing them are automatically moved to spam before reaching users' inboxes.

Follow the below steps to configure HTML Tags-Based Spam Check:

1. Login to the Zoho Mail Admin Console.
2. Go to the Security & Compliance menu, and select Phishing & Malware .
3. Select the Malware Processing option.
4. In the HTML Tags-based Spam Check option, 4 tags (Frame, Object, Embed, Form) will be listed.
5. Select the tags that you think might be harmful, and emails containing these tags will be moved to spam.

Related Pages

Spam Control Settings | Spam Control Lists | Spam Quarantine