Risky Policies Detection and Remediation in Email Gateway Defense
Email Gateway Defense (EGD) displays a notification banner when risky policy configurations are detected for your tenant. This release focuses on exemptions involving domains that are frequently targeted for impersonation and phishing. A policy may be flagged whether it allows an entire domain, a wildcard or subdomain pattern, or a specific sender address associated with one of these domains.
These types of exemptions can bypass security controls that would otherwise evaluate the message. Many were created historically to address deliverability issues, before SPF, DKIM, and DMARC were as widely adopted as they are today. Most major legitimate senders now authenticate their mail using one or more of these standards, which can reduce the need for persistent sender exemptions.
Detection runs across account-level, domain-level, and user-level policies.
These domains were selected because they are high-value impersonation targets and include many of the brands most frequently abused in phishing campaigns. EGD currently identifies sender exemptions involving the following domains as risky:
barracuda.combarracudanetworks.commicrosoft.comintuit.comgoogle.comdocusign.netamazon.comnetsuite.comapple.comzoom.uslinkedin.comdropbox.comsf-notifications.comadobesign.compaypal.comsharepointonline.commailchimp.comukg.comquickbooks.com
However, there may be cases where an exemption is required for a specific business reason. Before removing an exemption, review any user-specific mail-flow requirements or integrated applications that may depend on the existing policy.
Where the Banner Appears
A Risky Policies Detected banner appears at the top of all pages in the EGD admin console when risky policies are detected.
The banner remains visible as long as risky policies are unresolved. If you choose not to take action, the banner reappears on your next login.
Banner changes, such as new risky policies being detected or all policies being remediated, are reflected after you refresh the page.
How to Remediate Risky Policies
To remediate, click Improve email security by removing them in the Risky Policies Detected banner. This opens the Risky Policies page in Email Protection, a separate Barracuda experience for managing email security policies.
Review to see which rules are affected and at which levels (account, domain, user). For user-level sender policies, the associated user is displayed alongside the policy details. This allows you to identify and contact the affected user before removing the policy.
Delete all – Removes all flagged policies across all levels for the tenant you are currently managing.
Delete individually – Click the trash can icon next to any specific policy to remove it on its own.
Note: Deletion cannot be undone.
If removal partially fails, for example, due to a permission issue at one policy level, an alert appears and policies that could not be deleted return to their default state. The banner will continue to appear if some risky policies remain or a recheck finds qualifying policies.
For the full step-by-step remediation instructions, see Risky Policies Detection and Remediation.
Best Practices
Replace broad allow rules (for example, wide wildcards) with specific, verified senders or domains.
Use authentication-based controls (SPF, DKIM, DMARC alignment) instead of blanket allow lists.
Review exceptions regularly and remove unused or legacy entries.
Consult the EGD Best Practices Guide for recommended configuration settings and optimization tips.
Notes
Detection runs automatically – No configuration is required. Only administrators with access to Email Protection can modify or remove flagged policies. Changes take effect after you save your updates on the Email Protection Risky Policies page.
No automatic remediation – Email Protection does not delete or modify risky policies without your explicit confirmation.