Understand the report
Bring together the message, link and attachment evidence.
Suspicious email analysis
MailSentinel by rootzero
Suspicious email analysis
Your staff forward a dubious email. MailSentinel replies with a verdict (legitimate, suspicious or malicious), the signals behind it and what to do next.
For IT and security teams handling suspicious email reports.
Decisions your team can make
Support your decision
Base classification on the elements observed during analysis.
Share a clear response
Give your team the verdict and recommended actions.
01In short
Sender, domain authentication, links, attachments and tone are analysed and cross-checked against threat intelligence sources. The security team follows everything from one dashboard.
- Deployment
- No software to install
- Turnaround
- A few seconds per analysis
- Verdict
- Legitimate, suspicious or malicious
- Trial
- 30 days, assisted setup
02How it works
What MailSentinel does, step by step.
-
Forward
The suspicious message goes to a dedicated analysis address from the usual mail client. Nothing to install.
-
Analysis
Sender, domain, links, attachments, and signs of CEO fraud or business email compromise.
-
Verdict
Legitimate, suspicious or malicious, with a confidence score and an explanation of the signals found.
-
Follow-up
Advice for the person who received the email, a dashboard for the security team.
Use cases and deliverables
When to choose this product
- Decide what to do with an email reported by an employee.
- Examine an attachment or link before opening it.
- Give the reporting employee an explanation of your decision.
What you receive
- An analysis of the message and its suspicious elements.
- A verdict with supporting evidence.
- Recommendations for handling the report.
03Questions
Frequently asked questions
Who makes MailSentinel?
MailSentinel is a rootzero product. It is designed, built and run by the rootzero team in France.
How do I get started?
A first call lets us scope your perimeter and goals. Write to us to arrange the setup.
What should I prepare for the first conversation?
Describe how reports reach your team and your usual volume. Use a demonstration message with sensitive data removed for the first conversation.
How do I get a proposal?
Describe your needs and scope. We agree arrangements, schedule and price with you before any commitment.
Further reading
The method, open to inspection.
Our public research and guides on these topics: the mechanisms, the evidence and the limits of each analysis.
CVE-2026-34975
CVE-2026-34975: email header injection in Plunk through raw MIME construction in SESService
Plunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.
Free tool
URL Inspector
Inspect a URL’s origin, host, port, path, parameters and fragment, then spot credentials, secrets, duplicates and ambiguous normalisation.
Evaluate MailSentinel on your scope.
Describe how reports reach your team and your usual volume. Use a demonstration message with sensitive data removed for the first conversation.
Request a demonstration+Same house
The other rootzero products
- SpectrAIAutonomous web and API pentesting
Automated web application and API pentesting
- DataShieldAttack surface management
Inventory of Internet-exposed services
- BreachScanData leak monitoring
Data leak monitoring