Tip: the status counts below show the last 24 hours — but as soon as you type a search or use a filter, you're looking through your full ~90-day history.
Read-only access — can view mail logs, quarantine, and settings but cannot change anything
operator
Daily operations — can release quarantine, manage queue, and handle day-to-day email tasks
manager
Configuration + users — can edit filtering rules, sender policies, and create viewer/operator users
admin
Full control — can manage domains, all users, billing, and all settings within their scope
Levels
customer
Access to all domains belonging to that customer
domain
Access restricted to one specific domain only
Managed Domains
Domain
Relay To
Customer
Status
Added
Actions
Loading...
-
Quarantined
0
Pending Approval
Quarantined Emails
Auto-deleted after 90 days (3-month data-minimization cap).
Ctrl+click rows to select · then batch release
Date
From
To
Subject
🌐
Auth
Score
Reason
Actions
Loading...
Triage view sorts your quarantine into 3 safety buckets:
🟢 Safe to clear — high-confidence spam, bulk delete asks for confirmation
🟡 Needs your attention — review individually
🔵 Probably wanted — caught by a strict rule, consider releasing
Your release/delete decisions help our AI categorize quarantine more efficiently over time.
Loading...
Release Requests Pending Approval
Pending requests auto-deleted after 90 days (3-month data-minimization cap).
📧You arrived from an email notification — showing only this request.
Ctrl+click rows to select · then batch approve / whitelist / deny
Date
From
🌐
To
Subject
Score
Reason
Actions
Loading...
Captured Rejects (onboarding)
Auto-deleted after 90 days (3-month data-minimization cap), regardless of capture window.
Emails REJECTED at SMTP that we kept a copy of (when onboarding capture is enabled for the recipient domain). Review to confirm nothing legitimate was bounced. Auto-cleanup follows the per-domain capture window.
Ctrl+click rows to select · then batch release / confirm
Date
From
To
Subject
🌐
Auth
Score
Reason
Actions
Loading...
✨ Smart Triage
Preview only — recommendations, no action taken. You decide.
Quarantined Email
Captured Rejection
Grok proposal#0
Confirm bulk delete
⚠ Conflict found
New customer — guided setup
Step 1 of 3 · Customer
Adding a domain for
The user gets a magic-link setup invite by email.
-
Total Queued
-
Deferred
-
Active
-
Hold
Customer
Domain
Sender
Recipient
Subject
Size
Age
Error
Actions
Click "Queue" tab to load
🤖 AI — Super-Admin
AI cost & billing and AI controls. Super-admin only.
💰 AI Cost — Aggressive Filtering
On rows = actual force-AI calls (the billing number). off rows = projected upper bound (real cost is usually ~⅓ after the first-contact/auth-pass carve-out). Red = over the $50/mo approval line.
Loading…
▸
▸
▸
Resellers
🟡 Past Due — Payment Failed
⏳ Billing Drafts
Customers
Add Customer
Free/Demo customers are excluded from migration backlog views.
Used as the default for new billing attachments. Cascade: customer → reseller → USD.
Used for emails and UI unless overridden at a lower scope.
Users
Domains
Per-user breach checks (HIBP)
User Management
Name
Email
Tier
Role
Scope
2FA
Status
Last Login
Actions
Loading...
Add User
Manage which notifications this user receives. Two-factor and SMS/Telegram verification stay self-service in the user's own profile.
Send times (Eastern Time) — up to 5. Each digest covers everything quarantined since the previous one; empty digests are skipped.
Quarantine & Whitelist Policies
Control who can self-release quarantined emails and who can auto-whitelist senders. Settings inherit from parent scope (Global → Reseller → Customer → Domain). Set a value to override the parent, or leave as “Inherit” to use parent’s setting.
Self-Release (Quarantine)
Can users release quarantined emails themselves?
⚠ High-risk band (71–94: phishing / malware). Enabling this lets users release these emails into their inbox without admin review. Off by default.
Auto-Whitelist (Sender Trust)
Can users auto-trust senders when releasing emails?
Mailbox Billing
Manage declared mailbox counts per customer or per domain. The Observed column counts distinct recipients receiving mail in the last 30 days (excluding system addresses like postmaster, abuse, mailer-daemon, no-reply). Shared inboxes such as info@, sales@, support@ are intentionally counted — they are billable seats on M365 / Workspace. Click a row to expand; click Show breakdown per domain to see which addresses contribute.
Loading...
Financial Overview
Revenue, commissions, and customer breakdown across all resellers. Distinguishes Stripe (self-signup) customers from Manual / Reseller-billed customers (provisioned by a reseller without going through Stripe).
Total Customers
—
Active
—
Monthly Revenue
—
Commissions Owed
—
Net Revenue/mo
—
Annual Projection
—
These figures cover only customers referred under your reseller account. Monthly GMV is what your customers pay LastSpam; Commission is your earned cut on those subscriptions.
Revenue by Plan
Plan
Clients
Active
Monthly
Annual
Revenue/mo
Commissions/mo
Net/mo
By Reseller
Click a reseller row to expand their client list.
Reseller
Clients
Active
Revenue/mo
Commission/mo
Net/mo
All Customers
Customer
Plan
Status
Source
Billing
Mailboxes
Observed
Price/mo
Commission
Reseller
Since
Voice & Chat Misses
Voice / chat questions where the RAG knowledge base returned nothing relevant, OR where Grok answered without consulting the docs. Review, mark resolved, or write a doc to close the gap.
-
Open
-
Open (24h)
-
Reviewed
-
Total
Date
Source
Role
Who
Question
Top sim
Status
Loading...
Bugs & Suggestions
Bug reports, UI/UX suggestions, and feature requests from logged-in users (admin/reseller/customer in-app form).
-
New
-
Bugs
-
UI/UX
-
Features
-
Total
Date
Category
From
Message
Page
Status
Actions
Loading...
Email Feedback
End-user spam / not-spam reports collected from email banners. Use to spot misclassifications and tune scoring.
-
False negatives
-
False positives
-
New
-
Reviewed
-
Total
Top reported domains:
Date
Type
Sender
Subject
Score
Verdict
Recipient
Status
Actions
Loading...
Grok Approvals
Mitigations Grok proposes from clustered end-user reports. Permanent rules and high-impact actions wait for your GO; TTL'd auto-applied items are listed for audit. Every item carries the cluster + run ID that produced it.
-
Pending GO
-
Approved
-
Applied
-
Rejected
-
Auto-applied
-
Total
0selected
Loading…
Confirm bulk approve
You are about to approve these proposals. Each will apply per Phase 4 dispatch rules. This cannot be undone in bulk.
AI-Bypass Senders
Mark a high-volume authenticated sender so the filter skips the AI second-opinion call.
Only use for senders that pass authentication.
Leave blank to bypass for the whole recipient domain.
Sender
Recipient scope
Hits
Added
By
Loading…
Changelog & What's New
Post product updates and operational notices visible to all logged-in users. Pin-to-top entries render as a banner above the page header (use for active incidents and maintenance windows).
Uses current Type, Audience, and Banner-only as context.
Existing entries
Domain Info
Relay:
Plan:
AI Mode:
Connection:
Language:
Notes:
Relay Destinations
Capture until:
DNS Records
Microsoft 365
Status:
Mode:
Tenant:
Features
Move spam to Junk Folder
Routes LastSpam-flagged spam (verdict=spam) to each user's Junk Folder. Users will need to check Junk to recover false positives.
Reject Direct Send
Blocks unauthenticated "Direct Send" — mail delivered straight to M365 as one of this tenant's own domains (a common spam/spoof path that never reaches LastSpam).
⚠ Enable only if NO printer, scanner, fax-to-email, legacy system or custom tool on their network relays mail through M365 unauthenticated — those would stop sending. Reversible.
Microsoft can take 2–3 minutes to fully apply this change — if you verify in PowerShell right away, the old value may still show briefly.
IP restriction (only accept mail from LastSpam)
Locks the inbound connector so M365 only accepts mail from LastSpam's IPs (the strongest Direct Send block).
⚠ Enable ONLY after MX has pointed to LastSpam for several hours (past the old MX TTL) — too early rejects legitimate mail. Same printer/scanner/legacy/custom-tool caveat as above. Reversible.
Microsoft can take 2–3 minutes to fully apply this change — if you verify in PowerShell right away, the old value may still show briefly.
⏳Disconnecting Microsoft 365
Starting…
0%
✓ Microsoft 365 disconnected — all Exchange changes reverted
✗ Disconnect failed
Attach billing ——
Who pays?
Plan
Cycle
Currency
Mailboxes
To change mailbox count, edit in Admin → Mailbox Billing tab.
Pricing
Unit price ($/user/cycle)
Label (admin note, optional)
—
Save as Draft = no Stripe call yet; the customer (or reseller) sees a "Pending Activation" banner in their portal and clicks Activate when ready.
Generate Checkout URL = immediate Stripe Checkout link to copy + send manually.
Checkout URL generated
Send this URL to the payer. They have 24 hours to complete the Stripe Checkout flow before the session expires.
Start onboarding without purchase
No subscription exists for this customer. Pick a plan and mailbox count to provision an externally-billed subscription, then start the onboarding wizard.
Domain:
Plan
Mailbox count
Disconnect Microsoft 365?
This removes all four Exchange objects LastSpam created (inbound connector, transport rule, anti-spam policy, anti-phish policy) and returns the tenant to its original state. Mail flow will not change unless this domain also has MX records pointed at LastSpam.
Type the domain name to confirm:
CONFIGURATION
Behavioral toggles: greylisting, AI mode, MyContext, rejection capture
Onboarding Rejection Capture —
During the onboarding window, keeps a copy of every email rejected at SMTP so the customer can verify nothing legitimate was bounced. Capture is on by default for the first 30 days of every new domain.
0 = capture off by default for new domains. Maximum 90 (matches the 90-day capture-retention cap).
MyContext (AI prompt context) —
Tell our AI about this business in a few sentences — industry, typical correspondents, vocabulary, services offered/not offered. Used to nuance email classification (avoid false positives on routine business mail). It does NOT override our core spam/dangerous safety rules.
Use this only if all your customers share a vertical. For mixed-vertical resellers, leave blank — your customers' own MyContext is more useful.
Runs every email through the AI — including low-scoring authenticated mail that's normally skipped — so more spam is caught before it reaches the inbox. Caught mail follows this customer's usual spam handling (tagged in the inbox, or moved to Junk). Best when a customer is still seeing too much spam. It stays conservative, so false positives are rare — but if their spam routes to Junk, a quick glance there now and then is worth it.
Greylisting delays first-contact emails by 5 minutes — legitimate servers retry, bots don't. Disabling it means emails skip the greylisting delay but still go through all other verification layers (authentication, sender rules, attachment scanning, AI analysis).
OFF (default): Greylisting bypassed when SPF auth passes. No alignment check. ON: Greylisting bypassed only when DMARC passes (SPF/DKIM auth + domain alignment). Recommended for high-security domains (finance, healthcare, education).
Session Security —
Idle timeout: how long a user can be inactive before being signed out (warning shown 60 sec before logoff). Absolute timeout: maximum session duration regardless of activity — forces re-authentication after this time. Inherit uses the parent scope or LastSpam defaults (60 min idle, 24 hour absolute). Never disables the check.
How it works: This setting controls whether email analysis uses local AI, cloud AI, or both. Privacy Mode customers still benefit from anonymized threat intelligence learned from cloud analysis — only raw email content stays local.
How verdicts work — every email is scored 0-100 based on sender reputation, authentication (SPF/DKIM/DMARC), content rules, and AI analysis on borderline cases. The score determines the verdict; the toggles below control how each verdict is annotated on the delivered mail.
VERDICT
SCORE
ACTION
WHAT IT MEANS
External
—
DELIVERED
Clean mail from outside your organization. Useful to flag look-alike spoofing attempts.
Suspect
20-39
DELIVERED
Borderline — could be spam or legit. User judgement required.
Spam
40-70
DELIVERED
Very likely junk. Delivered so users can inspect / report false positives.
Danger
71-100
REJECTED / QUARANTINED
Known threats, malware, confirmed phishing. Never reaches the mailbox — Danger tag is symbolic only.
HTML Banners inject a colored warning block at the top of the email body. Subject Line Tags prepend a customizable label (e.g. [Spam]) to the subject. Toggle each verdict independently for banners and subject tags to tune the signal-to-noise for your users.
HTML Banners
External
Suspect
Spam
Danger
Subject Line Tags
External
Suspect
Spam
Danger
Unsubscribe Button (RFC 8058)
Safe one-click Unsubscribe button on newsletter banners
Renders a small Unsubscribe pill next to "Report spam" only on emails that pass all 5 safety gates (RFC 8058 signature + SPF + DKIM + DMARC + URIBL + HTTPS). The click is server-proxied — your user's browser never touches the sender's URL.
⚠ Per-customer setting — select a customer in the filter bar above to manage. (Per-scope inheritance coming in Phase A.2.)
Sender Whitelist / Blacklist
—
Two whitelist modes — choose based on how much you trust the sender's email infrastructure.
✅ Safe Whitelist (recommended)
Delivers the email only if SPF or DKIM passes. Still runs full spam/AI analysis for logging and Tags.
Use for: Trusted partners with working email authentication. Protects against spoofing — someone pretending to be the whitelisted sender will still be blocked.
Blocks if: Neither SPF nor DKIM passes, or DMARC policy is p=reject and fails.
⚠ Full Bypass (dangerous)
Delivers the email regardless of authentication results. No SPF, DKIM, or DMARC checks.
Use for: Senders with broken infrastructure — no reverse DNS, temporary blacklisting, no DKIM/SPF setup at all.
Risk: Anyone can spoof this sender and bypass all protections. Use with caution and set an expiry date if possible.
Input formats:acme.com = exact domain | *.acme.com or .acme.com = domain + subdomains | bob@acme.com = specific address
Precedence: Blacklist always wins over whitelist. Dangerous whitelist wins over safe. Customer-level rules inherit to all their domains.
Expiry options.Never = permanent. 30/90/365 days (absolute) = pick when you know an end date. Idle 90/180/365 days = pick when the rule is a temporary fix and you don't know when it'll be obsolete (e.g. partner with broken SPF). The rule auto-deactivates if not matched in N days. Idle-deactivated rules are kept in the list and can be reactivated with one click.
FROM — sender to match
APPLIES TO — who this rule protects
Spam scoring is controlled by the Mode selector above
⚠ Warning: Full Bypass skips ALL authentication checks (SPF, DKIM, DMARC). Anyone can spoof this sender and emails will still be delivered. Only use for senders with completely broken email infrastructure.
Input Format Guide
bob@acme.com
Exact email address
acme.com
Entire domain (all users @acme.com)
*.acme.com
Domain + all subdomains (mail.acme.com, eu.acme.com, etc.)
What Each Option Does
Mode: Safe
Whitelist only if DMARC passes (proves sender owns the domain)
Mode: Full Bypass
Skip all spam checks — no authentication required (dangerous)
Skip greylisting
No first-contact delay — useful for time-sensitive senders
Skip attachment blocking
Allow risky file types (e.g., .exe, .iso) from this sender
You can combine options. Comma or newline-separate multiple entries.
Whitelist — at this scope
Blacklist — at this scope
Child Scope Rules — inherited from sub-scopes
▲ Inherited from Global(read-only)
▲ Inherited from Reseller — (read-only)
▲ Inherited from Customer — (read-only)
File Attachment Policies
—
Default attachment policy — aligned with Microsoft Defender, Mimecast, Proofpoint, and Google. Overrides below can create exceptions per customer or domain.
ClamAV malware scanning runs on all attachments regardless of extension. Use the override form below to create exceptions for trusted senders or required file types.
Extensions = file types to allow/block. Senders = who can send them (empty = anyone). Emergency = active immediately for your direct scopes, cascades to child admins for approval.
Child Scope Rules
MONITORING
Read-only audit feeds — who did what, when. Three logs below: Change History (per-user actions + admin user management), Config Changelog (platform settings), Login History (sign-ins).
Change History
Per-user actions + admin user management: spam reports, release requests, whitelist/blacklist clicks, user create / edit / activate / deactivate / unlock / delete / password reset / invite resend. Hover the ? for full details.
Platform-config changes: greylisting, AI mode, MyContext, sender rules, attachments, tags & banners. User-management events appear in Change History above. Hover the ? for full details.
Login History
Date / Time ▼
User
IP
Result
Reason / UA
Loading…
Email Analytics
-
Total Emails
-
Clean
-
Blocked
-
Dangerous
-
Block Rate
Email Volume Over Time
What Catches Spam
Score Distribution
Verdict Breakdown
Status Breakdown
Status
Count
%
Loading...
AI Engine Usage
Engine
Emails
%
Loading...
Top Sending IPs
IP Address
Total
Blocked
Block %
Loading...
Top Sender Domains
Domain
Total
Blocked
Block %
Loading...
Top RBL Providers Hit
Provider
Hits
Loading...
Top URIBL Domains Caught
Domain
Hits
Loading...
Top Recipient Domains
Domain
Total
Blocked
Loading...
Shadow AI (Ollama)
Second-pass Ollama scan of every email. Does not change delivery. Shown here: how it performs, and where it disagrees with the live verdict (live said clean/uncertain, shadow said spam/dangerous — these are the ones worth a human look).
-
Scanned
-
Pending
-
Disagreements
-
Latency P50
-
Latency P95
-
Errors
Live said clean / uncertain — Shadow said spam / dangerous
Time
From
To
Subject
Live
Shadow
Shadow Score
Shadow Reason
Loading…
Risk Snapshot
A 30-second view of your email-attack-surface — who is being targeted, what is leaking, and which platforms your people are exposed to. Metadata-only: we never read message bodies.
–
—
Posture Score
Last 30 days. 100 = healthy. Penalties subtracted for spam pressure, auth failures, dangerous mail, and traffic from breached platforms.
Most-Targeted Users (30d)
Concentration risk — who is the spear-phishing magnet on your team.
Recipient
Hits
Dangerous
Quarantined
Loading…
Hostile External Domains (30d)
Sender domains driving the most rejected/quarantined volume.
Domain
Attempts
Dangerous
Avg score
Loading…
Breached Platforms Reaching Your Org (30d)
Companies with a known data breach that emailed your organization in the last 30 days — an awareness view of breached brands in your mail flow (a phishing-impersonation surface, and a hint your users may hold accounts there). Recipients = how many of your users received mail from that domain. This does not mean those users are compromised — to see which of your users actually appear in a breach, use Your Exposed Users below.
Platform
Severity
Breaches
Most recent
Messages
Recipients
Loading…
Your Exposed Users
Your own users whose email address appears in a known data breach — across the entire Have I Been Pwned catalog, not only platforms that recently emailed you. Requires per-user breach checks to be enabled for the customer.
Loading…
Add Reseller
Marks this reseller as Free or Demo. Test resellers should be Demo.
Default for customers in this reseller's scope. Cascade: customer → reseller → USD.
Referral URL
Customers signing up via this URL are credited to this reseller (35% commission auto-split when their card is charged on Stripe).
No referral URL set yet. Click Generate URL to create one based on the reseller's company name.
Slug:
Stripe Connect (Path A) onboarding
Required for the reseller to receive 35% transfers when their customers pay via Path A. Generates a Stripe Express onboarding link the reseller clicks once (real KYC + bank account).
Onboarding URL (send to reseller — expires in 30 minutes):
Used for emails and UI unless overridden at a lower scope.
Email Details
Panel 1
Panel 2
Panel 3
Admin Assistant
Send Feedback
Report a bug, suggest an improvement, or request a feature. Just describe it — we'll categorize it automatically.
or Ctrl+V to paste
✓
Thank you!
Your feedback has been submitted. We'll review it shortly.
Trigger outage alert
Send an emergency notification to all users who opted in for outage alerts on this domain. Cooldown: 30 min per severity. Per-user daily cap: 5 alerts/24h.
Enroll authenticator app
Scan this QR code with your authenticator app (Google Authenticator, Authy, 1Password, Microsoft Authenticator, etc.), then enter the 6-digit code your app shows.
Can't scan?Enter this secret manually:
✓ Authenticator app enrolled
Save these backup codes somewhere safe. Each one can be used once if you lose access to your authenticator app. They are shown ONLY ONCE — copy them before closing this dialog.
Disable authenticator app
This will remove your authenticator app and all unused backup codes. Your other 2FA methods (SMS / Email / Telegram) remain unchanged.
Regenerate backup codes
This will invalidate all existing backup codes (used and unused) and generate 8 new ones. Confirm with your current password.
✓ New backup codes generated
Save these backup codes somewhere safe. Each one can be used once if you lose access to your authenticator app. They are shown ONLY ONCE — copy them before closing this dialog.
My Profile
Authenticator app (TOTP)
Be notified when LastSpam detects mail-flow trouble for your domain. SMS and Telegram require one-time verification.
When an email addressed to you is quarantined, your domain's policy may send you a notification with a release link. You can silence those for yourself here.
As an admin, you can opt in to receive notifications for every quarantined email across the domain(s) you administer — either as it happens, or as a digest at the times you choose (Eastern Time).
Send times (Eastern Time) — up to 5. Each digest covers everything quarantined since the previous one; empty digests are skipped.
When a user requests release of a dangerous quarantined email, you receive an email asking you to approve or deny. Disable this if you prefer to manage pending requests from the dashboard only. Pending requests remain visible in the dashboard badge regardless.
Leave blank to keep current password
Sign out all other sessions
Use this if you signed in on a shared device or suspect someone else has access to your account. Your current session stays active.