Email risk alert descriptions

Help Center

AI Assistant

Help Center AI Assistant is now available

Got questions about Lark? Use our AI chat to find the answers.

Click and hold to drag

Got It

Try Now

Email risk alert descriptions

2 min read

I. Intro

For emails that the sender's true identity cannot be verified, and for phishing, virus, and other high-risk emails, Lark Mail will issue risk alerts at the top of emails to remind users to handle these emails with caution and protect their personal information.

II. Information reference

You can find common triggering scenarios and descriptions in the following table.

Triggering scenario	Description
The email contains high-risk links	This email contains high-risk links. Do not click the link or disclose personal information in replies.
The email is a phishing email	Someone has previously used similar emails to steal users' personal information. Do not click links or download attachments in the email, nor disclose personal information in replies.
The email uses a similar domain to impersonate the sender	The sender's domain "[domain]" is similar to your organization's domain, posing a risk of impersonation. Do not click links or download attachments in the email, nor disclose personal information in replies.
The email contains high-risk, or harmful attachments	This email contains high-risk or harmful attachments. If you are unsure of the email's authenticity, do not download the attachments.
The email is from external source with encrypted attachments	This email contains encrypted attachments, which the system cannot scan for viruses. If you are unsure of the email's authenticity, do not download the attachments.
The email is sent from an impersonating domain that is not verified	The sender's identity has not been verified, so it cannot be confirmed if this email was indeed sent by them. If you are unsure of the email's authenticity, do not click links or download attachments in the email, nor disclose personal information in replies.
The email is sent from similar names	The sender's identity has not been verified, so it cannot be confirmed if this email was indeed sent by them. If you are unsure of the email's authenticity, do not click links or download attachments in the email, nor disclose personal information in replies.
The message failed verification
Other potential risk situations	This email poses a risk. If you are unsure of the email's authenticity, do not click links or download attachments in the email, nor disclose personal information in replies.

III. FAQs

What should I do if a normal email triggers a risk alert?

If a normal email triggers a risk alert, you can set the email sender as trust sender, or contact the administrator to add the sender or domain to the email allowlist to prevent emails from this sender or domain from being treated as spam.

Note that if the email does not pass SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) authentication, the email might be forged. In this case, the Allowlist will not be effective. If the Allowlist does not work, contact the sender to confirm whether their SPF or DKIM is correctly configured.