Best Practice - Mesh Unified

The default policy settings are designed to be best practice and are explained below.

Verdict	Recommended action	What the verdict means
CLEAN	DELIVER	The email has been scanned and given a clean verdict.
IMPERSONATION	QUARANTINE	The email contains Business Email Compromise indicators and sender information matches, or is similar to an internal user.
INFOMAIL	QUARANTINE	The email contains an unsubscribe link and/or advertising, marketing, newsletter type content. Note: Many transactional emails will contain unsubscribe links and will be quarantined if your policy is configured to quarantine Infomail.
MALWARE	QUARANTINE	The email contains malicious content such as a URL or attachment.
PHISHING	QUARANTINE	The email contains content such as a URL or attachment that is considered phishing.
SPAM-DEFINITE	QUARANTINE	The email has received a spam score of 18.00+
SPAM-HIGH	QUARANTINE	The email has received a spam score of 9.00-18.00
SPAM-LIKELY	QUARANTINE	The email has received a spam score of 6.25-9.00
SPF-FAIL	REJECT	The email has failed SPF. Note, rejected emails cannot be delivered.
SPF-NONE	NO ACTION	The sender has no SPF record in place. Note, we still see many legitimate senders without an SPF record in place.
BANNED	QUARANTINE	The email contains an attachment banned as per the policy in place.

Policy Option	Recommended action	What the verdict means
Banned Attachments	QUARANTINE EXECUTABLES	If an email contains a banned attachment, it will be automatically quarantined. Allow rules DO NOT bypass this verdict. Emails quarantined for banned attachments can only be released by an administrator or partner team member.
Bypass Internal Banned Attachments	DISABLED	If enabled, internal emails containing a banned attachment will not be quarantined.
Geo Filter	QUARANTINE	Quarantine, junk, or banner actions on emails from different regions and countries. Policy is triggered based on the country of origin or the envelope-from TLD. Allow rules DO NOT bypass this verdict. To bypass the policy-geo verdict, you must create a custom rule or remove the country from the policy option.
Spam Filtering Level	MEDIUM	This feature increases or reduces the sensitivity of the spam filtering. This can be useful if you require filtering to be more or less restrictive for everyone or for certain mailboxes. Low will quarantine emails with a spam score of 7.5 as “Spam-Likely”. Medium is our default medium setting. This will quarantine emails with a spam score of 6.25. Emails at this score would fall into our "Spam-Likely" category. High will quarantine emails with a spam score of 5.0 as “Spam-Likely”. Medium is the recommended setting.

Actions	What it means
DELIVER	Emails are delivered to the inbox.
DELIVER + BANNER	Emails are delivered to the inbox with a verdict dependant or a contextual banner applied. Learn more here:Banners
QUARANTINE	Emails are quarantined in Mesh for 28 days.
JUNK	Emails are moved to the Junk folder in Outlook.
BANNER	A warning banner is applied to the top of the email.
JUNK + BANNER	A warning banner is applied to the top of the email and the email is moved to the Junk folder in Outlook.
DELETE	Emails are deleted entirely and will not appear in the quarantine or inbox. Deleted emails cannot be delivered.
REJECT	Emails are rejected before content scanning. Rejected emails cannot be delivered.