Connection & reputation
Senders on Spamhaus ZEN are turned away before they can send anything. Spamhaus DBL, ZRD and the hash blocklist then check every domain, link and file.
Email security as a service
Stops bad mail and explains every decision.
Obsidian Email Security protects Microsoft 365, Google Workspace and Exchange. Every message goes through Spamhaus reputation, antivirus, authentication and content checks, and an AI model reviews the uncertain ones. We run the service; you point your mail at it. There is nothing to install.
- Spamhaus DQS
- ClamAV
- SPF · DKIM · DMARC
- AI
Operated by Integrators Resource, Minneapolis.
Protects
Microsoft 365
Google Workspace
Exchange Server
01Layered protection
Seven kinds of check, one score
Each check adds points for suspicious findings and removes points for reassuring ones. Your policy sets the thresholds. If one check breaks, the rest still decide, so mail is never lost.
Sender authentication
SPF, DKIM, ARC and DMARC with proper alignment. A spoof of a domain that publishes p=reject gets caught even when the sender is on your allow list.
Antivirus
ClamAV scans every message and attachment. Sanesecurity's third-party signatures add coverage for phishing and malware campaigns.
Attachment policy
Blocks dangerous file types, including ones hidden inside archives. You choose whether Office macros and password-protected archives are quarantined, scored or allowed.
Links & impersonation
Flags links whose visible text points somewhere other than where they really go. Also catches lookalike domains and outsiders using the display name of one of your VIPs.
Content & Bayes
Heuristic rules look for BEC language, payment requests and urgency. A Bayesian filter learns from what your users report and release.
AI review
For mail the rules can't settle, a language model on our own servers reads the message and its technical facts. It returns a verdict and its reasons.
Every message ends with a verdict:
cleanbulkspamphishbecvirusmalwarepolicy
02How it works
In front of your mail server, or beside it
Send your mail through Obsidian, connect it to your mailboxes through each platform's API, or both. The same checks, policies and quarantine apply either way. Nothing runs on your side.
Gateway mode
Point your MX at Obsidian
Change your MX records to mx1.obsidiansuite.net. Mail arrives at Obsidian first, is filtered during the SMTP conversation and is relayed to your mail server over TLS.
- Connection screeningPostfix postscreen turns away senders listed on Spamhaus ZEN.
- ScanAll seven checks run while the sender is still connected, so rejected mail bounces back to the sender.
- DecideDeliver, tag for Junk, quarantine, reject, or hold for AI review.
- DeliverClean mail goes on to Exchange, Microsoft 365 or Google over TLS. Outbound mail can route back through Obsidian too, so it is checked before it leaves.
API mode
Connect the mailboxes
You grant Obsidian access to your tenant through Microsoft Graph, a Google Workspace service account or Exchange Web Services.
- Directory syncUsers and their aliases come from Entra ID, Google or Active Directory, so Obsidian knows which addresses really exist.
- Mailbox scanningMessages are read and scored in place, with no change to your MX records.
- ClawbackIf a delivered message later turns out to be phishing, it is pulled back out of every mailbox it reached.
- Single sign-onUsers sign in to their portal with their Microsoft or Google account.
03The console
Triage a threat without leaving the dashboard
The dashboard follows mail from arrival to quarantine, with trend lines for the last 24 hours, 7 days or 30 days. The volume chart can put threats on their own axis, so a handful of phishing messages is never flattened by thousands of clean ones.
- Message inspector. Click a threat to open it beside the dashboard: the envelope, SPF, DKIM and DMARC results, the AI verdict, every rule that scored it, and the key headers. Block the sender or release the message from there.
- Search from anywhere. Press Ctrl + K on any page to jump to a section, or paste an address or message ID to trace it.
- Built-in self-tests. One click runs the EICAR test file through every stage. System health checks the Spamhaus test entries and warns when something between the gateway and the internet intercepts DNS.
04AI that shows its work
A second opinion that stays in our infrastructure
Obsidian asks the model only when its answer can change the outcome. That means mail in the grey zone, messages that look like business email compromise, a VIP's name from outside, or a first-time sender with links. The model sees the mail and its technical facts. Its verdict, confidence and reasoning appear at the top of the message.
- Our own servers. The model runs on hardware Integrators Resource owns and operates. Message content is never sent to OpenAI or any other outside AI service.
- Three ways to wait. Hold parks the message until the model answers. Async delivers at once and claws it back if needed. Inline waits during SMTP for the strictest policies. You choose the mode per policy.
- Hard to trick. Email text is kept separate from the model's instructions. A message that tries to give the model orders is treated as evidence of phishing.
- Rules first. Reputation, antivirus, authentication and content rules settle most mail on their own; the model is the tie-breaker, not the first line.
- Tested on known mail. A built-in self-test gives the model messages whose right answer is known: credential phishing, a gift-card request, a malicious attachment, a newsletter, and a friend's note with no authentication. A model change can't quietly start quarantining real mail.
05For end users
People can fix their own false positives
Every user has a portal at portal.obsidiansuite.net. It works on a phone as well as a desktop. Users see what was held for them, release what they were expecting, and report anything that got through.
- Quarantine digests by email at the times you choose. Release links go to a confirmation page first, so a link scanner can't release a message by clicking it.
- Personal allow and block lists that work alongside the organization's lists.
- Dangerous mail stays locked. Viruses, malware and phishing show as admin review. Users can see the message was stopped but can't release it.
- Secure sign-in with Microsoft or Google accounts, or a password with an authenticator app for two-factor.
- Encrypted mail to anyone. A message can go to any address as a secure link. It is encrypted before it reaches us and the key travels only in the link, so we store what we can't read. The recipient confirms their address with a one-time code, reads it in the browser and can reply securely. Available through the API and in the Obsidian Mail app.
06For administrators
Your own console, your own rules
Your IT team signs in at portal.obsidiansuite.net. Each organization is separate: its own domains, policies, allow and block lists, connectors and quarantine. Your administrators see only your mail, and no other customer can see it.
Full message trace
Every check, every rule and every point, with the reason for the final decision. You can answer "why was this blocked?" in seconds.
Per-organization policies
Thresholds, actions for each verdict, attachment rules, AI settings, and which verdicts users may release themselves.
Two roles
Administrators manage the organization; users see and release only their own mail.
REST API
Statistics, message search, release and list management over a token-based API. We issue tokens scoped to your organization, for your PSA and your own scripts.
Audit log
Every sign-in, release, policy change and setting change is recorded with the person, the time and the real client IP.
Documented end to end
Every setting, policy field, rule and header is documented, with guides for connecting Microsoft 365, Google Workspace and Exchange.
07Security & privacy
Hosted, not handed off
Obsidian runs on servers Integrators Resource owns and operates, in the United States. Message content is processed there and is not sent to an outside AI or analytics service. The only outside lookups are DNS queries: Spamhaus reputation checks, which send domains, IP addresses and file hashes, and the SPF, DKIM and DMARC records of senders.
Our own infrastructure
No public cloud or third-party mail filter underneath. We run the servers and the AI model ourselves.
Encrypted secrets
Connector credentials, API keys and two-factor secrets are encrypted at rest. Passwords are hashed with Argon2.
TLS everywhere
Built-in Let's Encrypt certificates with automatic renewal. Delivery to your mail servers requires TLS by default.
Isolated organizations
Every customer has its own quarantine, lists and policies. Quarantined mail and logs are deleted automatically when their retention period ends.
PostfixClamAVSpamhaus DQSOllamaPostgreSQLLet's Encrypt
08Get started
Protected without a project
There is no server to build and nothing to patch. We set up your organization, you change a few records, and your mail is filtered from the next message on.
Onboarding
Four steps
- Talk to usTell us your domains and platform. We create your organization and your first administrator.
- ConnectAdd a connector or transport rule so your mail server accepts mail from Obsidian, or grant API access for mailbox scanning.
- Switch MXPoint your MX records at
mx1.obsidiansuite.net. Mail flows through Obsidian from then on. - TuneAdjust policies, lists and quarantine digests in the portal, or leave the defaults.
We run it
What we look after
- Servers and updatesWe maintain the gateway, its operating system, the mail server and every component.
- Threat dataSpamhaus Data Query Service and antivirus signatures, kept current around the clock.
- The AI modelHosted and maintained on our own hardware.
- CertificatesTLS certificates for mail and the portal renew automatically.
- Our own mailDigests, sign-in links and one-time codes are DKIM-signed and covered by SPF and DMARC, so receiving servers can verify they really come from us. We see what the receiving server answered for every one.
09Questions
Frequently asked
Do I need to install anything?
No. In gateway mode you change your MX records and add a connector or transport rule so your mail server accepts mail from Obsidian. In API mode you grant access through Microsoft or Google. We run everything else.
Does the AI send my email to OpenAI or another cloud service?
No. The model runs on servers Integrators Resource owns and operates. Message content is never sent to an outside AI provider.
Where is my mail processed and stored?
In the United States, on Integrators Resource's own servers. Quarantined mail stays there until it is released, deleted or its retention period ends.
What happens if part of the system fails?
Mail is never lost. If one check fails, it is marked as errored and the others still decide. If the antivirus is down, the sending server is asked to try again later, which mail servers do automatically. If the AI is unreachable for longer than the maximum hold time, the rules decide.
Can users release their own quarantined mail?
Yes, from the portal or from a digest email. Each policy controls which verdicts users may release. Viruses, malware and phishing always need an administrator.
Is outbound mail scanned?
Yes. Mail your servers send out through Obsidian is checked for viruses and spam, so a compromised account can't get your domain blocklisted. Checks that only make sense for incoming mail, such as impersonation and AI review, are skipped.
Can we send encrypted mail to people outside the company?
Yes. A secure message reaches the recipient as a link. It is encrypted before it leaves the sender, and the key is only in the link, so our servers hold the message without being able to read it. The recipient proves their address with a code sent to it, reads the message in the browser and can reply securely. Messages expire after the time the sender chooses, up to 90 days.
Which platforms work?
Microsoft 365, Google Workspace and Exchange Server, alone or mixed. Any mail server that can receive mail over SMTP works in gateway mode.
Want to see it on your own mail?
Tell us about your environment: Microsoft 365, Google Workspace, Exchange, or a mix of them. We'll show you how Obsidian fits.