> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/detect/material-email-threat-detections/email-bomb-protection.md).

# Email Bomb Protection

Material automatically detects and remediates [email bomb attacks](#user-content-fn-1)[^1] to restore availability to the inbox.

<figure><img src="/files/HIdQ8e10uClE38q3ifv7" alt=""><figcaption></figcaption></figure>

### How is an email bomb attack detected?

A bomb attack is detected when an account's inbound volume spikes far above its normal baseline within a short window. Material only counts messages that land in the Inbox and excludes expected or low-risk traffic (such as out-of-office replies) so that normal activity doesn't trigger a false alarm.

### What remediation occurs with Email Bomb Protection?

If you [**enable Email Bomb Protection**](#how-to-enable-disable-email-bomb-protection) then Material automatically removes email bomb messages from user inboxes and moves them to a separate surge protection label (Gmail) or folder (Outlook) to prevent the attack from overwhelming users and potentially hiding legitimate messages.

* Material then moves any messages from people and domains the user has communicated with back to their inbox.
* Users can manually move messages back to their inbox or delete them from their surge protection label or folder.
* Admins can bulk-recover held messages from [Message Search](/getting-started/fundamentals/explore/message-search.md): search for the affected messages, select them, then from the bottom toolbar click **All Actions** (⌘K) > **Move to Inbox**.
* Any surge protection labels or folders Material creates remain, even if the emails themselves are removed.
* If you enabled protection after the attack began, remediation initiates immediately and also applies to all messages from the start of the attack on.
* User notifications are sent via email when remediation starts and ends. The notification sent when protection ends explains what to expect if another surge starts, so users know where to find their mail. They look like this:

<figure><img src="/files/peKNQRrQ7nTWHKWZhmD1" alt="" width="563"><figcaption></figcaption></figure>

### How to enable/disable Email Bomb Protection

To enable Email Bomb Protection Globally or by tenant:

1. Confirm you're in a global space, or a specific tenant, depending on where you want to enable/disable:

   <figure><img src="/files/u8gXDVgmwEbyeO9hON1L" alt="" width="320"><figcaption></figcaption></figure>
2. From [Settings](/getting-started/deployment-guides/your-first-30-days/2-admin-tour.md), click **Default Account Settings**.
3. Under **Remediations**, scroll to **Email Bomb Protection**. Choose an option:
   1. **Enabled**: Bomb attacks are detected and automatically [remediated](#what-remediation-occurs-with-email-bomb-protection)
   2. **Detect only**: Bomb attacks are detected and issues are created for investigation
   3. **Disabled**: No issues created and no response

<figure><img src="/files/ObasFAdAvbg3rCdU902S" alt="" width="357"><figcaption></figcaption></figure>

3. Save your choice.

{% hint style="success" %}
**Enable protection after an attack begins**

If you chose [**Detect Only**](#how-to-enable-disable-email-bomb-protection) and see that an attack begins, you can enable protection for an account/group at that point and remediation will occur from the beginning of the attack onward.
{% endhint %}

<details>

<summary><strong>Enable per Account/Group</strong></summary>

You can also enable/disable individual accounts and groups separately from your default, global choice.

1. From the **Explorer**, open an **account or group**.
2. Click **Settings**.
3. Under **Remediations**, scroll to **Email Bomb Protection**. Choose an option.

<figure><img src="/files/Yuwt1oIKDWO8PS5Ccieh" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
From the detection, you can also use quick links to see all accounts/groups it's enabled/disabled for currently:

<img src="/files/nfJH3VZxmWaFRgZ5cnXC" alt="" data-size="original">
{% endhint %}

</details>

### How to track an email bomb attack

* To **notify admins**, create an [event subscription](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/set-up-a-notification.md) with these parameters:
  * If `Issue Change`
  * And Detections: `Account is experiencing a potential Email Bomb Attack`

<figure><img src="/files/h6qPahp8ifXv1mFaoatZ" alt="" width="563"><figcaption></figcaption></figure>

* To **view issues created by this detection**: filter issues by the detection called `Account is experiencing a potential Email Bomb Attack` .

  <figure><img src="/files/6baWQOln6VUo6A40SwCm" alt="" width="375"><figcaption></figcaption></figure>

[^1]: an attack method that involves sending a large volume of emails within a short period, with the goal of overwhelming the receiver's inbox and potentially obscuring legitimate emails


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-threats/detect/material-email-threat-detections/email-bomb-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.