Best practice on mail security
Last adaption: 04.2024
New:
notemptyThis article refers to a Resellerpreview
The article describes a best practice for mail security.
These are our recommended settings.
All information provided without guarantee!
These are our recommended settings.
All information provided without guarantee!
Requirements
These recommendations relate to the following scenario:
- Receiving emails via the mail relay
- Delivery takes place directly via MX
- Filtering takes place directly on MX input
- Defining a global e-mail address
Mailrelay
Under , set the configuration to accept only emails to the recipient's address.
General
| Caption | Value | Description | UTMuser@firewall.name.fqdnApplications 
|
|---|---|---|---|
| Mailfilter: | On | The mail filter function must be activated | |
| SPF/DKIM/DMARC audits: | On | Adds an RFC 8601 Authentication-Results header to the mail and allows filtering for corresponding SPF/DKIM/DMARC results in a Mailfilter rule (see below). | |
Relaying
Relaying list Relaying list
With the relaying list can be supplemented. The following configurations are useful here: |
 Relaying
| ||
| Caption | Value | Description | |
|---|---|---|---|
| Emails, addressed to the anyideas.de domain should be forwarded by mail relay | |||
| Domain: | anyideas.de | Example domains for receiving emails | |
| Option: | Emails addressed to this domain | ||
| Action: | Relay | ||
| If outbound emails are to be sent via the mail relay of the UTM, another entry is required: | |||
| Domain: | 192.168.175.100 | IP address of the internal mail server | |
| Option: | While making a connection notempty With this option, the mail relay forwards all emails coming from this host regardless of the recipient (open relay). This option should therefore be used with the utmost care, e.g. only for internal mail servers!
| ||
| Action: | Relay | ||
| Entry for a mail server that is to be blocklisted: | |||
| Domain: | 203.0.113.113 | IP address of the foreign mail server | |
| Option: | While making a connection | ||
| Action: | refuse | ||
OptionsOptions | |||
| Use exact domain name for relaying: | On | This option will not accept emails to recipients within a subdomain. | |
TLS settingsTLS settings | |||
| TLS encryption as a server: | On | TLS encryption for mail relay must be enabled, otherwise emails will be received over unencrypted connections.
See also the notes of the German BSI for using TLS (german language). | |
| Certificate: | Importing a certificate whose CN corresponds to the host name of the UTM is optional. If such a certificate is not imported, the mail relay uses a self-signed certificate for the purpose of transport encryption. | ||
| TLS encryption as a client: | encrypt | Ensures that emails are always sent via an encrypted connection.
| |
SMTP routes
Greylisting
Greylisting
Greylisting causes the delivery attempt of an unknown mail server to be rejected at first.
Spambots usually do not make any further delivery attempts, so the delivery of spam has already been successfully stopped before the mail had to go through the spam filter engine.
A regular mail server, on the other hand, will make another, this time successful, delivery attempt after a certain period of time.
In addition to fending off simple spambots through greylisting, valuable time is also gained to load new definitions to detect any new spam waves.
When using the mailconnector, greylisting must not be configured
OptionsOptions | |||
| Caption | Recommendation | Description |  Greylisting
|
|---|---|---|---|
| Greylisting: | On | Enables greylisting | |
| SPF: | On | If the Sender Policy Framework of the sender domain is correctly entered in the DNS, the mail is delivered without delay. In the SPF record, all mail server IP addresses of the sender are entered that are authorized to send emails. The recipient then checks the mail header field "Mail From" or the "HELO" command to see which domain is entered or named there and whether it matches one of the IP addresses in the SPF record. If the IP address of the sender does not match those of the SPF record, the mail goes into greylisting. | |
| Add header: | On | By default, an additional greylisting entry is added for each recipient listed in the mail header. This can cause issues if there are many recipients in the header. When disabled No no greylisting headers will be inserted. | |
| Automatic allow list for: | 7 days |
The value can be increased up to 60 days. | |
| Delay: | 2 minutes |
Time frame given to the sending mail server to make another delivery attempt. notempty Depending on the configuration of the sending mail server, redelivery may be delayed by much more than the configured time frame (default settings 2 minutes) - in extreme cases by several hours. notempty If a larger value is set for Delay for instance:
30
minutes selected, the scan engine may have a higher probability of detecting new outbreaks with redelivered emails, because the virus signatures may have been updated in the meantime. | |
Advanced Advanced
| |||
Greeting PauseGreeting Pause | |||
| Caption | Recommendation | Description |  |
| Status: | On | Similar to Greylisting, greeting pause takes advantage of the fact that the SMTP protocol is not fully implemented in spam bots. This allows them to be distinguished from regular mail servers. The greeting is a greeting that is transmitted from the mail relay to the sending mail server. This could look like this, for example: 220 firewall.foo.local ESMTP Ready | |
Recipient limitationsRecipient limitations | |||
| Status: | Off | This option blocks E-mails that have more than a defined number of recipient addresses. In the meantime, most spam emails are sent as individual emails. This option should only be activated in special cases. | |
| Limit: | 25 |
Number of recipients that must not be exceeded (Attention: May apply to company-internal mail groups!). | |
Limitations per clientLimitations per client | |||
| Limit connections: | On | Activates the function for configuring the maximum number of permitted connections. The connection limit counteracts possible DDOS attacks. | |
| Exceptions | Host | If outbound emails are also to be sent via the mail relay of the UTM, the corresponding mail servers should be added. | |
| Permitted connections: | 2 |
Here you can set how many connections the mail relay accepts simultaneously. | |
| Enable access control | On | Possible DOS attacks are counteracted by the access control. | |
| Time slot: | 60 seconds
| ||
| Connections per time slot: | 5
| ||
OtherOther | |||
| HELO required: | On | If HELO is enabled, the SMTP client is requested to give its name. Must absolutely remain activated (default) This option exists to ensure backward compatibility. | |
| Reverse DNS lookup needs: | On | Checks if the HELO name exists and applies in the PTR. Deactivate action Off
| |
| Accept unresolvable domains: | No | Checks if host address and sender address are resolvable. Should remain disabled for SMTP. notempty Must be enabled when using the mailconnector
| |
| Maximum number of processes: | 10 |
The value should only be adjusted in case of permanently high mail volume and must consider the performance of the hardware! | |
Mailfilter
Under many different Filter rules should be adjusted and/or newly created:
Filter rules
| Filter rule | Description |
|---|---|
Filter rule »is classified as SPAM / SMTP«Spam_SMTP |
Run action:
Default: Accept email When an e-mail is received:
Mail servers or senders whose emails are classified as SPAM have attracted attention as SPAM sources in the past. Emails from these systems should not be accepted under any circumstances.
Accepting such emails (even if they are quarantined afterwards) only makes the email domain more interesting for potential SPAM and virus senders. notempty
Securepoint recommends that these emails be rejected. |
Filter rule »is classified as suspicious«.Possibly_Spam |
Run action: Default: Accept email
When an e-mail is received:
Emails that are classified as suspicious contain suspicious patterns and content and should not be delivered to the user's mailbox.
notempty
Securepoint recommends that these emails be quarantined. Here we recommend
|
Filter rule »contains a virus«Virus |
Run action: Default: Accept email
When an e-mail is received:
Accepting such emails (even if they are quarantined afterwards) only makes the email domain more interesting for potential SPAM and virus senders.
notempty
Securepoint recommends that these emails be rejected. Here we recommend
Here we recommend
|
Filter rule »with content of«Filter_Extensions |
Run action:
Default: Accept email When an e-mail is received:
Executable files should not be delivered. They are filtered based on the file extension. Can be added to as needed.
notempty
Securepoint recommends that these emails be rejected. Here we recommend
|
Filter rule »is a bulk email«bulk_rescan Bulk_Mail |
rule name
bulk_rescan
Run action:
30 minutes
Default: Accept email When an e-mail is received:
E-Mails classified as BULK are currently being sent out in masses and should not be delivered to the user's mailbox.
These could be, for example, the first emails of a new SPAM wave. notempty
Securepoint recommends that these emails be quarantined. Here we recommend BULK Mail
Another rule is needed that defines how to proceed in case of a new scan with the same result! rule name
Bulk_Mail
Run action:
Default: Accept email When an e-mail is received:
From
»anyideas.de |
Filter rule »Investigate / further investigations are recommended«Investigate |
Run action:
15 minutes
Default: Accept email When an e-mail is received:
The spam filtering engine expects that the category of this email may change in the next 15 minutes.
notempty
Securepoint recommends that these emails be quarantined. Here we recommend Check content (no classification)
|
Filter rule »was caught by the URL filter«URL_Filter |
Run action:
Default: Accept email When an e-mail is received:
Emails containing a dangerous URL should not be accepted and delivered to the user's mailbox.
Please note the settings of the URL filter. notempty
Securepoint recommends that these emails be quarantined. Here we recommend
|
The current threat situation makes it clear that standard procedures can no longer keep up in the fight against malware.
Documents are identified by MIME types and file extensions. | |
Filter rule »Word documents based on MIME types«Word_MIME |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
MIME types can now be selected in the click box. This list can be entered as content. application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document, application/vnd.openxmlformats-officedocument.wordprocessingml.template, application/vnd.ms-word.document.macroEnabled.12, application/vnd.ms-word.template.macroEnabled.12 In order for Word documents to be filtered based on MIME types, a new rule is needed.
notempty
Securepoint recommends emails with Office documents attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »Excel documents based on MIME types«Excel_MIME |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, application/vnd.openxmlformats-officedocument.spreadsheetml.template, application/vnd.ms-excel.sheet.macroEnabled.12, application/vnd.ms-excel.template.macroEnabled.12, application/vnd.ms-excel.addin.macroEnabled.12, application/vnd.ms-excel.sheet.binary.macroEnabled.12 In order for Excel documents to be filtered based on MIME types, a new rule is needed.
notempty
Securepoint recommends that emails with Office documents attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »Open Office / Libre Office documents based on MIME types«OOffice_MIME |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
application/vnd.oasis.opendocument.chart-template,application/vnd.oasis.opendocument.database,application/vnd.oasis.opendocument.formula, application/vnd.oasis.opendocument.formula-template,application/vnd.oasis.opendocument.graphics,application/vnd.oasis.opendocument.graphics-template, application/vnd.oasis.opendocument.image,application/vnd.oasis.opendocument.image-template,application/vnd.oasis.opendocument.presentation, application/vnd.oasis.opendocument.presentation-template,application/vnd.oasis.opendocument.spreadsheet, application/vnd.oasis.opendocument.spreadsheet-template,application/vnd.oasis.opendocument.text,application/vnd.oasis.opendocument.text-master, application/vnd.oasis.opendocument.text-template,application/vnd.oasis.opendocument.text-web, text/rtf, application/rtf notempty Securepoint recommends emails with Office documents attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »Office documents based on file extension«Office_Extension |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
File extensions can now be selected in the click box. This list can be entered as content. doc, dot, docx, docm, dotx, dotm, docb, xls, xlsx, xlt, xlm, xlsm, xltm, xlsb, xla, xlam, xll, xlw, ppt, pot, pps, ppa, pptx, pptm, potx, potm, ppam, ppsx, ppsm, sldx, sldm, pub, odt, ott, oth, odm, otg, odp, otp, ods, ots, odc, odf, odb, odi, oxt, rtf In order for Office documents to be filtered by file extension, a new rule is needed.
notempty
Securepoint recommends that emails with Office documents attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »Compressed files based on MIME types«Compressed_MIME |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
application/x-zip-compressed,application/zip In order for compressed files to be filtered based on MIME types, a new rule is needed.
notempty
Securepoint recommends that emails with compressed files attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »Compressed files based on extension«Compressed_Extension |
Run action:
30 minutes
Default: Accept email When an e-mail is received:
File extensions can now be selected in the click box. This list can be entered as content. zip,7z,ace,arj,cab,zz,zipx In order for compressed files to be filtered based on the file extension, a new rule is needed.
notempty
Securepoint recommends that emails with compressed files attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
Filter rule »ISO files based on MIME type or extension«images |
Rules with -Connect operators
Run action:
30 minutes
Default: Accept email When an e-mail is received:
File extensions can now be selected in the click box. This list can be entered as content. iso,img MIME types can now be entered in the click box. This list can be entered as content. application/x-cd-image, application/x-iso-image, application/x-iso9660-image In order for .iso and .img files to be filtered, a new rule is needed.
notempty
Securepoint recommends that emails with images attached are temporarily quarantined and filtered again after 30 minutes! Here we recommend
|
AL_mark or filter attachmentsAL_Anhänge markieren AL_Anhänge zustellen Filter attachments |
Scenario: Attachments from specific senders are to be tagged and delivered. All other attachments should be filtered.
rule name:
AL_Anhänge markieren
Run action:
Sender verified
When an e-mail is received:
»* Add criterion »anyideas.de
rule name
AL_Anhänge zustellen
Run action:
When an e-mail is received:
»* »anyideas.de Since this email was flagged - i.e. a filter applied - it is displayed in the quarantine as filtered. Nevertheless, thanks to the 2nd rule, it will be delivered.
rule name:
Filter attachments
Run action:
30 minutes
When an e-mail is received:
»* »anyideas.de |
Create allowlist exception rulesAllowlist |
If emails from a certain sender (here from securepoint.de) are to be delivered in any case, a allowlist exception must be created in the mail filter rule set. Run action:
When an e-mail is received:
from
»@ttt-point.de
|
Fake senderfake_sender_intern |
 In order to avoid accepting emails with fake internal senders (which usually enjoy a high level of trust), we recommend creating three filter rules according to the following example: In this example, emails of the mail domain @securepoint.de are to be accepted. The IP address of the mail server is assumed to be 192.168.175.100. notempty These are only sample addresses that need to be customized locally.
rule name
fake_sender_intern1
Run action:
When an e-mail is received:
»@ttt-point.de »192.168.175.100
rule name
fake_sender_intern2
Run action:
When an e-mail is received:
From Add criterion »@ttt-point.de »192.168.175.100
rule name
fake_sender_intern3
Run action:
When an e-mail is received:
From Add criterion »securepoint.de »192.168.175.100
|
Filter rule SPF failSPF fail |
Run action:
When an e-mail is received:
»anyideas.de
»fail
|
Filter rule SPF permerrorSPF permerror |
Run action:
SPF error / check sender!
When an e-mail is received:
»anyideas.de
»softfail or »permerror
|
Filter rule DKIMDKIM |
Run action:
When an e-mail is received:
»anyideas.de
»fail
|
Filter rule DMARC quarantineDMARC quarantine |
Run action:
When an e-mail is received:
|
Filter rule DMARC rejectDMARC reject |
Run action:
When an e-mail is received:
|
URL-Filter
Area URL-Filter
The URL filter verifies
- the URL itself. Further notes in the wiki about the Mailfilter.
This can be used in combination with the allow action to create mainly allowlists - in which content category the visited page falls.
This categorization is constantly updated by our content filter team.
Allowlist entries (e.g. Education (schools and training institutes, universities) can also be created here with the allow action, or blocklist entries with the action.
The following categories are preconfigured in installations since 11.8 and should not be missed in older installations:
| Type | Name | Description | Action |
|---|---|---|---|
| Category | This category contains URLs currently classified as malicious which spread malware and contain phishing pages (phishing, malware, botnets, crime ware, etc.) | block | |
| Category | This category contains URLs that provide pornographic or predominantly sexual content. | block | |
| Category | This category contains URLs that provide advice on hacking, warez, building malware, tricking systems or subscription traps. | block | |
| Category | Server and services for important software updates This category is intended for allowlist environments. |
allow |
notempty
Other categories are to be adapted to the requirements of the company
By clicking on the filter rule will be added.
Spam Report
Area Options SectionSpam Report
The spam report can inform email users at certain intervals about emails filtered, blocked or quarantined by the UTM. This report can be sent either on a specific day of the week or daily, at a specific time.
| Action | Value | Description |
|---|---|---|
| Enable reports: | (Default) | No spam reports will be sent. |
| Reports are sent to the users. | ||
| Reports are sent to the users and an overview is sent to the administrator. | ||
| Delivery Condition: | Deliver always (Default) | In any case, a spam report will be sent. |
| Not accepted | Quarantined or filtered | |
| Quarantined or filtered | A spam report will only be delivered if at least one email has been quarantined or filtered. | |
| Alternative Hostname / IP: | If the web interface with the mail server is to be accessed via an external IP or another host name. | |
| Day: | (Default) | This report can be sent either on a specific or . |
| 1. Report | 20:00 o'clock | Specifies the time for sending the report. |
| 2.Report 3.Report 4.Report |
Disabled | With every day reports, a total of four reports can be sent at specified times. |
In order for the report to reach the e-mail user, it is necessary for the e-mail user to be in a group with the 'Spamreport permission.
If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address.
Disclaimer and hints
Liability
This website was compiled with the greatest possible care. Nevertheless, no guarantee can be given for the correctness and accuracy of the information provided. Any liability for damages arising directly or indirectly from the use of this website is excluded. If this website refers to websites operated by third parties, Securepoint GmbH is not responsible for any content linked or referred from this site.
The following wiki articles may be helpful for setup.