Mailfilter

notempty

Dieser Artikel bezieht sich auf eine nicht mehr aktuelle Version!

notempty

Der Artikel für die neueste Version steht hier

notempty

Zu diesem Artikel gibt es bereits eine neuere Version, die sich allerdings auf eine Reseller-Preview bezieht

ds on or does not end onIn the click box, elements can now be selected or entered again. }}

Mailfilter

Description of the Mailfilter

Last adaptation to the version: 12.2.2

New:

• For authenticated users, there is a new filter criterion
• In the URL-Filter it is now also possible to filter on domain and URL regex

notempty

This article refers to a Resellerpreview

11.8.8 11.8.6 11.8 11.7

---

Introduction

In order to determine whether an incoming email is spam, the POP3 proxy, mail relay and mail connector can pass incoming emails to the Mailfilter. The Mailfilter consists of the:

• Cyren scan daemon,
• the ClamAntivirus
  Only for systems that meet the requirements
    ,
• the Securepoint content filter and
• a URL filter.

If a web link is found within the email which matches the URL filter or which is recognized by the content filter, a freely editable replacement message appears instead of the content section of the email.
By using the Mail Connector, it is possible to check not only POP3 but also emails fetched with IMAP as well as the two encrypted variants through the Mailfilter.

The UTM mail archive stores mails that have been quarantined using the filter rule.
Emails forwarded and delivered by the UTM (HAM) are no longer found in the mail archive unless this option is explicitly activated.

Requirement

For the Mailfilter to receive mails, the POP3 proxy, the mail relay or the mail connector must be configured.

Filter rules

Filter rules

Overview

The filter rules are used to decide how to proceed with emails for which defined properties have been detected.

A distinction is made between the SMTP and POP3 protocols as well as the mail connector.
Via the Mail Connector, the UTM is able to read emails from a mail server using the POP3 and IMAP protocols and their encrypted variants POP3S and IMAPS. It also inspects them for spam and malware by using the Mailfilter.

Furthermore, a distinction is made between the protocols POP3 and SMTP.
If the mail relay is used, the protocol is SMTP. If the POP3 proxy is used, the POP3 protocol is selected.

---

Configuration

Configuration

Filterregel bearbeiten

With + Add rule a new filter rule is created.

A unique Rule name must be assigned.

The Conditions with and -Operator determines,

• whether all conditions must be fulfilled ( and )
• or whether it is sufficient if only one condition of the filter rule is fulfilled ( or ).

Criteria

Filtering according to the following conditions is possible:

If an email is received...

Condition	Operator	Value
and protocol	is is not	SMTP Mail-Connector POP3
and source host	is is not is in is not in matches regex See Wiki article about Regex.    ends with ends not with	» ✕any values
and destination host	see source host
and sender	see source host
and recipient	see source host
and header field additionally: Specification of the header field	see source host The header field »from« indicates a sending mail server (Received: from) - not the »Sender« field.
and is classified / is not classified as spam<
and is classified / is not classified as suspicious
and is classified / is not classified as bulk email
and has a virus / has no virus
and is captured by URL filter / is not captured by URL filter
and has been submitted / has not been submitted by an authenticated user New as of v12.2.2
and with content that MIME-Type oder Filename	see source host
and DKIM result for domain in 11.8.7     Enter the domain	exists and is is nonexistent or is not	» ✕fail » ✕pass » ✕temperror
	Prerequisite for the use is in the menu → Applications →Mailrelay → Tab General activation of the option SPF/DKIM/DMARC checks: On If elements of an email were signed by a domain DomainKeys Identified Mail, this verifies the signature and adds the result to the header of the email. The signature is verified with the public key from the DNS of the mail domain. At this point the result that was added to the header is queried. Potential results: » ✕fail Signature invalid » ✕pass Signature valid » ✕temperror mostly: Error in DNS resolution; general: Error that may not occur at a later time.
and SPF result for domain in 11.8.7     Enter the domain	exists and is is nonexistent or is not	» ✕fail » ✕neutral » ✕pass » ✕permerror » ✕softfail » ✕temperror
	Prerequisite for the use is in the menu → Applications →Mailrelay → Tab General activation of the option SPF/DKIM/DMARC checks: On The sender of an email can enter in a txt record of his domain all computers (servers) authorized to send emails with host name and IP address. These entries are synchronized at smtp level with the entry Received: from from the mail header and the result is added to the mail header. At this point the result that was added to the header is queried. Potential results: » ✕fail Client-Host explizit nicht autorisiert » ✕neutral keine explizite Aussage getroffen » ✕pass Prüfung erfolgreich » ✕permerror Fehler (z.B. Syntax) in DNS Resource Records » ✕softfail nicht explizit unautorisiert, aber auch nicht autorisiert ("~"-qualifier im DNS RR) » ✕temperror meist: Fehler in der DNS-Auflösung; generell: Fehler, der zu einem späteren Zeitpunkt ggf. nicht mehr auftritt
and DMARC result/policy-to-enforce is in 11.8.7	pass quarantine reject Prerequisite for the use is in the menu → Applications →Mailrelay → Tab General activation of the option SPF/DKIM/DMARC checks: On Neither SPF nor DKIM make any demands on a connection between the sending or signing domain and other characteristics of the email (e.g. header fields). This means that anyone who has control over DNS entries for any domain can carry out valid SMTP transactions ("pass") in the sense of SPF using the "MAIL FROM" command or create valid signatures for this domain in the sense of DKIM. That is why DMARC (https://tools.ietf.org/html/rfc7489) can be used to establish this connection: A DMARC check is only successful if either SPF or DKIM checks are valid and the domain used matches the domain used in the "From" header field of the email (depending on the option, the same or a subdomain). In addition, a domain owner can define via DMARC which action (reject, quarantine) should be performed if the check is not successful.

The + button can by used to apply additional critaria for this filter.

Hint: Further configuration hints can be found in our best practice article on Mail Security

---

Aktionen

The following options are available for Do action:

• The check for the set of rules
  • Filter applicable content and
  • Mark email in subject with
  is not aborted but continued.
  Further filter rules can be applied to these emails.
• In all other action cases, if the criteria apply, the check for the rule set is terminated after the action.

Action	Description
Accept email	Accepts the email. The test for the rule set is completed.
Reject email	Important: This option must not be used when using the POP3 proxy! Important:  When using the Mail-Connector, this function is strongly discouraged. Neither the sender nor the recipient will be notified that the email has been rejected!
Quarantine email and filter again: Neu in 11.8	Additional input of quarantine duration 30 in minutes Important: This option must not be used when using the POP3 proxy!
Quarantine email	(and hold a predefined time (see Settings) for viewing) Important: This option must not be used when using the POP3 proxy!
Discard email	Important: This option must not be used when using the POP3 proxy!
Filter applicable content	A Replacement Message is displayed for the relevant section (plain text, html text, attachment, etc.).
Highlight email subject header with	Text, which is added to the subject header to mark an email so that it can, for example, be relocated from the mail server to a corresponding folder.

---

Whitelist exception rule

Whitelist exception rule

Move filter rule

In a whitelist rule, the acceptance of a mail is defined under certain conditions. In order for a rule to work as a whitelist rule, the order must be defined so that this rule takes precedence over the general spam quarantine rule. By clicking and holding the left mouse button on the whitelist rule (pos. 7) in the "Pos." column, this rule is moved upwards above the general Spam_SMTP filter rule. Once the rule has reached the desired position, the mouse button is released and the whitelist rule is assigned a new position number according to its ranking.

Hint: Further configuration hints can be found in our best practice article on Mail Security.

---

URL-Filter

URL-Filter

The URL filter is used to check whether emails contain web links.

If a link that is in this list is detected in the email, a replacement message is displayed instead of the entire mail text.
Harmless URLs can explicitly be allowed here, so that they are not rejected by the category filter. (Pay close attention to the order as with the whitelist filter!).

With the button the URLs can be allowed or blocked .

Wildcards * can be used the URLs.
Categories are checked using the Securepoint content filter, which is also used with the Webfilter.

Add Rule Add Rule
Type ‌ Domain	example.com	Domain in plain text notation. All subdomains and subpages are filtered.	Filter rules
Type ‌ URL	*.example.com/pages/*	Only the exact URL is filtered (wildcard * is possible).
Type ‌ URL Regex	.*\.example\.com	URL in regex format, which allows numerous placeholders Syntax of regular expressions - Regex
Type ‌ Category	category	Content filter list maintained by Securepoint. An overview with all categories can be found here. notempty New as of v12.5 Category: Unknown This allows you to block access to all websites that have not yet been classified by Securepoint. Reporting of accidentally wrongly categorised pages here.

Settings

In this section, you can create a spam report, modify the blocking messages, and define the criteria according to which the emails are stored in the UTM mail archive.

Spam report

Spam report

Email digest

The spam report can inform email users at certain intervals about emails filtered, blocked or quarantined by the UTM. This report can be sent either on a specific day of the week or daily, at a specific time.

Action	Value	Description
Enable reports:	None (Default)	No spam reports will be sent.
	Users	Reports are sent to the users.
	Users and Admin	Reports are sent to the users and an overview is sent to the administrator.
Delivery Condition:	Deliver always (Default)	In any case, a spam report will be sent.
	Not accepted	Quarantined or filtered
	Quarantined or filtered	A spam report will only be delivered if at least one email has been quarantined or filtered.
Alternative Hostname / IP:		If the web interface with the mail server is to be accessed via an external IP or another host name.
Day:	Monday (Default)	This report can be sent either on a specific weekday or Every day .
1. Report	20:00 o'clock	Specifies the time for sending the report.
2.Report 3.Report 4.Report	Disabled	With every day reports, a total of four reports can be sent at specified times.

In order for the report to reach the e-mail user, it is necessary for the e-mail user to be in a group with the 'Spamreport permission.

If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address.

Add a group under → Authentication →Users

The setting for this is made in the menu
→ Authentication →Users Groups + Add Group or Edit under Permissions:

The following sections must be activated here:

Email digest

On activates the creation of the spam report

Userinterface

On The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.

The email address can be taken from a directory server such as ActiveDirectory or LDAP if the UTM is connected to it. Otherwise, the user must be created with his email address on the UTM.

In the Mailfilter tab, further settings must be made, including the e-mail address to which reports are sent:

<This function may allow the downloading of viruses and should therefore only be allowed for experienced users!/li> }}

Email address
Caption	Default	Description
support@ttt-point.de		Email accounts that can be viewed by members of this group to control the mail filter. Delete with
Email address		Adding a mail address to the list
Allow downloads of following attachments:	None (Default)	Members of this group can download attachments from mails in the user interface that meet certain criteria.
	Filtered but not quarantined
	Quarantined but not filtered	This function may allow the downloading of viruses and should therefore only be allowed for experienced users!
	Quarantined and/or filtered	This function may allow the downloading of viruses and should therefore only be allowed for experienced users!
Allow forwarding of following emails:	None (Default)	Members of this group can forward emails in the user interface that meet certain criteria
	Filtered but not quarantined
	Quarantined but not filtered	This function may allow the forwarding of viruses and should therefore only be allowed for experienced users!
	Quarantined and/or filtered	This function may allow the forwarding of viruses and should therefore only be allowed for experienced users!
Report email address:		Email address to which a spam report is sent. If no entry is made here, the spam report is sent to the first email address in the list. If several mail addresses for a user are stored in an AD, the entry configured there as Primary SMTP address is used as the default address..
Report language:	Default	Default under → Network →Server settings → Firewall → language of reports It can be specifically selected: German or English

Spam report to the user.

Replacement messages

 Replacement messages 

Replacement messages

Here you define texts to be displayed instead of the blocked email section (plain text, formatted text or attachment). The text can be modified with the editing tool .

Type	Default message	Description
Content-Blocking	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been blocked because of their content or attachment'.
URL-Filter	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been filtered because of the URLs they contain.
Virus-Blocking	The content is rejected due content restrictions. If you think this is incorrect, please contact the IT Service Desk.	Text for emails that have been blocked due to "'virus detection"'.

---

Mail archive

Mail archive

Mail archive settings

Guidelines on how emails are stored in the quarantine archive of the UTM.

Criterion / Action	Default	Description
Maximum number of emails:	1024	Specifies how many mails are held locally on the UTM.
Maximum email age:	7 Days	Defines the time of reproaching.
Maximum archive size:	128 megabytes.	Determines the amount of storage space available for mails. When the limit is reached, the oldest mails are deleted.
Save all email transactions:	Off	When activated, the meta information' on unobjectionable mails is saved in addition to the complete filtered and rejected mails.
Deliver again as attachment: New in 11.8.6	Off	Emails in quarantine can now alternatively be sent as attachment in a new email.
Activate TNEF decoding: New in 11.8.6	Off	When activated, Emails whose formatted body elements or attachments have been encoded by Microsoft Outlook in the proprietary TNEF format can be captured by the Mailfilter.

Conclusion

Finish the configuration with Save and Close