Menu
← Back to home

Frequently Asked Questions

Everything you need to know about SpoofShield. Can’t find your answer? Contact us.

General

What is SpoofShield?
SpoofShield is a Microsoft Outlook add-in that runs directly inside your Outlook desktop client. It analyses every email you open and flags spoofing threats — including typosquat domains, VIP impersonation, and reply-chain hijacking — before you or your team acts on them.
How is SpoofShield different from my existing email filter?
Gateway filters and spam engines work at the server level — they can only see the email headers and metadata. SpoofShield runs client-side inside Outlook, so it can analyse the full conversational context: who was in the thread before, whether a new participant was injected, and whether the sender’s display name matches an internal VIP. No server-level filter can do that.
Does SpoofShield read or store my emails?
No. All detection runs locally inside Outlook on your device. Email content is never transmitted to SpoofShield’s servers. Only alert metadata (sender, recipient, threat type, timestamp) is logged to your organisation’s dashboard.
Is SpoofShield compatible with Microsoft 365?
Yes. SpoofShield is built on the Office.js API and works with Outlook desktop on Windows and Mac when connected to a Microsoft 365 (Exchange Online) mailbox.

Setup & Deployment

How do I deploy SpoofShield to my organisation?
After signing up and configuring your org, download the manifest file from your admin dashboard. Upload it via Microsoft 365 Admin Center under Integrated Apps → Upload custom apps. All licensed users in your tenant will receive the add-in automatically.
How long does setup take?
Most organizations are fully deployed in under 15 minutes. Signing up takes 2 minutes, configuring your VIP list and trusted domains takes 5 minutes, and deploying via Microsoft 365 Admin Center takes another 5 minutes.
Do my users need to do anything?
No. Once you deploy via Microsoft 365 Admin Center, the add-in appears in Outlook for all licensed users automatically. There is nothing to install on individual machines.
Can I test SpoofShield before rolling it out?
Yes. You can sideload the manifest on a single machine to test detection before deploying org-wide. See the INSTALL.md included with your manifest download for step-by-step instructions.

Billing & Plans

How does billing work?
SpoofShield is billed monthly per user seat. You can add or remove seats at any time from the dashboard. Changes take effect at the next billing cycle.
How do I cancel my subscription?
Log in to your dashboard at app.spoofshield.net → click the ‘Manage subscription’ pill in the top-right of the Dashboard page → this opens the Stripe customer portal → click ‘Cancel plan’. Your subscription stays active until the end of the current billing period, after which downloads and detection will be paused. Your alert history is always preserved.
What happens after I cancel?
You keep full access until the end of the billing period you’ve already paid for. After that, the Outlook add-in and browser extensions enter a locked state — they won’t analyse new emails, but your alert history and organisation data remain intact. You can resubscribe at any time to restore full access immediately.
What happens when my 14-day trial ends?
You will receive an email reminder 3 days before your 14-day trial ends. If you have not added a payment method, the add-in will enter read-only mode — alerts will stop but your dashboard history is preserved.
Do you offer annual billing?
Annual billing with a 20% discount is available on request. Contact us at info@spoofshield.net to set this up.

Security & Privacy

Is SpoofShield GDPR compliant?
Yes. No email body content is ever transmitted to our servers. Alert metadata (sender/recipient addresses, threat classification, timestamp) is stored in your org’s dedicated database partition. You can export or delete all data at any time from your admin dashboard.
Where is my data stored?
All data is stored on servers in the United States. If you require EU data residency, contact us to discuss our Enterprise plan.
Who can see my organisation’s alerts?
Only users you designate as admins in your SpoofShield org can view the full alert dashboard. Regular users only see alerts triggered in their own Outlook session.

Installation Guides

Step-by-step instructions for every platform. No account required to read these.

Outlook Add-inPersonal install
  1. Open Outlook desktop and go to Get Add-ins (Home tab → Get Add-ins, or File → Manage Add-ins).
  2. Click My Add-ins in the left panel, then scroll to Custom Add-ins at the bottom.
  3. Click + Add a custom add-in → Add from URL.
  4. Enter the manifest URL: https://app.spoofshield.net/addin/manifest.xml
  5. Click OK and restart Outlook.
  6. Open any email — the SpoofShield button will appear in the ribbon. Click it to open the task pane.
  7. Tip: Use ‘Add from URL’ (not ‘Add from file’) so the add-in stays up to date automatically.
Troubleshooting
  • Restart Outlook — the add-in may need a full restart to register.
  • Remove and re-add — go to My Add-ins, remove SpoofShield, then add it again using ‘Add from URL’.
  • Check your Outlook version — SpoofShield requires Outlook 2016 or later (Microsoft 365 recommended).
  • Check COM add-in conflicts — some COM add-ins can block Office.js add-ins. Temporarily disable others and test.
  • Corporate firewall — ensure app.spoofshield.net is whitelisted. Contact your IT team if needed.
  • Cached manifest — if you used ‘Add from file’, Outlook caches a local copy. Remove it and re-add via ‘Add from URL’.
M365 Admin CenterOrg-wide deploy
  1. Download the manifest: https://app.spoofshield.net/addin/manifest.xml
  2. Log in to the Microsoft 365 Admin Center (admin.microsoft.com).
  3. Go to Settings → Integrated apps → Upload custom apps.
  4. Upload the manifest.xml file and assign it to users or groups.
  5. The add-in will appear automatically in Outlook for all assigned users within 24 hours.
Troubleshooting
  • Confirm assignment — in Admin Center, verify the add-in is assigned to the correct users or groups.
  • Restart Outlook — users may need to fully close and reopen Outlook after the add-in rolls out.
  • Check COM add-in conflicts — some COM add-ins can block Office.js add-ins. Temporarily disable others and test.
  • Corporate firewall — ensure app.spoofshield.net is whitelisted for all users. Contact your IT team if needed.
Chrome / EdgeBrowser extension
  1. Open the Chrome Web Store (Chrome) or Edge Add-ons store (Edge).
  2. Search for SpoofShield and click the result.
  3. Click Add to Chrome or Add to Edge.
  4. When prompted, click Add extension to confirm permissions.
  5. Open Gmail or Yahoo Mail — SpoofShield activates automatically when you open an email.
  6. You’ll see a SpoofShield badge appear in your browser toolbar confirming it’s active.
Troubleshooting
  • Check it’s enabled — click the puzzle piece icon in Chrome/Edge and make sure SpoofShield is toggled on.
  • Reload the tab — after enabling the extension, reload your Gmail or Yahoo Mail tab.
  • Open the full email — alerts only fire when you open an email, not just select it in the list.
  • Permissions — if you declined permissions during install, go to browser Settings → Extensions → SpoofShield → Permissions and enable site access for mail.google.com and mail.yahoo.com.
  • Incognito/Private mode — extensions are disabled in private mode by default. Enable it in extension settings if needed.
FirefoxBrowser extension
  1. Open Firefox and go to addons.mozilla.org.
  2. Search for SpoofShield and click the result.
  3. Click Add to Firefox and confirm permissions.
  4. Open Gmail or Yahoo Mail — the extension activates automatically.
Troubleshooting
  • Check it’s enabled — click the extensions button in Firefox and make sure SpoofShield is toggled on.
  • Reload the tab — after enabling the extension, reload your Gmail or Yahoo Mail tab.
  • Open the full email — alerts only fire when you open an email, not just select it in the list.
  • Permissions — if you declined permissions during install, go to Firefox Settings → Extensions & Themes → SpoofShield → Permissions and enable site access for mail.google.com and mail.yahoo.com.
  • Private mode — extensions are disabled in private mode by default. Enable it in extension settings if needed.

Still have questions?

Our team typically replies within one business day.

Contact usSubmit a support ticket