Mail Gateway · Exchange & Microsoft 365
Phishing and malware stopped before they reach a mailbox.
A filtering mail gateway in front of Exchange or Microsoft 365, running inside your own infrastructure with the same detection your websites already get. And Outlook on the web and phones published through Defneo — protected against the known Exchange exploits, with push mail intact.
Commercial edition (30-day trial included)
New in October 2026, validated in test environments — we set up the first deployments together with you, as a pilot.
Mail on a shared hosting account (cPanel) instead? Site Shield filters those mailboxes for free
- Filtered before deliveryEvery message is checked before Exchange receives it: executable and script attachments (also inside ZIPs), HTML attachments with a password form, known malware hashes, senders from hijacked networks or abuse lists, links that show one domain and go to another, spoofed display names.
- Nothing queued, nothing lostExchange validates its own recipients and gives its own answer. If Exchange is down, the sending server simply retries — the gateway never accepts a message Exchange did not accept.
- Tag, monitor or rejectBy default junk is tagged and an Exchange transport rule moves it to the user's Junk folder. Monitor mode only labels; reject mode refuses clear phishing and malware outright.
- Open antivirusAttachments are checked against ClamAV-format signatures, and scanned by a ClamAV engine when you enable it. A scanner that is unavailable is reported as such, never as "clean".
- Sender reputation you already ownThe attackers your Defneo installation has banned and the Defneo community feed — including hijacked networks on Spamhaus DROP — become sender signals for mail.
- Never an open relayMail is accepted only for your own domains, and verdict headers written by a sender are removed before scanning: nobody can pre-write "clean" on their own message.
Outlook on the web and phones, published through Defneo
Exchange keeps being one of the most attacked servers on the internet. Defneo puts it behind the same edge as your websites, with rules that know Exchange:
- Known exploits refusedProxyShell, ProxyNotShell, ProxyLogon and the web shells left behind by those campaigns are stopped at the edge, and the source address is banned.
- Admin centre off the internetThe Exchange admin centre and remote PowerShell are refused from the internet and stay reachable from the networks you trust.
- Push mail that keeps workingPhones and Outlook keep a connection open for minutes to receive new mail instantly. Exchange gets timeouts sized for that, while every other site keeps its strict ones.
- Brute force, counted on failuresFailed Outlook on the web logins are counted, not logins: a whole office signing in at nine in the morning is never mistaken for an attack.
Three steps
- 1. Connect the gateway to ExchangeYour domains and the Exchange receive connector (or your Microsoft 365 tenant). Exchange is told to accept internet mail only from the gateway.
- 2. Move the MX recordYour MX record points to the Defneo server. A transport rule in Exchange (or Microsoft 365) sends tagged mail to the Junk folder.
- 3. Publish Outlook on the web and ActiveSyncOne command publishes the Exchange host names through Defneo, with automatic certificates and the Exchange-specific rules above.
What it never does
- Store your messages: there is no quarantine copy on the gateway.
- Accept a message Exchange refused, or lose one when Exchange is down.
- Stop your mail because the scanner failed — mail keeps flowing, labelled as unscanned.
- Trust a verdict a sender wrote into their own message.
What leaves your infrastructure
Nothing from your messages. Mail passes through a server you run, is checked there and is not kept. Sender reputation comes from your own Defneo installation and the signed community feed.
Requirements
- Defneo commercial edition (the 30-day trial includes it)
- Exchange Server 2016 / 2019 / Subscription Edition, or Microsoft 365
- Inbound SMTP reachable on the Defneo server and access to your DNS (MX record)
- For the ClamAV engine: about 1.5 GB of extra memory