notempty
Description of the mail filter
Last adaptation to the version: 11.8.6 (11.2019)
- New:
- New in version 11.8.6 Emails in quarantine can now alternatively be sent as attachment in a new email.
- New in version 11.8.6 Mailfilter now supports decoding of sections in Microsoft's proprietary TNEF -Format]
- The " email time lock": In the filter rules the action
can be selected.
The scan engine can have a higher detection probability for new viruses, which spread frequently via a certain file type, with the renewed delivery with virus signatures updated in the meantime. The basic delivery remains guaranteed.
Previous versions: 11.7 | 11.8
Introduction
In order to determine whether an incoming mail is spam, the POP3 proxy, mail relay and mail connector can pass incoming emails to the mail filter. The mail filter consists of the Cyren scan daemon, the ClamAntivurs, the Securepoint content filter and a URL filter. If a web link is found within the email which matches the URL filter or which is recognized by the content filter, a freely editable replacement message appears instead of the content section of the email. By using the Mail Connector, it is possible to check emails fetched with IMAP as well as the two encrypted variants through the mail filter in addition to POP3. The UTM mail archive stores mails that have been quarantined using the filter rule.
E ails forwarded and delivered by the UTM (HAM) are no longer found in the mail archive if this option is not explicitly activated.
Requirement
Note: For the mail filter to receive mails, the POP3 proxy, the mail relay or the mail connector must be configured.
Filter Rules
Overview
The filter rules are used to decide how to proceed with emails for which defined properties have been recognized. UTM is able to retrieve emails from a mail server via the protocols POP3 and IMAP and their encrypted variants POP3S and IMAPS and to check them for spam and malware using the mail filter. A distinction is also made between the protocols POP3 and SMTP. If the mail relay is used, the protocol is SMTP. If the POP3 proxy is used, the POP3 protocol is selected.
Configuration
With a new filter rule is created.
A unique Rule name must be assigned.
The Rules with -Operator determines whether all criteria must be fulfilled () or whether it is sufficient if only one criterion of the filter rule is fulfilled ().
Filtering according to the following is possible:
- Protocol - selectable is:
- Source host
- Target host
- Transmitter
- Receiver
- Header field
- Spam or not Spam
- suspicious or not suspicious at all
- Bulk emails or no bulk emails
- Contains virus or contains no virus
- was captured by URL filter or was not captured
- with content of its - selection
As condition you can
- is or is not
- Contains or does not contain
- matches Regex
- ends on or does not end onIn the click box, elements can now be selected or entered again.
With the button further criteria for this filter can be added.
Hint: Further configuration information can be found in our Best Practice article on Mail Security
The following options are available for do action::
| Action | Description |
|---|---|
| Important: This option must not be used when using the POP3 proxy! Important: When using the Mail-Connector, this function is strongly discouraged. Neither the sender nor the recipient will be notified that the email has been rejected! | |
New in 11.8 |
Additional input of quarantine duration 30 in minutes Important: This option must not be used when using the POP3 proxy! |
| (and hold a predefined time (see Settings) for viewing) Important: This option must not be used when using the POP3 proxy! | |
| Important: This option must not be used when using the POP3 proxy! | |
| A Replacement Message is displayed for the applicable section (plain text, html text, appendix, etc.). | |
| Text with which the subject is added in such a way that the mail is identified and can, for example, be moved from the mail server to an appropriate folder. |
Whitelist exception rule
In a whitelist rule, the acceptance of a mail is defined under certain conditions. In order for a rule to work as a whitelist rule, the order must be defined so that this rule takes precedence over the general Spam Quarantine rule. By clicking and holding the left mouse button on the whitelist rule (pos. 7) in the "Pos." column, this rule is moved upwards via the general Spam_SMTP filter rule. Once the rule has reached the desired position, the mouse button is released and the whitelist rule is assigned a new position number according to its ranking.
Hint: Further configuration notes can be found in our best practice article on Mail Security.
URL-Filter
The URL filter is used to check whether emails contain web links. If a link that is in this list is recognized in the mail, a replacement message is displayed instead of the entire mail text. Safe URLs can be explicitly allowed here so that they are not rejected by the category filter. (Note the order as with whitelist filters!).
With the button ✔ the URLs can be allowed or blocked .
For URLs wildcards can be used *. Categories are checked against the Securepoint content filter, which is also used with the Webfilter.
Settings
Here it is possible to create a spam report, change the blocking messages and define the criteria according to which the emails are stored in the UTM mail archive.
Email digest
The spam report can inform email users at certain intervals about emails filtered, blocked or quarantined by the UTM. This report can be sent either on a specific day of the week or daily, at a specific time.
| Action | Value | Description |
|---|---|---|
| Enable reports: | (Default) | No spam reports will be sent. |
| Reports are sent to the users. | ||
| Reports are sent to the users and an overview is sent to the administrator. | ||
| Delivery Condition: | Deliver always (Default) | In any case, a spam report will be sent. |
| Not accepted | Quarantined or filtered | |
| Quarantined or filtered | A spam report will only be delivered if at least one email has been quarantined or filtered. | |
| Alternative Hostname / IP: | If the web interface with the mail server is to be accessed via an external IP or another host name. | |
| Day: | (Default) | This report can be sent either on a specific or . |
| 1. Report | 20:00 o'clock | Specifies the time for sending the report. |
| 2.Report 3.Report 4.Report |
Disabled | With every day reports, a total of four reports can be sent at specified times. |
In order for the report to reach the e-mail user, it is necessary for the e-mail user to be in a group with the 'Spamreport permission.
If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address.
The setting for this is made in the menu
Groups or Edit under Permissions:
The following sections must be activated here:
- Email digest
- On activates the creation of the spam report
- Userinterface
- On The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.
The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.
In the Mailfilter tab, further settings must be made, including the e-mail address to which reports are sent:
| Email address | ||
| Caption | Default | Description |
|---|---|---|
| support@ttt-point.de | Email accounts that can be viewed by members of this group to control the mail filter. Delete with | |
| Email address | Adding a mail address to the list | |
| Allow downloads of following attachments: | (Default) | Members of this group can download attachments from mails in the user interface that meet certain criteria. |
| Allow forwarding of following emails: | (Default) | Members of this group can forward emails in the user interface that meet certain criteria |
| Report email address: | Email address to which a spam report is sent. If no entry is made here, the spam report is sent to the first email address in the list. If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address..
| |
| Report language: | Default under → Firewall → language of reportsIt can be specifically selected: or |
Spam report to the user.
Replacement messages
Here you define texts to be displayed instead of the blocked email section (plain text, formatted text or attachment). With the texts can be changed.
| Type | Default message | Description |
|---|---|---|
| Content-Blocking | The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk. |
Text for emails that have been blocked because of their content or attachment'. |
| URL-Filter | The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk. |
Text for emails that have been filtered because of the URLs they contain. |
| Virus-Blocking | The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk. |
Text for emails that have been blocked due to "'virus detection"'. |
Mailarchive
Specifications on how e-mails are stored in the quarantine archive of the UTM.
| Criterion / Action | Default | Description |
|---|---|---|
| Maximum number of emails: | 1024 |
Specifies how many mails are held locally on the UTM. |
| Maximum email age: | 7 days. |
Defines the time of reproaching. |
| Maximum archive size: | 128 megabytes |
Specifies the storage space available for mails. When the limit is reached, the oldest mails are deleted. |
| Save all email transactions: | Off | When activated, the meta information' on unobjectionable mails is saved in addition to the complete filtered and rejected mails. |
| Deliver again as attachment: New in 11.8.6 |
Off | Emails in quarantine can now alternatively be sent as attachment in a new email. |
| Activate TNEF decoding: New in 11.8.6 |
Off | Emails whose formatted body elements or attachments have been encoded by Microsoft Outlook in the proprietary TNEF format can be captured by the mail filter when activated. |
Conclusion
Finish the configuration with and