Sophos Email Plus

Sophos Email Plus protects business mailboxes against spam, malware and phishing. The enhanced licence includes the full protection of Sophos Email and adds 90-day message history and quarantine, message replay and an integrated DMARC Manager. IT teams gain more time to investigate suspicious activity, make important messages accessible again and protect their email domain against misuse.

Detect attacks before they cause harm

An email attack does not always contain an obvious attachment. A convincing payment request can also be dangerous. Sophos Email Plus therefore examines attachments, links, message content and signs of sender impersonation. This helps counter phishing and Business Email Compromise: fraud in which attackers impersonate management or business partners, for example. Phishing simulations and training with Sophos Phish Threat are also included.

More time to investigate an incident

Suspicion often arises days or weeks after an email arrives. Sophos Email Plus retains message history and quarantine for 90 rather than 30 days. This gives teams longer to establish which message was processed and how Sophos classified it. Quarantined emails also remain available for review longer. This extends the investigation window; it does not replace email archiving or a backup.

Deliver important emails again

An accidentally deleted message or a temporary mail server issue need not mean asking the sender to resend everything. Message Replay can trigger redelivery of incoming messages accepted by Sophos within the last 90 days. Messages already delivered are sent as attachments to a new message. Emails rejected by Sophos on receipt are excluded. The Sophos redelivery documentation explains the supported message statuses.

Recall forwarded threats in Microsoft 365

When a dangerous email is forwarded internally, removing only the original message may not be enough. Contact Trace and Recall also tracks internally forwarded copies in Microsoft 365 and enables their recall. IT teams can act selectively; copies are also included automatically when automatic search and remediation are appropriately enabled. This requires a Microsoft 365 domain connected for post-delivery protection. Copies held by external recipients are not recalled.

Protect your domain against impersonation

The business domain can be misused for fraud outside its own mailboxes too. The included DMARC Manager shows which services send email on behalf of the domain and whether messages are authenticated correctly. DMARC is a standard for verifying the sender domain. Reports help identify legitimate sending services, correct misconfigurations and introduce a policy against impersonation. The domain and its DNS records must be configured accordingly.

When Sophos Email Plus is a good fit

Sophos Email Plus suits businesses that need more investigation and follow-up capabilities alongside email protection, or want to secure their domain with DMARC. Sophos Email supports Microsoft 365 and Google Workspace, among other platforms; recall of internally forwarded copies is limited to Microsoft 365. Both the required features and the existing email environment therefore matter when choosing a licence.

The users and shared mailboxes to be protected are licensed. Aliases and distribution lists do not need an additional licence. DMARC Manager is already included in Plus; portal-based encryption remains a separately licensed add-on.