Stop email attacks from sender to inbox

Valimail secures outbound sender identity through automated DMARC enforcement, preventing attackers from spoofing your domains. Sublime protects inbound email with org-specific detections that adapt as attackers change tactics. When you identify a malicious sender in Valimail's Active Threat Detection report, one click pushes it to Sublime as a blocklist entry and a live detection rule your team can inspect and edit. No copy-paste, no manual handoff.

Keeping them separate creates gaps. Outbound authentication stops unauthorized senders from abusing your domains. Inbound detection stops threats from reaching your team's inboxes. Modern BEC and phishing campaigns exploit both directions simultaneously, so protecting only one creates an opening for attackers to exploit.

When connected, the integration maintains a valimail_blocklist and a detection rule named Block Valimail-reported malicious senders in your Sublime tenant. Each time you report a malicious sender from Valimail's Active Threat Detection report, Sublime automatically acts on matching inbound mail using the action you configure -- quarantine, move to a review folder, or another Sublime action. The rule is visible and editable in your Sublime tenant; Valimail only ever writes to these two dedicated objects.

The integration is currently available as a Labs release for Valimail Enforce customers with the Active Threat Detection add-on enabled. You'll also need Owner permissions in your Enforce account and a Sublime Security account with API access.

No. The integration creates and manages only two objects: the valimail_blocklist and the Block Valimail-reported malicious senders detection rule. It does not modify other rules, lists, or settings.