Auto-Quarantine Emails When a Domain's Trust Score Drops in Real Time

Inboxes across Australian businesses are getting hammered by spoofed invoices, fake Australia Post tracking alerts, and ATO impersonation emails that slip past legacy filters. When a sender's reputation suddenly nosedives, security teams in Sydney or Perth often only find out after the damage is done. A real-time quarantine policy tied to a live trust score lets you act the moment a domain starts looking dodgy, rather than waiting for a post-mortem.

Most mail gateways still rely on static blocklists and DKIM pass/fail checks that don't reflect what is happening on the wire right now. Pairing those controls with continuous sender scoring closes the gap between "passed authentication" and "actually trustworthy." The sections below walk through building a quarantine rule that reacts the instant a score crosses a line you control.

Why Real-Time Score Drops Matter for Aussie Inboxes

Australian organisations sit in a peculiar spot. Local telcos and ISPs see huge volumes of phishing targeting super funds, myGov logins, and ATO refunds, and many of the senders look legitimate until their infrastructure is hijacked. A sudden drop in a domain's trust score often signals that a marketing platform has been compromised, a sending IP has landed on a major blocklist, or SPF and DKIM alignment has silently broken.

The Australian Cyber Security Centre regularly reminds businesses that a single spoofed email reaching a CFO can derail an entire quarter, particularly when it carries a fake invoice from a known supplier. Catching the moment a score moves from "trusted" to "suspicious" means you can quarantine mail before it lands in that CFO's inbox in Brisbane or Adelaide.

You can start by reviewing how spoofed emails move through your environment using the incident response API guide, which shows how to pull live signals into your detection pipeline. Treat those signals as the heartbeat of the policy you are building.

Picking Quarantine Thresholds That Match Your Risk Appetite

Not every dip warrants a quarantine. A score dropping from 95 to 80 might just mean a sending service rotated IPs overnight, while a plunge from 90 to 30 typically means a domain has been weaponised. The trick is to define two or three bands and assign a different action to each.

A sensible starting point for an Australian SMB: quarantine anything below 40, tag for review anything between 40 and 70, and let everything above 70 flow normally. Adjust the bands based on the false positives you see during the first fortnight. If your finance team in Melbourne cannot receive supplier invoices, your lower bound is too aggressive.

Document the thresholds in your security runbook alongside references to the ACSC's email hardening guidance so the rationale survives a staff change. This also makes audit work easier when you need to explain why a particular message was held back during a post-incident review.

Building the Rule Inside Your Mail Gateway

Once thresholds are set, encode them as a transport rule. In Microsoft 365, this means a mail flow rule that inspects a custom header added by your scoring integration. In Proofpoint or Mimecast, it maps to a smart host filter or an advanced content filter checking message headers.

The rule should stamp the message with an X-Quarantine-Reason header, redirect it to a dedicated quarantine mailbox, and notify the security contact. Keep the quarantine separate from junk mail so admins can quickly triage. Avoid silently deleting anything based on score alone, because that destroys forensic value and can break legitimate retries if a sender's reputation recovers.

If you want a concrete example of how header inspection works alongside DMARC data, the DMARC report guide shows how unauthorised sending services often reveal themselves through misaligned signatures, which usually correlates with a collapsing trust score.

Wiring Up the Live Scoring API

The real magic happens when your gateway polls the scoring engine and writes the current score into a header or custom attribute on every inbound message. Trusted Sender Score offers a developer endpoint that returns a numeric reputation along with component signals such as DKIM pass rate, DMARC alignment, and recent blacklist hits. Cache the response for a few minutes to avoid hammering the API.

Store the response in a header like X-SenderTrust-Score so your transport rule has a single value to compare. For high-volume environments, batch the lookups by queuing messages briefly and scoring them in groups, and your gateway in Mascot will thank you for the lower latency.

You can get started on the main platform and review the API documentation directly on Trusted Sender Score.

Handling Exceptions and Manual Overrides

Even the best policy will occasionally trap a legitimate supplier. Build a simple allowlist that overrides the quarantine rule for domains you have explicitly vetted, and pair it with a short justification field so the override is auditable. Send a weekly digest of overrides to your security lead so patterns emerge before they become blind spots.

Remember that Australian privacy obligations under the Notifiable Data Breaches scheme can kick in if a spoofed email causes a credential leak that you should have prevented. Logging every quarantine decision, including the score, the action taken, and the analyst who released the message, gives you the evidence trail you need if the OAIC ever comes knocking.

Testing, Tuning, and Keeping the Policy Honest

Roll the policy out in audit mode first, where messages are scored and tagged but not quarantined. Spend at least a week reviewing the false positive rate, paying particular attention to Australian senders such as banks, hospitals, and government agencies that sometimes share sending infrastructure. Once you are happy with the hit rate, flip the rule to quarantine mode and watch the queues.

Schedule a monthly review. Spammers shift tactics faster than any static rule can keep up, so revisit your thresholds, allowlist, and the weight your scoring engine gives to DKIM, SPF, and DMARC. Treat the policy as a living document rather than a set-and-forget control that quietly rots in the background.