Best Practice - Mesh Unified

The default policy settings are designed to be best practice and are explained below.

Verdicts

Verdict	Recommended action	What the verdict means
CLEAN	DELIVER	The email has been scanned and given a clean verdict.
IMPERSONATION	QUARANTINE	The email contains Business Email Compromise indicators and sender information matches, or is similar to an internal user.
INFOMAIL	QUARANTINE	The email contains an unsubscribe link and/or advertising, marketing, newsletter type content. Many transactional emails will contain unsubscribe links and will be quarantined if your policy is configured to quarantine Infomail.
MALWARE	QUARANTINE	The email contains malicious content such as a URL, attachment, or other suspicious characteristics. Allow rules DO NOT bypass this verdict. Emails quarantined with the malware verdict can only be released by an administrator or partner team member.
PHISHING	QUARANTINE	The email contains phishing content such as a URL, attachment, or other suspicious characteristics. Allow rules DO NOT bypass this verdict. Emails quarantined for phishing verdict can only be released by an administrator or partner team member.
SPAM-DEFINITE	QUARANTINE	The email has received a spam score of 18.00+
SPAM-HIGH	QUARANTINE	The email has received a spam score of 9.00-18.00
SPAM-LIKELY	QUARANTINE	The email has received a spam score of 6.25-9.00
SPF-FAIL	REJECT	The email sender has failed SPF. Reject - Email dropped at the connection level. Rejected emails cannot be retrieved. Quarantine - Set the verdict to Spam-Definite. An SPF softfail will not be rejected even if action is set to reject. Instead, a spam score will be applied.
SPF-NONE	NO ACTION	The email sender has no SPF record in place. Many legitimate senders send email without an SPF record in place e.g. Microsoft Out Of Office Notifications No Action - Do nothing. Score - Add an additional spam score of 3.0 to the message. Quarantine - Set the verdict to Spam-Definite.

Additional Options

Policy Option	Recommended action	What the verdict means
Banned Attachments	QUARANTINE EXECUTABLES	If an email contains a banned attachment, it will be automatically quarantined. Allow rules DO NOT bypass this verdict. Emails quarantined for banned attachments can only be released by an administrator or partner team member.
Bypass Internal Banned Attachments	DISABLED	If enabled, internal emails containing a banned attachment will not be quarantined.
Geo Filter	QUARANTINE	Quarantine, junk, or banner actions on emails from different regions and countries. Policy is triggered based on the country of origin or the envelope-from TLD. Allow rules DO NOT bypass this verdict. To bypass the policy-geo verdict, you must create a custom rule or remove the country from the policy option. Emails quarantined due to the policy-geo verdict can only be released by an administrator or partner team member.
Spam Filtering Level	MEDIUM	This feature increases or reduces the sensitivity of the spam filtering. This can be useful if you require filtering to be more or less restrictive for everyone or for certain mailboxes. Low will quarantine emails with a spam score of 7.5 as “Spam-Likely”. Medium is our default medium setting. This will quarantine emails with a spam score of 6.25. Emails at this score would fall into our "Spam-Likely" category. High will quarantine emails with a spam score of 5.0 as “Spam-Likely”. Medium is the recommended setting.

Actions Explained

Actions	What it means
DELIVER	Emails are delivered to the inbox.
DELIVER + BANNER	Emails are delivered to the inbox with a verdict dependant or a contextual banner applied. Learn more here:Banners
QUARANTINE	Emails are quarantined in Mesh for 28 days.
JUNK	Emails are moved to the Junk folder in Outlook.
BANNER	A warning banner is applied to the top of the email.
JUNK + BANNER	A warning banner is applied to the top of the email and the email is moved to the Junk folder in Outlook.
DELETE	Emails are deleted entirely and will not appear in the quarantine or inbox. Deleted emails cannot be delivered.
REJECT	Emails are rejected before content scanning. Rejected emails cannot be delivered.