Checks sender identity
The engine compares sender names, addresses and reply paths for impersonation signals.
CloudCastle Email Security
Email analysis from several perspectives
Code-verified: sender, intent, URL and attachment analysis mechanisms. Unmeasured: customer protection, processing speed and provider compatibility. These checks can miss threats and flag benign mail.
Launch remains NO-GO. On 10 September 2026, an authenticated read-only configuration query observed one enabled gateway domain: the owned cloudcastle.ai domain. This is not external SMTP delivery proof or customer acceptance. Capability disclosures.
Six analysis perspectives
Email verdict
Benign · suspicious · malicious
The short version
What Email Security does for you
The following are code-level analysis paths, not a promise that every message is inspected or detected before a recipient acts.
Analyzes the request
Intent analysis looks for password theft, invoice, payroll and gift-card scam patterns; classification is not guaranteed.
Checks links and files
URL and attachment checks feed the verdict. Connected-mailbox analysis is post-delivery; gateway mechanisms are not evidence of customer pre-delivery protection.
Complementary analysis
Message context. Layered inspection.
Code-verified: independently implemented analysis paths. Comparative speed, efficacy and vendor parity are unmeasured.
Code-verified: message analysis
Inspect message context
- ONNX language models classify BEC and phishing intent
- Computer vision compares logos and extracts supported QR images
- Header alignment checks display-name, Reply-To and envelope differences
- Independent engines run concurrently under individual time budgets
Code-verified: layered inspection
Keep checking after the first scan
- URL defense checks rewritten links when enabled and followed
- YARA and ClamAV attachment checks depend on engine availability
- Bounded recursive archive inspection checks supported nested contents
- Reputation feeds, DNS blocklists and lookalike-domain detection corroborate risk
These are implementation descriptions, not an industry benchmark or a claim of parity with another vendor.
The scanning pipeline
Six views of the same email. One explainable verdict.
Code-verified: engine status, latency and findings feed aggregation. An unavailable engine reduces coverage; a benign verdict is not proof a message is safe.
Message reputation
Rspamd scores spam, sender authentication and known message patterns. CloudCastle adds its own header-alignment and VIP-identity checks even if Rspamd is unavailable.
Language intelligence
An ONNX intent model classifies credential phishing, invoice fraud, payroll diversion, gift-card scams, extortion and malware lures. Deterministic context signals corroborate the model.
Computer vision
OpenCV perceptual hashes compare embedded images with a brand-logo database. Rectangle-density and QR-extraction heuristics provide signals, not guaranteed login-form or quishing detection.
URL defense
Threat feeds, Spamhaus DBL, SURBL and URIBL checks are combined with homoglyph and edit-distance detection for typosquatted domains. Every rewritten link is signed, scoped and expiring.
Attachment analysis
YARA and ClamAV scan attachments and bounded archive contents. Macro-capable and executable files are flagged in the report so the verdict explains exactly which file raised the risk.
Weighted verdict
The weighted aggregator combines every layer’s evidence into one score, records the contribution each engine made, and returns benign, suspicious or malicious with the reasoning attached.
Business email compromise
BEC can lack malware. Context still matters.
A forged request from the boss can be technically clean: no malicious file, no bad link, and valid SPF for the attacker’s own domain. CloudCastle looks at identity, intent and context together.
- VIP impersonation: a protected executive or help-desk name must come from its registered domain, including common homoglyph tricks.
- Routing deception: From, Reply-To, Return-Path and SMTP envelope domains are compared independently.
- Financial intent: invoice, wire-transfer, payroll and banking-change language is classified separately from ordinary spam.
- Correlated evidence: urgency, authority, credential requests and domain mismatch contribute to scoring; false positives and misses remain possible.
Code-verified analysis categories
More than a spam score
These categories describe analysis inputs, not measured coverage of every attack class.
Credential theft
Language, URL and vision paths provide signals for credential-lure analysis.
Bulk and nuisance mail
Rspamd, authentication and reputation signals contribute to spam scoring when available.
QR-code attacks
OpenCV attempts QR extraction from supported embedded images. This does not eliminate image-based bypasses.
Weaponized files
YARA, ClamAV and bounded archive inspection analyze supported attachments when available.
Late-armed websites
Enabled URL defense checks rewritten links at click time. Expiring HMAC tokens bind URL and tenant, and recipient where available.
Lookalikes and copied logos
Homoglyph folding, edit distance and perceptual matching supply lookalike signals, not guaranteed detection.
Deployment
Your email service, named
Unmeasured customer readiness: the paths below describe code and configuration options, not approved customer deployment choices. Each requires exact-mode acceptance, authorization and rollback evidence.
Microsoft 365 mechanisms
Gateway and mail-flow connector code paths differ from the post-delivery Graph connector. Provider configuration and permissions determine the applicable path.
Customer mail flow, tenant-wide coverage and pre-delivery outcomes are unmeasured.
Google Workspace mechanisms
Gateway configuration and post-delivery Gmail API integration are separate paths. API integration requires customer-authorized service-account delegation.
Customer compatibility, permission scope and recovery remain unmeasured.
SMTP gateway mechanisms
Gateway code supports filtering and onward SMTP or LMTP transport. The owned-domain gateway configuration observation does not prove Internet mail acceptance or delivery.
No customer gateway launch authorization or domain-wide protection is claimed.
Cloudflare Email Worker mechanism
The worker integration submits mail for analysis before its forwarding decision. This path does not rewrite message bodies for click-time URL checks.
Customer forwarding, refusal behavior and recovery are unmeasured.
Connected mailbox (IMAP)
The IMAP path reads a selected mailbox after delivery and can request quarantine moves where provider permissions support them.
Delivery-to-scan delay, successful moves, outages and backlog recovery are unmeasured in customer environments.
Personal-mailbox compatibility
Provider discovery and connection interfaces exist, but a provider preset is not proof of working authentication, complete coverage or reversible quarantine.
Confirm the exact provider, permissions and rollback path before any authorized evaluation. No provider-count or scan-speed promise is made.
Discuss an evidence-bound email evaluation
Customer acceptance remains unmeasured. Define the mailbox, mode, consent and recovery requirements before deployment.
Simple pricing: a monthly minimum plus per inbox — see pricing.