# Abnormal email security > What Abnormal email security is, how its API-connected approach differs from a gateway and DMARC, and what to verify in an evaluation. Abnormal email security is Abnormal AI's cloud email-security offering. Its public materials describe an API-connected product for Microsoft 365 and Google that uses behavioral signals to identify email threats and support remediation. That is a product description, not proof of effectiveness in a specific tenant. Evaluate its permissions, mail-flow fit, investigation evidence, remediation timing, and false-positive handling before deciding whether it closes a documented gap. ## Quick takeaways - Abnormal describes its Email Security offering as API-deployed cloud email security. - Its public materials position behavioral context as distinct from rule or signature matching. - API-connected email security and an MX-routed secure email gateway have different deployment questions. - DMARC validates authorized use of the visible From domain. It does not assess message legitimacy. - A tenant-specific evaluation should test detection, response, investigation, and rollback with approved scenarios. ## What Abnormal email security public materials describe [Abnormal's Email Security product page](https://abnormal.ai/platform/email-security) describes a cloud email-security platform that builds behavioral models around people and vendors connected to an organization. The same page describes API deployment and coverage for Microsoft 365 and Google. Those statements establish the vendor's published product position, not an independently measured detection outcome. The threat model matters when comparing products. A team worried about supplier impersonation, compromised accounts, or lookalike senders should define those cases explicitly. For the wider category and trial scorecard, see [how to compare anti-phishing software](/learning/anti-phishing-software). For a separate explanation of the attack pattern, see [email impersonation and prevention](/learning/what-is-email-impersonation-and-how-can-you-prevent-it-in-2025). ## How its deployment differs from a gateway and DMARC An API-connected product generally raises questions about authorization scope, message access, response actions, and coexistence with native controls. An MX-routed gateway raises mail-routing and gateway-operation questions instead. Those are different architectures, so do not assume that every email-security product is a secure email gateway. Read [how secure email gateways protect an organization](/learning/how-secure-email-gateways-protect-organization) for the gateway model. ![Decision map separating API-connected email security, MX-routed gateways, and DMARC evidence](/images/editorial/abnormal-email-security/abnormal-email-security-deployment-evidence-map.svg "1600x900") *Source: Original deterministic decision map based on [Abnormal Email Security product material](https://abnormal.ai/platform/email-security) and [RFC 9989, DMARC](https://www.rfc-editor.org/rfc/rfc9989.html). [View the full-size decision map](/images/editorial/abnormal-email-security/abnormal-email-security-deployment-evidence-map.svg).* DMARC is another boundary. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) defines it as a mechanism through which a domain owner can enable validation of the domain used in an email's visible From field and publish handling preferences and reporting requests. It does not make a claim about whether a message is otherwise legitimate or valuable. A public [DMARC checker](/tools/dmarc) can inspect a domain's published DMARC record, but it cannot evaluate Abnormal in a tenant or prove an inbound filter's effectiveness. ## What to collect before an evaluation Use a written test plan that keeps vendor statements, tenant evidence, and protocol evidence separate. The blank fields below are intentional. A criterion should remain unscored until the evaluation produces evidence. ```yaml abnormal_email_security_evaluation: connection_and_permissions: evidence: "approved authorization scope and data-access review" result: null representative_attack_cases: evidence: "authorized impersonation and compromised-account scenarios" result: null response_operations: evidence: "timestamps for investigation, remediation, release, and rollback" result: null false_positive_handling: evidence: "known-good business mail and exception workflow" result: null native_control_coexistence: evidence: "documented baseline and change record" result: null decision_rule: "Do not score a criterion without tenant-specific evidence." ``` Ask who owns each evidence item before the evaluation begins. Include approved business mail as well as authorized simulations, then retain timestamps and the steps needed to investigate, release, or reverse an action. Do not send realistic phishing to users without authorization and safeguards. The data sheet's descriptions of remediation and investigation features are useful questions for the evaluation, but they do not replace observed results. ## What a public record check can and cannot answer Sender-domain authentication remains worth checking alongside an inbound-security evaluation because it addresses direct spoofing of domains you control. It is not a substitute for evaluating display-name impersonation, lookalike domains, malicious content, or a compromised mailbox. Inspect the published record before changing policy, then compare it with message and trial evidence. A public record alone cannot disclose an organization's Abnormal configuration, permissions, detections, message timing, or false positives. ## Check the sender-domain record beside the trial Use Palisade's [DMARC checker](/tools/dmarc) to inspect the published DMARC record for a domain in scope, then keep that DNS evidence beside the tenant trial record. The checker can show public DMARC publication and policy information. It cannot test Abnormal, inspect a tenant, reproduce a detection, or prove inbound-filter effectiveness. ## Sources and further reading - [Abnormal: Email Security](https://abnormal.ai/platform/email-security) - [RFC Editor: RFC 9989, DMARC](https://www.rfc-editor.org/rfc/rfc9989.html) ## Frequently asked questions ### Is Abnormal email security a secure email gateway? Not necessarily. Abnormal's public materials describe an API-connected cloud email-security approach, while a traditional secure email gateway is commonly evaluated as a mail-routing layer. Confirm the architecture, authorization scope, mail-flow effects, and operating model for the tenant you are assessing. ### Does Abnormal email security replace DMARC? No. DMARC validates authorized use of the visible From domain and publishes handling preferences and reporting requests. An inbound-security product can address other message and behavioral signals, but it does not replace the sender-domain authentication and reporting work described by DMARC. ### Can a DMARC lookup test Abnormal email security? No. A DMARC lookup can inspect a domain's published authentication policy. It cannot see an Abnormal tenant, test permissions, reproduce detections, measure remediation timing, or establish whether a product handled a particular message correctly. ### What should a buyer test first? Start with the current native-control baseline and the deployment constraints. Then run approved, representative cases that include known-good business mail and authorized threat simulations. Capture detection, investigation, remediation, release, rollback, false-positive, and administrator-effort evidence for the same cases. ### Does API deployment prove that mail flow will not change? No. A vendor's deployment description does not prove the impact of a particular tenant's permissions, native controls, remediation settings, or operating procedures. Review the proposed authorization scope and test the documented mail path before relying on it in production.