Mailfilter

Description of the Mailfilter

Last adaptation to the version: 14.1.1 (11.2025)

New:

Es gibt zwei neue Filterkriterien:
- und enthält von der Ähnlichkeitserkennung verdächtigte Domains
- und enthält keine von der Ähnlichkeitserkennung verdächtigte Domains

New section in the settings: General
Section Criteria revised

notempty

This article refers to a Beta version

14.0.0 12.7.1 12.6.2 12.6.1 12.5.2 12.2.2 11.8.8 11.8.6 11.8 11.7

Introduction

In order to determine whether an incoming email is spam, the POP3 proxy, mail relay and mail connector can pass incoming emails to the Mailfilter. The Mailfilter consists of the:

Cyren scan daemon,
the ClamAntivirus
Only for systems that meet the requirements
,
the Securepoint content filter and
a URL filter.

If a web link is found within the email which matches the URL filter or which is recognized by the content filter, a freely editable replacement message appears instead of the content section of the email.
By using the Mail Connector, it is possible to check not only POP3 but also emails fetched with IMAP as well as the two encrypted variants through the Mailfilter. The UTM mail archive stores mails that have been quarantined using the filter rule.
Emails forwarded and delivered by the UTM (HAM) are no longer found in the mail archive unless this option is explicitly activated.

Requirement

notempty

For the Mailfilter to receive mails, the POP3 proxy, the mail relay or the mail connector must be configured.

Filter rules

Overview

The filter rules are used to decide how to proceed with emails for which defined properties have been detected. A distinction is made between the SMTP and POP3 protocols as well as the mail connector.
Via the Mail Connector, the UTM is able to read emails from a mail server using the POP3 and IMAP protocols and their encrypted variants POP3S and IMAPS. It also inspects them for spam and malware by using the Mailfilter.
Furthermore, a distinction is made between the protocols POP3 and SMTP.
If the mail relay is used, the protocol is SMTP. If the POP3 proxy is used, the POP3 protocol is selected.

Mailfilter

Add filter rule

With + Add rule a new filter rule is created.
A unique Rule name must be assigned.
The Conditions with -Operator determines,

whether all conditions must be fulfilled ( and )
or whether it is sufficient if only one condition of the filter rule is fulfilled ( or ).

Criteria

Filtering according to the criteria listed below is possible. Several conditions can be combined using the button at the bottom right.

Criteria Category

Criteria and their configuration options

Protocol

Protocol

Adresswerte

Adresswerte

Automatische Erkennung

Automatische Erkennung

Inhalt

Inhalt

Domains Result Filter

Domains Result Filter

DMARC result/policy recommendation

DMARC result/policy recommendation

Should only be used in conjunction with a specific domain from which correct dkim signatures are expected.

Ähnlichkeitserkennung

Ähnlichkeitserkennung
notempty

New as of v14.1.1 Experimentell

Further configuration hints can be found in our best practice article on Mail Security.

Actions

The following options are available for Do action:

The check for the set of rules

Filter applicable content and
Mark email in subject with

is not aborted but continued.
Further filter rules can be applied to these emails.

In all other action cases, if the criteria apply, the check for the rule set is terminated after the action.

Action

Description

Accepts the email. The test for the rule set is completed.

The sender receives a notification that their email has been rejected.

This option must not be used when using the POP3 proxy!

notempty

When using the Mail-Connector, this function is strongly discouraged.
Neither the sender nor the recipient will be notified that the email has been rejected!

Additional input of quarantine duration in minutes. Example: 30 minutes

This option must not be used when using the POP3 proxy!

(and hold a predefined time (see Settings) for viewing)

This option must not be used when using the POP3 proxy!

The email is disposed off without the sender being notified.

This option must not be used when using the POP3 proxy!

notempty

Revised recognition and marking

Marks all links in an e-mail with ℹ️. Text that looks like a link but refers to another address is marked with ⛔.

Link text and display text the same (with and without protocol) (Link text: https://securepoint.de, Display text: ( https:// ) securepoint.de) → ℹ️
Link text with non-link-like display text (Link text: https://securepoint.de, Display text: Besuch uns auf unserer Webseite) → ℹ️
Link text with link-like, different display text (with and without protocol) (Link text: https://securepoint.de, Display text: ( https:// ) github.com) → ⛔
Mailto link (Link text: mailto: HomerS@ttt-point.de, Display text: HomerS@ttt-point.de) → ℹ️ (all links with mailto: as protocol receive an info icon)
No link text with a link-like display text without protocol (Link text: @, Display text: @securepoint.de) -> no marking
Images with embedded link (<a href="https://securepoint.de><img src="https://link.to.image.de/image.png></a>) → ℹ️
Images without embedded link (<img src="https://link.to.image.de/image.png>) → no marking
HTML-Buttons → ℹ️

Text, which is added to the subject header to mark an email so that it can, for example, be relocated from the mail server to a corresponding folder.

Behavior for action Mark email in subject with

The behavior of a mail filter rule with the action depends on whether the email is in quarantine or not.

Email is not in quarantine: If an email is sent or received for which this mail filter rule applies, the set marker is placed in the email subject.
Email is in quarantine: If an email is placed in quarantine or an email in quarantine is resent where this mail filter rule applies, the subject not is changed.
Reason: The information from the original email is saved in the mail archive. Therefore, the subject cannot be changed.

Allowlist exception rule

In a allowlist rule, the acceptance of a mail is defined under certain conditions. In order for a rule to work as a allowlist rule, the order must be defined so that this rule takes precedence over the general spam quarantine rule. By clicking and holding the left mouse button on the allowlist rule (pos. 7) in the "Pos." column, this rule is moved upwards above the general Spam_SMTP filter rule. Once the rule has reached the desired position, the mouse button is released and the allowlist rule is assigned a new position number according to its ranking.

Move filter rule

Further configuration hints can be found in our best practice article on Mail Security.

URL-Filter

Text for emails that have been filtered because of the URLs they contain.			Mailfilter UTMuser@firewall.name.fqdnApplications Mailfilter-Log URL filter with some filters

Add Rule Add Rule
Type Domain	anyideas.com	Domain in plain text notation. All subdomains and subpages are filtered.	Add Rule UTMuser@firewall.name.fqdnApplications Filter rules
Type URL	.anyideas.com/pages/	Only the exact URL is filtered (wildcard * is possible).
Type URL Regex	.*\.anyideas\.com	URL in regex format, which allows numerous placeholders Syntax of regular expressions - Regex
Type Category	Unknown	Content filter list maintained by Securepoint. An overview with all categories can be found here. Category: Unknown This allows you to block access to all websites that have not yet been classified by Securepoint. Reporting of accidentally wrongly categorised pages here.

Settings

In this section, you can create a spam report, modify the blocking messages, and define the criteria according to which the emails are stored in the UTM mail archive.

General

notempty

Neu ab v14.0: Aktivierung direkt im Mailfilter

Caption	Value	Description	Mailfilter UTMuser@firewall.name.fqdnApplications Mailfilter-Log Activation of the mail filter under Applications Mailfilter Area Settings Section General
Mail filter for Mailrelay / Mail-Connector:	Off	Activates the mail filter for Mailrelay and Mail-Connector
Mailfilter for POP3-Proxy	Off	Activates the mail filter for POP3 proxy

Spam report

The spam report can inform email users at certain intervals about emails filtered, blocked or quarantined by the UTM. This report can be sent either on a specific day of the week or daily, at a specific time.

Action	Value	Description	Mailfilter UTMuser@firewall.name.fqdnApplications Mailfilter-Log Email digest
Enable reports:	None (Default)	No spam reports will be sent.
	Users	Reports are sent to the users.
	Users and Admin	Reports are sent to the users and an overview is sent to the administrator.
Delivery Condition:	Deliver always (Default)	In any case, a spam report will be sent.
	Not accepted	A spam report will only be delivered if at least one email has been filtered, quarantined or rejected.
	Quarantined or filtered	A spam report will only be delivered if at least one email has been quarantined or filtered.
Alternative Hostname / IP:		If the web interface with the mail server is to be accessed via an external IP or another host name.
Day:	Monday	This report can be sent either on a specific weekday or Every day .
1. Report	notempty updated 20 : 00 Uhr	Specifies the time for sending the report.
2. Report 3.Report 4. Report	Off	With every day reports, a total of four reports can be sent at specified times.

In order for the report to reach the e-mail user, it is necessary for the e-mail user to be in a group with the 'Spamreport permission.

If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address.

Gruppe hinzufügen UTMuser@firewall.name.fqdnAuthentifizierungBenutzer Add a group under Authentication Users The setting for this is made in the menu
Authentication Users Groups + Add Group or Edit under Permissions:
The following sections must be activated here:

Email digest

On activates the creation of the spam report

Userinterface

On The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.

The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.

In the Mailfilter section, further settings must be made, including the e-mail address to which reports are sent:

<This function may allow the downloading of viruses and should therefore only be allowed for experienced users!/li> }}

Caption	Default	Description
Allow downloads of following attachments:	None (Default)	Members of this group can download attachments from mails in the user interface that meet certain criteria.
	Filtered but not quarantined
	Quarantined but not filtered	This function may allow the downloading of viruses and should therefore only be allowed for experienced users!
	Quarantined and/or filtered	This function may allow the downloading of viruses and should therefore only be allowed for experienced users!
Allow forwarding of following emails: Die Berechtigung Mailfilter Administrator überschreibt diese Konfiguration mit dem Default Wert. notempty updated	None	Members of this group can forward emails in the user interface that meet certain criteria
	Filtered but not quarantined
	Quarantined but not filtered (Default)	This function may allow the forwarding of viruses and should therefore only be allowed for experienced users!
	Quarantined and/or filtered	This function may allow the forwarding of viruses and should therefore only be allowed for experienced users!
Report email address:		Email address to which a spam report is sent. If no entry is made here, the spam report is sent to the first email address in the list. If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address..
Report language:	Default	Default under Network Server settings → Firewall → language of reports It can be specifically selected: German or English
Email address
Email address		Adding a mail address to the list
support@ttt-point.de		Email accounts that can be viewed by members of this group to control the mail filter. Delete with

Spam report to the user.

Replacement messages

Replacement messages

Type	Default message	Description
Here you define texts to be displayed instead of the blocked email section (plain text, formatted text or attachment). The text can be modified with the editing tool .			Mailfilter UTMuser@firewall.name.fqdnApplications Mailfilter-Log Replacement messages
Content-Blocking	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been blocked because of their content or attachment'.
URL-Filter	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been filtered because of the URLs they contain.
Virus-Blocking	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been blocked due to "'virus detection"'.

Mail archive

Guidelines on how emails are stored in the quarantine archive of the UTM.
Criterion / Action	Default	Description	Mail archive settings under Applications Mail filter Area Settings section Mail Archive
Maximum number of emails:	1024	Specifies how many mails are held locally on the UTM.
Maximum email age:	7 Days	Defines the time of reproaching.
Maximum archive size:	128 Megabytes	Determines the amount of storage space available for mails. When the limit is reached, the oldest mails are deleted.
Save all email transactions:	Off	When activated, the meta information' on unobjectionable mails is saved in addition to the complete filtered and rejected mails.
Deliver again as attachment:	Off	Emails in quarantine can alternatively be sent as attachment in a new email.
TNEF handling:notempty New as of 12.6.2 Formerly Activate TNEF decoding	Do not decode	Emails whose formatted body elements or attachments have been encoded by Microsoft Outlook in the proprietary TNEF format (.dat attachments) are not decoded and are therefore not scanned by the mail filter.
	Decode and replace	TNEF format content, is decoded and replaced to ward off malware.
	Decoding	TNEF format content is decoded in order to examine it, but is not generally replaced. It will of course still be removed if it has been classified as inadmissible.

Conclusion

Finish the configuration with Save.

Mail-Header

The following values can be set under the X-Securepoint header field by the mail filter:

X-Securepoint: Virusscan Failure
X-Securepoint: Spamcheck Failure
X-Securepoint: Virus found (virus_name)
X-Securepoint: Content Changed
X-Securepoint: Spam
X-Securepoint: Probably Spam
X-Securepoint: UrlFilterSpam
X-Securepoint: Bulk
X-Securepoint: FHASH notempty
neu

Sets of emails can be selected with the help of tags. A pattern is created based on these sets and each new incoming email is checked for similarities using this pattern. Certain actions can then be carried out using corresponding mail filter rules			Mailfilter UTMuser@firewall.name.fqdnApplications Mailfilter-Log The overview of existing tags
In order for emails to be tagged, they must be saved in the mail archive. It is therefore advisable to activate the option Save all email transactions under Applications Mail filter Area Settings in Mail archive Yes.
The following is displayed in the tag overview: Name: The name of the tag Description: The description of the tag, if available Used in mail filter rules: Displays the mail filter rules in which this tag is used Opens the dialog for editing the tag Deletes the tag

A new tag is added with the Add tag button.
Caption	Value	Description	Add tag UTMuser@firewall.name.fqdnApplicationsMailfilter Window for adding a tag
Name:		Choose a suitable name for the tag
Description:		Optional Enter a description for the function of this tag
Use the Save and close button to save the tag and close the window.

Fill in tags
A filter rule must be configured in order to apply a created tag. In Filter rules, create a new filter rule using the Add rule button, or edit the filter rule for an existing filter rule using the button Configure the filter rule Under When an email arrives and resembles an email with the tag, or and does not resemble an email with the tag Select the created tag After saving the filter rule, this tag can be used in the user interface. This wiki article describes further details.

User permission
In order for a user to be able to tag emails, this user requires the corresponding group authorization. Under Authentication User , the corresponding group is selected via Edit under Groups. The following authorizations must be active in the Authorizations section: On Userinterface On Mailfilter Administrator On Mailtag Administrator			Edit group UTMuser@firewall.name.fqdnAuthenticationUser The required active authorizations

CLI
The following CLI commands are available for tags: Add email to tag mail filterng tag add mail <name> tag <name> If the tag does not exist, a new one is created Create tag name with description mail filterng tag set description <text> tag <name> Set description mail filterng tag set description <text> tag <name> Information about existing tags mail filterng tag get Return list of archived emails with associated tag mail archive get Delete entire day mail filterng tag purge tag <name> Remove email from tag mail filterng tag remove mail <name> tag <name>

Mailfilter

Contents

Introduction

Requirement

Filter rules

Overview

Add filter rule

Criteria

Protocol

Adresswerte

Automatische Erkennung

Inhalt

Domains Result Filter

DMARC result/policy recommendation

Tags

Ähnlichkeitserkennung

Actions

Behavior for action Mark email in subject with

Allowlist exception rule

Tags

Fill in tags

User permission

CLI

URL-Filter

Add Rule

Settings

General

Spam report

Replacement messages

Mail archive

Conclusion

Mail-Header