Sophos Email: choose an architecture and plan onboarding
This decision guide separates Mailflow and Gateway, assigns ownership and walks through the pilot, cutover, validation and operations.
Sophos Email
These guides cover architecture and onboarding, licensing, directory, mailbox and domain management, Gateway and Microsoft 365 Mailflow, and safe policies against spam, spoofing, malware, and dangerous URLs.
Contents
Sophos Email topic overview
The articles follow the Sophos Email operational lifecycle: architecture and licensing, domains and mailboxes, mail flow, protection policies, quarantine and investigation, encryption, and automation.
Getting started, architecture, and licensing 4
Choose Mailflow or Gateway, check regions and licences, plan onboarding, and migrate existing Mail Protection.
Sophos Email: check licensing and data region before onboarding
This checklist assigns ownership, evidence and escalation for a Sophos Central data-region choice that can't be changed after submission.
Sophos Email: manage licenses, usage and lifecycle
This guide explains editions, add-ons, license consumption, reconciliation and the safe handling of trial and subscription end dates.
Migrate from Sophos Firewall Mail Protection to Sophos Email
A staged migration runbook for MTA and transparent proxy deployments, with explicit feature gaps, loop prevention and acceptance gates.
Domains, directories, and mailboxes 4
Manage domains, DKIM, and SMTP routing, maintain mailboxes, synchronise directories, and remove domains safely.
Sophos Email: configure Gateway domains, DKIM and SMTP routing
This guide moves from domain verification through DNS and DKIM to BATV, SMTP routing, testing and a controlled way back.
Safely remove and offboard a Sophos Email domain
This runbook disconnects Mailflow, removes the domain from both possible inventories, and proves the replacement mail path.
Sophos Email: manually add, import and manage mailboxes
This guide covers the lifecycle of manually managed user mailboxes, distribution lists and public folders in Sophos Central.
Synchronize Sophos Email with Google Directory
This guide covers authorization, filters, synchronization, additional domains, troubleshooting, and irreversible cleanup of a Google Directory source.
Gateway and Mailflow 7
Set up and troubleshoot Sophos Gateway and Microsoft 365 Mailflow for Microsoft 365, Exchange, Google Workspace, and Zoho Mail.
Set up and safely disconnect Sophos Email Gateway
This guide covers the Gateway decision, domain verification, controlled cutover, validation, troubleshooting and offboarding.
Set up Sophos Email Gateway with Microsoft 365
This guide covers Microsoft 365 Gateway connectors, a safe MX cutover, and validation in Message Trace and Sophos Message History.
Set up Sophos Email Gateway with Exchange on-premises
This guide connects on-premises Exchange to Sophos Gateway with restricted receive and send connectors while avoiding open relay and competing routes.
Configure Sophos Email Gateway with Google Workspace
This guide connects Google Workspace to Sophos Gateway in both directions and provides a safe change, validation, and troubleshooting strategy.
Set up Sophos Email Gateway with Zoho Mail
This runbook covers Zoho routes, live Sophos Gateway values, a controlled cutover and validation in both directions.
Set up Sophos Email Mailflow for Microsoft 365
This guide takes administrators from tenant permissions through Mailflow activation to testing, Gateway migration, and clean removal.
Sophos Email Mailflow: systematically repair Microsoft 365
This runbook isolates Sophos Mailflow faults with Quick Test, Message Trace, and header analysis and provides safe repair and rollback paths.
Protection policies and threat defence 12
Control spam, spoofing, malware, dangerous URLs, DLP, DMARC, outbound threats, and account compromise.
Sophos Email Security: create and assign policies
This guide explains scope, policy order, special handling for distribution lists and shared mailboxes, and safe testing and rollback.
Configure Sophos Email anti-spam and outbound threats
This guide covers spam actions, NRD and New Sender Protection, outbound disclaimers, the delay queue and safe handling of false positives.
Sophos Email: Securely manage inbound allow/block exceptions
A controlled workflow for narrowly scoped inbound exceptions, list precedence, SPF/DKIM/DMARC, CSV imports, and regular cleanup.
Sophos Email: configure Impersonation Protection and VIP protection
This practical workflow connects VIP management, policy actions, Aggressive Mode, smart banners, validation, and safe troubleshooting.
Sophos Email: configure sender authentication and Smart Banners
This guide explains inbound sender authentication, processing order, safe actions, Smart Banners and validation in Message History.
Sophos Email: configure malware, attachment, and URL protection
This administrator workflow connects policy scope and rule order with safe actions, Message History checks, troubleshooting, and rollback.
Sophos Email: configure Time-of-Click URL protection
A safe administrator workflow for page text, logos, tightly scoped URL Allow List entries, validation, and troubleshooting.
Sophos Email Data Control: Configure DLP Rules Safely
This guide shows how to plan and prioritise Data Control rules, verify them with realistic positive and negative tests, and safely resolve …
Set up Sophos Email DMARC Manager
Practical guide to DNS delegation, staged DMARC policies, sender analysis, validation, troubleshooting and the reporting-migration boundary.
Set up and verify Sophos Email Post-Delivery Protection
This administrator workflow separates provider setup, automatic remediation, and on-demand clawback and covers acceptance testing, quarantine, …
Sophos Email: detect and respond to account compromise
This incident runbook connects recipient configuration with triage, documented containment measures, validation, recovery, rollback, and escalation.
Sophos Email: sending limits and bulk sender privileges
This admin guide connects current thresholds with the request workflow, status checks, reset windows, and the distinction between legitimate bulk mail …
Quarantine, investigation, and reporting 7
Operate quarantines, trace messages, process user reports, and investigate incidents with monitoring and Threat Analysis.
Sophos Email: set up Microsoft 365 quarantine
A controlled setup and acceptance workflow for Gateway and M365 Mailflow domains, with a clear boundary around Microsoft-owned quarantine.
Administer Sophos Email quarantine
A controlled administrator workflow for quarantine types, details, Intelix inspection, release, deletion, evidence, and escalation.
Set up Sophos Email quarantine self-service
A controlled workflow for scheduling, portal access, release and delete permissions, recipient mapping, validation, and troubleshooting.
Sophos Email Message History: trace messages and troubleshoot delivery
A practical runbook for search, status and category analysis, recipient events, authentication, eligible remediation, evidence, and escalation.
Operate Sophos Email reports and monitoring
An operational workflow for dataset selection, filters, drill-down, scheduling, export, validation, and correct handling of pending verdicts.
Sophos Email: deploy and repair the Report to Sophos Outlook add-in
A controlled workflow for Microsoft 365 deployment, client and network diagnosis, cache and token cleanup, and a verifiable reporting test.
Integrate Sophos Email with Threat Analysis Center
The Marketplace integration sends Sophos Email events to Sophos for analysis and is accepted through tile health and a representative data record.
Encryption and secure delivery 4
Deploy TLS, Secure Message, S/MIME, portal encryption, and the Outlook add-in safely.
Sophos Email: Configure TLS and Secure Message securely
Decision guide and runbook for policy scope, TLS versions, certificate verification, Push and Portal Encryption, validation, troubleshooting and …
Sophos Email: set up and operate S/MIME encryption
An evidence-led administrator workflow for prerequisites, certificate matching, inbound and outbound testing, and the secure certificate lifecycle.
Sophos Email: deploy the Outlook encryption add-in
This workflow joins the Sophos Central configuration to supported Microsoft deployment and a verifiable acceptance test.
Sophos Email: configure portal encryption, branding, and recall
A practical workflow for the branding request, recipient experience, administration, acceptance testing, rollback, and troubleshooting.
APIs and automation 7
Automate API access, tenant routing, mailboxes, quarantine, Clawback, and S/MIME in a controlled way.
Get started with the Sophos Email Management API
This entry point connects shared Central API access to a harmless read test and clear version, pagination, throttling, and write-operation boundaries.
Authenticate the Sophos Email API and route to the correct tenant
This workflow protects the Client Secret and token, validates the Who-am-I identity, and couples every Email request to the correct tenant ID and data …
Automate Sophos Email mailboxes with the API
A safe mailbox lifecycle covering search, pagination, CRUD, aliases, delegates, distribution-list owners and bulk-sender requests.
Manage Sophos Email quarantine through the API
A controlled API workflow for search, pagination, preview, URLs, attachments, downloads, strip/reattach, bulk actions, and error handling.
Manage Sophos Email Post-Delivery Quarantine through the API
A tenant-scoped API workflow for search, preview, attachments, download jobs, release, deletion, state validation, and partial failures.
Run and verify Sophos Email clawback through the API
This runbook covers single and multiple clawback with x-sophos-email-id, tenant-scoped requests, status polling, partial failures, throttling, and …
Automate Sophos Email S/MIME through the API
A safe lifecycle runbook with exact API paths, payloads, validation, and safeguards for the destructive S/MIME reset.