---
title: "Is email filtering in place for inbound mail?"
url: https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail
category: "Email security and phishing"
canonical_key: q_eml_011
evidence_state: verified
updated: 2026-08-24
---

# Is email filtering in place for inbound mail?

URL: https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail
Section: Email security and phishing
Evidence state: Verifiable from your tenant

Almost every organisation answers yes, and the useful part of the answer is whether the policies were configured or merely inherited.

## What the carrier is actually asking

The carrier is asking whether inbound mail passes through spam and malware filtering before it reaches users. It is the baseline question in the email block, and the more specific questions about detonation and authentication build on it.

## Why it is underwritten

Filtering removes the volume, which is what makes the remaining, targeted messages noticeable. Carriers ask because a no here is disqualifying and because the follow-up detail distinguishes a tuned deployment from an untouched default.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Filtering configuration is directly readable in Microsoft 365, including whether policies were customised or left at their defaults.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Microsoft 365 | Anti-spam policy configuration and its actions | Custom policy with thresholds and actions chosen deliberately, rather than the default policy alone |
| Microsoft 365 | Anti-malware policy and the common attachment filter | Executable and script attachment types blocked at the gateway |
| Microsoft 365 | Quarantine policies and release permissions | Users cannot release malware from quarantine themselves, and quarantined items are reviewed |
| Microsoft 365 | Outbound spam policy and admin notification | Outbound limits and alerting configured, which is how a compromised mailbox is detected early |
| Microsoft 365 | Allow-lists in transport rules and anti-spam policies | Sender and domain allow-lists reviewed, since a broad allow entry bypasses filtering entirely for that sender |

**Allow-lists are filtering bypasses**

A domain added to an allow-list to fix a false positive years ago will deliver anything sent from a spoofed address in that domain, filtering skipped. These entries accumulate, nobody removes them, and they are the most common self-inflicted gap in an otherwise well-configured mail estate.

## What a defensible yes requires

- Anti-spam and anti-malware policies are configured rather than inherited defaults.
- Dangerous attachment types are blocked by the common attachment filter.
- Quarantine release permissions prevent users from releasing malicious content.
- Outbound spam limits and notifications exist, so a compromised mailbox surfaces quickly.
- Allow-lists are inventoried and reviewed rather than accumulated indefinitely.

## How this answer goes wrong

The default policies are in place and untouched, and a set of allow-list entries added over several years bypasses them for the senders most likely to be impersonated. The answer is yes and the effective coverage is partial in exactly the places that matter.

## If this answer turns out to be wrong

Business email compromise is the highest-frequency cyber claim, so the mail controls described on the application are among the first things an adjuster reads back against it. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Is the built-in filtering enough for this question?

For this specific question, generally yes, provided policies are configured and allow-lists are controlled. The detonation question is where the plan level starts to matter.

### Should users be able to release quarantine items?

For spam, reasonably. For malware and high-confidence phishing, no. Those releases should require an administrator.

### Why does outbound filtering matter here?

Because outbound volume limits and alerts are usually the first indication that a mailbox has been compromised and is sending on the attacker's behalf.

### How do we audit allow-lists?

Export transport rules and anti-spam allow entries, and review each with the person who requested it. Most will have no current justification.

## Related questions

- [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation)
- [Does the Applicant employ SPF, DKIM, and DMARC?](https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc)
- [Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?](https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant)
- [Are external emails tagged as originating from an external source?](https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.