# Email Security > Baselines that configure Exchange Online mail flow and anti-malware, anti-phishing and anti-spam protections. Email Security's fifteen baselines configure Exchange Online Protection and, where a tenant is licensed for it, Microsoft Defender for Office 365: the layers that inspect mail before it reaches a mailbox. They also cover the transport-level settings that control what the tenant's own mail flow is allowed to do. ## Why it matters Email is still the most common way in: a phishing link, a malicious attachment, a spoofed sender posing as someone the recipient trusts. It's also the most common way data quietly leaves, through a mailbox rule that forwards everything out once an account is compromised. Microsoft 365's built-in anti-malware and anti-spam protection can't be turned off, but the policies that decide how aggressively to act, what to quarantine or deliver, and whether auto-forwarding or unauthenticated mail relay are allowed are all configurable, and the defaults aren't always the tightest available. ## How Microsoft evaluates it Anti-malware, anti-spam and anti-phishing are separate Exchange Online Protection policy types. Each pairs conditions (which recipients it covers) with an action for each verdict, and policies are evaluated in priority order as a message moves through mail flow, before delivery. Anti-malware scanning can't be switched off; anti-spam and anti-phishing can be tuned, and once Microsoft's Standard or Strict preset security policy is on, its fixed, Microsoft-managed thresholds take precedence over custom policies. Safe Attachments and Safe Links are separately licensed Defender for Office 365 features layered on top, which detonate attachments and re-check links when they're opened rather than only at delivery. Direct Send, SMTP client submission, auto-forwarding and DKIM signing are tenant-wide mail-flow settings rather than filtering policies, checked against the tenant's configuration rather than per message. ([Microsoft Learn: Built-in security features for all cloud mailboxes](https://learn.microsoft.com/defender-office-365/eop-about), [Anti-spam protection in cloud organizations](https://learn.microsoft.com/defender-office-365/anti-spam-protection-about)) ## What end users experience Depending on the quarantine policy behind the verdict, a quarantined message may never reach the user, or may arrive with a notification. High-confidence phishing is always quarantined, with no option to deliver it. Safe Links rewrites every link, so each click goes through a Microsoft check first, and a dangerous destination shows a warning page instead. Safe Attachments can delay a message while its attachment is detonated: a pause the user doesn't see, rather than a warning. Blocking auto-forwarding or Direct Send stops any forwarding rule a user (or an attacker in their account) had set up; the next attempt fails. DKIM signing and disabling legacy SMTP access are invisible to users, because they change how mail is authenticated and sent, not anything a mailbox owner sees. | Baseline | Scope | Licence | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------------- | | [Anti Malware Policy (Default)](https://docs.octiga.io/baselines/email-security/anti-malware-policy/) | Tenant | — | | [Anti Spam Inbound Policy (Default)](https://docs.octiga.io/baselines/email-security/hosted-content-filter-policy/) | Tenant | — | | [Automatic Forwarding - Block](https://docs.octiga.io/baselines/email-security/auto-forward-block-transport-rule/) | Tenant | — | | [Default Hosted Outbound Spam Filter Policy](https://docs.octiga.io/baselines/email-security/hosted-outbound-spam-filter-policy/) | Tenant | — | | [Direct Send](https://docs.octiga.io/baselines/email-security/org-direct-send/) | Tenant | — | | [DKIM Signing For Default Domain](https://docs.octiga.io/baselines/email-security/dkim-signing-config/) | Tenant | — | | [Mail Auto Forwarding](https://docs.octiga.io/baselines/email-security/org-auto-forwarding/) | Tenant | — | | [Malicious Attachment Types Filter Policy - DEPRECATED](https://docs.octiga.io/baselines/email-security/malware-file-types-filter-policy/) | Tenant | — | | [Malware Internal Sender Filter Notification Policy - DEPRECATED](https://docs.octiga.io/baselines/email-security/malware-internal-sender-filter-notification-policy/) | Tenant | — | | [Preset EOP Policy (Standard)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-standard/) | Tenant | — | | [Preset EOP Policy (Strict)](https://docs.octiga.io/baselines/email-security/preset-eop-protection-policy-rule-strict/) | Tenant | — | | [Safe Attachments Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-attachment-policy/) | Tenant | Defender for Office 365 | | [Safe Links Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-links-policy/) | Tenant | Defender for Office 365 | | [SMTP Access](https://docs.octiga.io/baselines/email-security/org-smtp/) | Tenant | — | | [Standard Default Anti Phishing Policy](https://docs.octiga.io/baselines/email-security/anti-phish-policy/) | Tenant | — |