What is Email Filtering?
Email Filtering is the process of automatically inspecting, assessing and, where necessary, blocking, quarantining or modifying inbound and outbound email so that malware, phishing, spam and forged senders do not reach users and systems. An email filter combines checks on the sender, the connection, the content, attachments and links, and decides per message what happens to it. In OT environments, email filtering is not a control on the process control system itself, but a line of defence around the people and workstations that do have access to that control system.
Email has for years been one of the main starting points of attacks on industrial organisations. Protecting the inbox of a maintenance engineer indirectly protects the engineering station, the historian and the remote access environment as well.
🎯 Why is email filtering important for OT?
PLCs, SCADA servers and field devices rarely send or receive email. The systems and people around them do: engineering laptops, maintenance staff, buyers who correspond with suppliers and administrators with access to the office network. A successful attack on any of them is often the first step towards the production environment.
| Email-based target | Impact in an OT context |
|---|---|
| Engineering laptops | Installation of malware, remote access trojans (RATs) or keyloggers that later travel into the OT network |
| Management portals or web HMIs | Credential harvesting for Remote Access and VPN accounts |
| Maintenance staff | Social engineering about firmware updates, faults or system access |
| Suppliers and supply-chain partners | Abuse of supply chain risk through hijacked supplier mailboxes and infected attachments |
| Finance department | Invoice or CEO fraud that costs money and often precedes further attacks |
The knowledge base MITRE ATT&CK for ICS lists Spearphishing Attachment (T0865) as an initial access technique. Well-known examples are the BlackEnergy campaign against energy companies, in which Word attachments with macros were sent months before the Ukrainian power outages of 2015, and groups such as Lazarus and OilRig that targeted energy and industrial companies with malicious Office documents.
🧠 How does an email filter work?
A modern email filter, whether a cloud gateway, an on-premises appliance or built into the mail platform, processes each message in several layers:
- Connection checks - reputation of the sending IP address, blocklists and rate limiting.
- Sender authentication - SPF, DKIM and DMARC checks to detect spoofing of the sender domain.
- Content analysis - rules and scores for spam, phishing indicators and suspicious language. The open-source filter SpamAssassin uses a default threshold score of 5.0 to classify a message as spam.
- Attachment checks - blocking executable files, antivirus scanning and detonating unknown files in a sandbox.
- Link analysis - checking URLs against reputation databases, often with rewriting so the link is checked again when clicked (see URL Filtering).
- Verdict - deliver, tag, quarantine or reject, with logging for analysis.
| Filtering type | What it does |
|---|---|
| Spam filtering | Blocks bulk and unsolicited email based on reputation and content |
| Phishing detection | Recognises messages that try to steal credentials or impersonate a known party |
| Malware filtering | Scans attachments and linked files for viruses, ransomware and trojans |
| URL filtering | Blocks or rewrites links to suspicious or malicious websites |
| Attachment policy | Restricts permitted file types, such as .exe, .js, .bat and macro-enabled files |
| Content filtering | Applies rules to keywords, scripts and sensitive data, including in outbound mail |
🔐 What role do SPF, DKIM and DMARC play?
Sender authentication is the part of email filtering that stops forged senders. An attacker pretending to be your automation supplier is much easier to catch this way.
| Standard | RFC | What it checks |
|---|---|---|
| SPF | RFC 7208 | Whether the sending IP address is authorised to send mail on behalf of the domain |
| DKIM | RFC 6376 | Whether the digital signature in the header is valid, so content and domain have not been forged |
| DMARC | RFC 7489, succeeded by RFC 9989 in May 2026 | Whether SPF or DKIM aligns with the visible sender domain, and what the receiver should do when the check fails (none, quarantine or reject) |
| STARTTLS and DANE | RFC 3207 and RFC 7672 | Whether the connection between mail servers is encrypted with TLS and uses the correct certificate, anchored in DNS |
The Dutch Standardisation Forum (Forum Standaardisatie) has placed SPF, DKIM, DMARC and STARTTLS with DANE on its ‘comply or explain’ list, so Dutch government bodies must apply them when procuring and managing mail systems. Large mailbox providers enforce them too: since February 2024 Google and Yahoo require bulk senders to use SPF, DKIM and a DMARC record (for Gmail the threshold is 5,000 messages a day), and Microsoft followed with similar requirements for Outlook.com in May 2025. The free test at internet.nl quickly shows how your own domain measures up.
🔧 How do you set up email filtering in an industrial organisation?
A practical step-by-step approach:
- Map the mail flows - which systems send mail (alarm notifications, reports from the historian, scanners) and which suppliers correspond with your engineers.
- Publish SPF, DKIM and DMARC - start with DMARC p=none to collect reports and progress via quarantine to reject.
- Set a strict attachment policy - block executables and scripts, quarantine encrypted archives and keep Office macros in internet files blocked. Since 2022 Microsoft has blocked these by default in Office for Windows, based on the Mark of the Web attribute.
- Use sandboxing and link checks - for unknown attachments and for links that only turn malicious after delivery.
- Provide a secure route for supplier files - firmware, project files and patches should not arrive by email, but through a controlled exchange zone in the IDMZ with scanning and hash verification.
- Keep email out of the OT network - guidance such as NIST SP 800-82 advises against allowing email and direct internet access from the control network. Engineers read their mail on an office workstation and work in the OT environment through a jump server.
- Connect to detection and response - forward filter logs to the SIEM, combine with EDR on endpoints and give users a report button.
Email filtering fits the duty of care in the Dutch Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026 as the Dutch implementation of NIS2, and the requirement for malicious code protection (SR 3.2) in IEC 62443-3-3.
🛡️ Which measures strengthen an email filter?
| Measure | Explanation |
|---|---|
| MFA for email accounts | Reduces the impact of stolen credentials; phishing-resistant variants also help against fake login pages |
| Threat Intelligence integration | Recognises known malicious domains, hashes and other IOCs |
| Outbound filtering | Prevents a hijacked account from sending spam or malware on behalf of your organisation |
| External sender tagging | A warning banner on mail from outside makes impersonation of colleagues less convincing |
| Security Awareness training | Staff, including operators and technicians, learn to recognise and report suspicious messages |
| Quarantine and incident process | Suspicious email is handled safely according to the Incident Response Plan |
No filter stops everything: a targeted attack from a genuine, hijacked supplier account passes SPF, DKIM and DMARC. That is why email filtering is one layer in a Defense in Depth strategy, alongside segmentation, least privilege and monitoring.
🚫 Which email-based attack techniques are common?
| Technique | Example in an OT context |
|---|---|
| Spear phishing | Targeted email to an OT engineer about an urgent SCADA patch |
| Supplier impersonation | Fake email in the name of a supplier with a “firmware-update.zip” |
| Malicious macro | Office document that installs a backdoor once macros are enabled, as with BlackEnergy |
| Malicious link | Link to a tool download with a hidden RAT or to a fake login page |
| Spoofed domains |
Email appears to come from support@automation-vendor.com, but comes from a lookalike
domain
|
❓ Frequently asked questions
What is the difference between email filtering and a spam filter?
A spam filter only targets unwanted bulk email. Email filtering is broader and also covers phishing detection, malware scanning, sender authentication with SPF, DKIM and DMARC, link checks and filtering of outbound mail.
Is email filtering needed if OT systems do not use email?
Yes, because attackers usually reach OT through people and office workstations that do receive email. Email filtering reduces the chance that an engineering laptop or administrator account is compromised and then used as a stepping stone to the process control system.
Does DMARC stop all phishing?
No, DMARC only prevents someone from forging the exact sender domain of your organisation. Phishing from lookalike domains or from hijacked, genuine supplier accounts requires additional filtering, link checks and vigilant staff.
Should suppliers send firmware or project files by email?
Preferably not, because attachments are hard to verify for authenticity and email is a favourite route for attackers. Have suppliers deliver files through a controlled exchange environment in the IDMZ, where they are scanned and checked against a published hash.
What is sandboxing in email filtering?
Sandboxing means the email filter first opens an unknown attachment or link in an isolated virtual environment and observes its behaviour. Only when no malicious activity is detected is the message delivered, which helps against new malware that antivirus does not yet recognise.
Does email filtering fall under the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act does not prescribe a specific product, but requires essential and important entities to take appropriate measures against cyber risks. Email filtering with sender authentication and malware protection is a common way to meet that duty of care, because email is one of the most used attack routes.
📌 In summary
Email filtering protects the people and workstations around the process control system against phishing, malware, spam and forged senders. A good filter combines connection checks, SPF, DKIM and DMARC, content and attachment analysis, sandboxing and link checks, and is complemented by MFA, training and a secure route for supplier files.
Email filtering is a first line of defence against attacks on OT: it stops APTs, supply chain attacks and human error before they reach the engineering workstation, the remote access environment or the process control system through the inbox.