INKY can modify and transform messages processed in a variety of ways to improve security and usability.

INKY can rewrite all links to enable real-time, sophisticated "deep analysis" of URLs when they are clicked after mail delivery. Users can be required to confirm whether they want to continue to a clicked link based on the original message threat level as well as a real-time check of the URL in question. This allows INKY to prevent users from accidentally visiting suspicious sites — both sites that were known to be dangerous when the mail was delivered, but also sites that later got reported or classified as dangerous.

The default "Minimal" banners list the threat types found in each message along with a Details link to get more information. The "Minimal (all links inside color banner)" is similar to "Minimal" but footer links like Report This Email appear inside the color banner. The "Verbose" option includes the details inline in each message. The "Micro" option lacks any details and requires the user to click the Details link to learn what threat types were found.

By default, INKY adds a neutral banner (says "Internal" for internal messages, "External" for others) even when messages don't have any obvious threats. This helps distinguish internal and external mail, and allows users to see external senders' email addresses more easily. If you'd prefer not to add a neutral banner to certain types of messages, you may opt out of this feature. You may also choose to suppress "Caution" or even "Danger" banners, but this is not recommended under normal circumstances.

Some types of messages may require special handling to ensure user functionality is not affected by INKY's modifications (e.g., banner, HTML sanitization, link rewriting). Use these options to adjust how INKY modifies messages of these types; modifying all messages will enforce the strictest level of protection for your users, but may affect the user experience. Choosing not to modify certain messages here will ensure that INKY does not make any body modifications to that mail (though the normal result headers will still be added, and the message results will still be visible in the dashboard). Note: You may have upstream rules causing some of these types to bypass INKY; you may need to disable those rules so INKY can process such mail and apply the policy configured here.

Choose the default language to use for banner text and user-facing landing pages related to the banner (i.e., the Report This Email page, Details page, and any link blocking pages if applicable). Note: Changing the language may affect outbound banner removal. Please reach out to your support representative for more information.

INKY can put a "Report This Email" link in every email processed to allow users to provide feedback. For the most effective reporting, INKY must store an unprocessed copy of incoming mail; we offer a method of doing so that stores the mail encrypted in a way that even INKY employees cannot decrypt until a user explicitly reports the email.

By default, user reports are sent to INKY for further analysis. These settings control where notification emails for each type of report can optionally be sent for your own internal review. Note: Each field can be a comma-separated list of email addresses (e.g., "user@domain.com, user2@domain2.com"). Leave a field blank to not send any custom notifications about a specific type of report.

INKY builds sender profiles and a social graph based on incoming mail to provide spear phishing protection tailored to your organization. The associated warnings are usually disabled at first, as this process requires a short training period to acquire enough data to make reliable predictions.

INKY can detect VIP spoofing (also known as CEO impersonation) using a curated VIP list containing the names and valid email addresses of top executives, board members, and other important contacts. This feature is initially disabled until INKY has a VIP list. The current list can be viewed and/or edited in the VIP List section in the navigation menu on the left.

INKY can leverage existing spam results from Microsoft or Google, and also runs its own spam engine. Use these settings to customize these behaviors.

If your organization uses third-party senders to send messages on behalf of your users, INKY may detect these messages as internal-sender spoofing. This is because your domain appears in the From: field but under-the-hood the mail was sent from a third-party mail server. To avoid such warnings, you can tell INKY about third-party senders that are permitted to send mail on your behalf.

When INKY processes external mail, a message that looks like it's from one of your domains is potentially spoofing unless we can verify that it comes from a trusted source. On the other hand, a message from one of your domains that cannot be verified is likely spoofing and should get detected as potential phishing. Use the below options to help improve INKY's handling of messages that technically arrive from an external system yet may actually be legitimate, internal messages. Also, for some customers, additional context about what type of mail is being processed is required to be able to detect spoofing accurately.

You may use INKY's analysis results to affect whether mail gets delivered to a user's inbox, junk folder, or some type of quarantine in your downstream infrastructure. Note: These settings only result in headers being added to processed mail; INKY does not directly quarantine or move mail to folders. Contact your support representative for more details.

These settings only apply if the "Use INKY results..." setting is not selected above. You may opt to quarantine messages based on INKY's analysis. Only the most serious warnings (aka red "Danger" warnings) will trigger quarantining. Note: For this option to work, you must be using Office 365 / Microsoft Exchange's hosted quarantine with appropriate mail flow rules in place.