What's new

UK serving site launch

Besides the seven existing serving sites, Trend Micro Email Security opens a new site in the United Kingdom, which is available for customers from the Licensing Management Platform only.

Starting September 30, 2025, Microsoft Teams will begin validating meeting join URLs. Rewritten or modified URLs may be treated as malicious, which could interfere with email delivery and link protection features. To prevent false positives and ensure uninterrupted access to legitimate Teams meetings, Trend Micro Email Security automatically bypasses URLs from teams.microsoft.com in Time-of-Click Protection.

This update helps maintain seamless meeting access while preserving accurate threat detection—no configuration required.

Improved Quarantine Query

Trend Micro Email Security offers enhanced quarantine query capabilities. These include full wildcard support across both the user and domain parts of email addresses, as well as the ability to filter by header sender and recipient fields. These updates make it easier to locate quarantined emails with greater flexibility and precision.

Customizable Notifications for Default Global Outbound Virus and Spam Policy Rules

Administrators with "Security Policy" permission and "My Organization" scope can now customize notification settings for default global outbound policy rules in Virus Scan and Spam Filtering. Options include enabling notifications, selecting notification templates, and configuring BCC recipients. This enhancement improves operational flexibility for security teams. For example, it allows them to alert internal stakeholders more effectively without compromising global protection rules.

Header Sender Field Added to Log Export

To improve traceability and analysis, Trend Micro Email Security now includes the "Email Header (From)" field in both log views within the console and exported CSV files for mail tracking accepted logs and policy event logs. Whether exporting selected entries or the full log, users can now view header sender data directly.

DMARC Report Analysis Result Export Enhancements

Trend Micro Email Security now allows administrators to export DMARC report compliance check details into CSV files directly from the console, either by selecting specific records or exporting all filtered results. Exporting selected records happens instantly, while exporting all results triggers an export task. This streamlined export process improves efficiency, supports faster data analysis, and enables easier day-to-day follow-up and reporting.

New Tokens in Notifications and Stamps for Header Sender Information

Trend Micro Email Security includes a new token, %HEADER_SENDER%, which administrators can use in email notifications for policy matches and in message body stamps. This token retrieves the sender address from the message header—rather than the envelope—providing a more accurate representation of the sender in certain scenarios. It serves as an alternative to the existing %SENDER% token.

Sanitize Attachments Action Available for PDF Files

Trend Micro Email Security enhances its "Sanitize attachments" action in Content Filtering policy to remove active content from PDF files, in addition to the previously supported Microsoft Word, Excel, and PowerPoint attachments.

Enhanced Security Check Management for Approved Senders

Trend Micro Email Security extends its Bypass Checks for approved senders in Sender Filter Settings. In addition to the existing Connection Filtering and Spam Filtering criteria, this enhancement allows administrators to determine whether to apply security risks and anomalies scanning on emails from approved senders. This provides a more comprehensive and robust security framework, ensuring that even approved senders are subject to advanced threat detection and mitigation.

Enhanced File Scanning with Virtual Analyzer Nominated by Correlated Intelligence

Trend Micro Email Security allows administrators to decide whether to send files that are identified as suspicious by Correlated Intelligence to Virtual Analyzer for further analysis. Administrator can also specify the security level for configured actions based on Virtual Analyzer’s scan results. This feature enhances file scanning robustness, ensuring more thorough threat detection and improved security.

This feature is available only in the Trend Micro Email Security Advanced license.

Detection Signal Customization for Correlated Intelligence

In addition to predefined detection signals for Correlated Intelligence, Trend Micro Email Security allows administrators to define custom signals by using predefined conditions to meet specific security needs. These custom signals can then be incorporated into correlation rules, enhancing the detection capabilities of Trend Micro Email Security within the customer’s unique environment.

Phishing Simulation Integration Available for the Japan Site

Trend Micro Email Security now supports phishing simulation integration for the Japan site, letting administrators decide whether to bypass inbound protection scans for Trend Micro phishing simulation emails.

Enhanced Domain Management for Reports

Trend Micro Email Security allows administrators to configure report settings and view generated reports only for the domains they have permission to manage. This enhancement ensures that email traffic and threat detection data in reports are accessible only to authorized administrators, providing better control and security.

New Tokens in Notifications and Stamps for Detections by Correlated Intelligence

Trend Micro Email Security includes two new tokens - %CI_RULE_NAME% and %CI_RULE_DESC%, that administrators can use in email notifications for policy matches and in stamps inserted into the message body. These tokens help identify which security risks or anomalies have been detected by Correlated Intelligence, providing clearer and more detailed information in your email security alerts.

Custom Correlation Rules for Anomaly Detection Available in Correlated Intelligence

Besides the Trend Micro predefined correlation rules, administrators can add custom correlation rules based on predefined detection signals to accommodate anomaly detection requirements in their environment. Administrators can apply custom correlation rules into the Correlated Intelligence policy and view details about detected anomalies in policy events logs. Furthermore, Trend Micro Email Security offers flexibility by enabling administrators to select all or specific predefined correlation rules to detect suspicious emails and possibly unwanted emails.

Boost Brand Visibility with BIMI

Trend Micro Email Security enhances your DMARC enforcement with Brand Indicators for Message Identification (BIMI), allowing you to display your brand’s logo in recipient inboxes. Administrators can verify if their published BIMI records are correctly set up and active, or they can create a BIMI record and preview it in the administrator console before publishing it in DNS. This feature helps increase your brand visibility and builds customer trust.