Implementing Your Email Content Security Policy

MailMarshal provides a powerful and flexible framework that allows you to enforce an Email Content Security policy. Configure MailMarshal to support your organizational Acceptable Use Policy for email usage. An Email Content Security policy typically has several goals:

• To stop spam.
• To block virus or malware infected email.
• To prevent illegitimate relaying of email.
• To control who can send email through your server.
• To prevent malicious email attacks
• To filter email messages and attachments according to local policies of the organization.

MailMarshal includes facilities to perform these tasks. MailMarshal is configured by default with settings and rules that implement some best practices and common filtering policies out of the box. This chapter gives an overview of typical policies and policy-related tasks, and the MailMarshal elements available to accomplish each task.

​

Configuring Email Content Security

Configure email content security using the MailMarshal Management Console. For basic information about the Management Console see Understanding the MailMarshal Web User Interface. Content Security policies generally include elements of two types: Email transport policies These policies are implemented using global settings you configure in MailMarshal Properties. These policies control who is allowed to send email to or through the MailMarshal server. For more information on email transport policies, see Configuring SpamProfiler, Preventing Relaying and Controlling Who Can Send Email Through Your Server. Email content policies These policies are implemented using rules you configure as part of MailMarshal Email Policy. These policies control the content of email messages. For more information on email content policies, see Stopping Spam, Stopping Viruses and Malware, and Filtering Messages and Attachments. To start the Management Console, open a supported web browser and navigate to the default HTTPS website of the Array Manager server.

​

Stopping Spam

Stopping unsolicited incoming email (commonly known as spam) is a primary goal for most organizations. The LevelBlue SpamCensor and SpamBotCensor technology filter spam efficiently with minimal overhead. The SpamProfiler is a signature based check performed at the Receiver, that allows MailMarshal to refuse delivery of spam or quarantine it with minimal processing.

​

Anti-Spam Configuration and Rules

The default email policy provided with MailMarshal includes a policy group titled Anti-Spam. This policy group includes a number of rules to block spam. Some basic rules are enabled by default. Additional rules can be enabled and/or customized to suit each installation. To view the Spam policy group:

1. In the left pane of the Management Console, expand the item Email Policy.
2. In the right pane, expand Content Analysis Policy and select Anti-Spam.
   
3. To view details of each rule, including a description of its intended use, select the rule and click Edit in the toolbar.
   Tip: To see a list of all conditions and actions in a rule, enable Preview using the toggle at top right of the rule panel.

The default rules include:

• Rules to quarantine spam using the SpamBotCensor, SpamCensor and SpamProfiler.
  Note: To ensure the reliability of SpamCensor and SpamProfiler, verify that they are enabled and correctly configured. See Configuring SpamProfiler and Configuring SpamCensor, SpamProfiler, and YAE Updates.To ensure the reliability of SpamBotCensor, ensure the processing nodes receive connections directly from the Internet.
• A rule to allow email messages from specific addresses.
• Rules to implement lists of blocked senders and safe senders for each user. Users can update these lists through the MailMarshal Spam Quarantine Management Website.
• A rule to quarantine email messages that contain text relating to scams, using the MailMarshal TextCensor.
• A rule to block spam email that contains spam-linked URLs in the message header or body. The rule uses the URLCensor function to compare URLs in received messages with listings maintained by external blocklist sites. URLCensor decodes URLs intentionally obscured with decimal, octal, or hexadecimal notation. For more information about using URLCensor, see the LevelBlue Knowledgebase.
  Note: To use URLCensor, you must ensure that MailMarshal uses a reliable, efficient DNS server. For more information, see Configuring Default Delivery Options.

​

Configuring SpamProfiler

SpamProfiler is a signature based service that examines email at the MailMarshal Receiver. SpamProfiler can significantly reduce the load on the MailMarshal Engine. By default MailMarshal enables SpamProfiler and uses Content Analysis Policy rules to quarantine messages in a folder. You can also use this facility to block messages at the receiver, without unpacking them. To configure SpamProfiler:

1. In the Management Console, select System Configuration and then expand Receiver Properties.
2. To enable SpamProfiler, select it from the menu and select Enable SpamProfiler.
   
3. To block message at the receiver, select the option Deny messages. You can exclude groups of senders from blocking using the additional options. For details of the options, see Help.
   Tip: A message is blocked at the Receiver if SpamProfiler classifies it as confirmed spam. To take action on other messages that SpamProfiler classifies, use the Content Analysis Policy rule condition Where message is detected as spam by SpamEngine.
4. To quarantine or delete messages, enable SpamProfiler and then use the Content Analysis Policy rule condition Where message is detected as spam by SpamEngine. For more information see Where message is/is not detected as spam by SpamEngine.
   Tip: When SpamProfiler is used with Content Analysis rules (not blocking at the Receiver), some suspect messages may be held briefly for rescan. Rescanning helps to improve the accuracy of SpamProfiler detection. Rescanning does not significantly delay processing.

​

Configuring SpamCensor, SpamProfiler, and YAE Updates

LevelBlue provides updates for the SpamCensor, SpamProfiler, and Yara Analysis Engine (YAE) facilities to all customers with current MailMarshal maintenance contracts. The updates are delivered through the Web by HTTP and HTTPS.

​

Configuring and Checking Automatic SpamCensor Updates

Automatic updating of the SpamCensor is enabled by default. You can choose to download updates manually or automatically. To monitor and configure SpamCensor updates:

1. In the Management Console, select System Configuration and then expand Array Properties.
2. Select Automatic Updates from the menu. The display shows the time and result of the last update attempt, and the time of the next attempt.
   
3. If you do not want the SpamCensor to update automatically, toggle off Enable Automatic Updates.
4. If you want to be notified by email when a SpamCensor update is received or a problem occurs, toggle on Send email to the administrator. MailMarshal sends an email message to the administrator address configured on the Notifications page of MailMarshal Properties.
5. If you want to perform a check for SpamCensor updates immediately, click Check for Updates Now.

​

Configuring Proxy Settings for Updates

If the MailMarshal server(s) do not have direct access to the Web, you can configure MailMarshal to use a proxy server to download the updates. This proxy server setting applies to SpamCensor and SpamProfiler updates. SpamCensor updates are downloaded by the Array Manager. SpamProfiler updates are downloaded by each processing node. To configure proxy settings for the updates:

1. In the Management Console, select System Configuration and then expand Array Properties.
2. Select Internet Access from the menu.
3. You can configure the following settings for the Array Manager (SpamCensor updates) and for the processing nodes (SpamProfiler updates).
   1. If you want MailMarshal to access the Web directly, select Direct Access.
   2. If you want MailMarshal to use a specific proxy server, select Proxy. Enter a proxy server name and port. If necessary, enter a user name and password for proxy authentication.
4. To apply the proxy settings, click Save and then commit MailMarshal configuration changes.

You can also configure different proxy settings for each processing node if necessary. For more information, see Customizing Settings for Nodes.

​

Stopping Viruses and Malware

Blocking virus and malware infections at the email gateway is a primary goal of email content security for most organizations. MailMarshal can scan email messages for virus infection using any of a number of virus scanners, including McAfee for Marshal and Sophos for Marshal. Nearly all MailMarshal installations use virus scanning. MailMarshal also provides additional important layers of protection against malware using proprietary Zero Day updates, Yara Analysis Engine malware detection, and the Outbreak Detection function of SpamProfiler.

​

How MailMarshal Uses Virus Scanners

MailMarshal can use one or more scanners to check email for viruses. Because virus scanners have differing architecture and update policies, some organizations choose to use multiple scanners. For more information about configuring virus scanners, see Configuring Antivirus Scanning. MailMarshal invokes the virus scanner after unpacking all elements of an email message. MailMarshal then passes the elements to the scanner software for analysis, and takes action based on the result returned from the scanner.

​

Features

MailMarshal supports the following virus prevention and management features:

• Email antivirus scanning at the gateway: Adds a proactive layer of defense at a key strategic point in the network.
• Multiple virus and malware scanners (optional): Increases the chances of detecting a virus and reduces the vulnerabilities from delays in patch updates.
• Virus notification and reporting: Provides email notifications of specific viruses, and comprehensive reporting on virus incidents (including the virus names if provided by the scanner in use).

MailMarshal also provides additional features that can help with virus protection, including:

• Unpacking documents and archives
• Scanning text for keywords and suspect code
• Blocking dangerous file types
• Blocking encrypted files

​

Implementation Options

To work with MailMarshal, a virus scanner must have a command-line interface or a MailMarshal DLL supplied by LevelBlue. The scanner must return a documented response indicating whether or not a virus is detected. Most commercially available virus scanners meet these specifications. Install one or more chosen scanners on each MailMarshal email processing server following the manufacturer’s instructions. For more information about supported antivirus software, see Supported Antivirus Software. For more information about installing virus scanners, see Configuring Antivirus Scanning.

​

Anti-Malware Policy and Rules

The default email policy provided with MailMarshal includes two policy groups titled Anti-Malware (Inbound) and Anti-Malware (Outbound). These policy groups include a number of rules to block viruses and malware. To view the Anti-Malware policy groups:

1. In the left pane of the Management Console, select the item Email Policy.
2. Expand Content Analysis Policy, and select the item Anti-Malware (Inbound) or Anti-Malware (Outbound).
3. To view details of each rule, including a description of its intended use, double-click the rule name in the right pane.

The default rules include rules to implement Zero Day protection and Yara Analysis Engine action, to attempt to block malware infected email messages using traditional scanners, to block malware-related messages by their content, and to apply SpamProfiler’s Outbreak Detection technology. The rules that invoke malware scanners are disabled by default. You must install and configure at least one scanner before you can enable these rules.

​

Best Practices

LevelBlue recommends the following basic practices to ensure security with respect to malware/viruses and scanning:

• Ensure that SpamCensor and SpamProfiler updating is enabled, to provide a Zero Day layer of protection. The SpamCensor updater also delivers updates for the Yara Analysis Engine and file unpacking.
• Block messages and attachments that MailMarshal cannot scan, such as password protected attachments and encrypted attachments (for example files of type ‘Encrypted Word Document’).
• Block encrypted messages that MailMarshal cannot decrypt, such as PGP and S/MIME messages and encrypted ZIP files.
• Block executable and script files by type and name. This helps to ensure that unknown viruses will not be passed through.
• Subscribe to email notification lists for malware outbreaks. Such lists are available from many antivirus software companies. When an outbreak occurs, block the offending messages by subject line or other identifying features.

​

Viewing Virus Scanner Properties

Double click the name of any virus scanner in the right pane to review MailMarshal configuration information for that scanner. With external scanners you can modify the configuration. For details of the fields, see the Help for this panel.

​

Preventing Relaying

Relaying email means sending a message to an email server for delivery to another email server. An open relay is an email server that accepts messages from any server for delivery to any other server. Spam senders often exploit open relays. It is best practice for an email server to refuse relaying requests, unless the source is known and trusted. By default MailMarshal only allows relaying requests from the email server that was selected for delivery of local email (in the Configuration Wizard). For instance, if you entered the IP address of an Exchange server as the local delivery location, MailMarshal will also relay outgoing email from the Exchange server. You may need to allow relaying from other locations. You can allow relaying in two ways:

• By specific account authentication. See Authentication by Account.
• By Relaying Table.

To permit relaying from other locations:

1. In the Management Console, select System Configuration and then select Relaying.
2. In the right pane, double-click the default Relay Table entry. The Relay Table panel displays the list of sources allowed or denied relay permission.
   
3. To permit relaying from additional computers, click Add.
4. In the Relay Table Entry panel select one of the available options, and then enter the required data. You can use a single IPv4 or IPv6 address, a hostname, or a MX lookup for a domain. For example, you can choose to permit relaying from the IP range 10.15.1.0– 10.15.1.255.
5. Click Save to both panes, and then commit configuration changes.
   Note: For more details of the available options, see Configuring Relaying. For details of the fields on the windows, click Help.To learn about an additional item that affects relaying in rare cases, see Help for the setting “Block suspicious local-part relay attempt.”

​

Controlling Who Can Send Email Through Your Server

MailMarshal includes a number of features that allow you to control acceptance of email messages. These include Reputation Service checking, PTR lookups, a list of blocked hosts, and authentication by account (user name and password).

​

Reputation Services and DNS Blocklists

MailMarshal can retrieve information from Reputation Services or DNS based blocklists including the Marshal IP Reputation Service, and third-party services such as SpamCop and Spamhaus. A Reputation Service is a service that provides an automated response through the DNS protocol. These services typically attempt to list email servers that are associated with spamming, open relays, or other unacceptable behavior. Each list has its own policies, and you should carefully evaluate the lists you choose to use. The Marshal IP Reputation Service (provided by LevelBlue) is automatically provisioned. You can configure details of other services in Policy Elements. You can configure one or more Connection Policy or Content Analysis Policy rules to filter email based on the list information.

​

Recommended Usage

To minimize performance issues, use only one or two reliable services. You can view the result returned by a Connection Policy rule Reputation Service condition by reviewing the MailMarshal Receiver text log.

​

Configuring Access to a Reputation Service

MailMarshal maintains a list of available reputation services it can use in Connection Policy rules. To configure access to a reputation service:

1. In the Management Console, expand Policy Elements and select Reputation Services. The right pane shows a list of configured services.
   Note: The Marshal IP Reputation Service will be automatically provisioned for use by trial installations and customers with current maintenance.Provisioning requires Internet access from the Array Manager server.
2. You can edit or test a service entry or add a new entry. See Help for details of the required information.

​

Using a Reputation Service Rule

The default email policy provided with MailMarshal includes a Connection Policy rule that uses the Marshal IP Reputation Service. This policy is enabled by default. To disable or re-enable the default Reputation Service rule:

1. Verify that the Marshal IP Reputation Service is present in the list of Reputation Services. This service is enabled by default in current versions of the product.
2. In the left pane, expand the item Email Policy.
3. Expand Connection Policy and double-click Connection Policies.
4. In the right pane, double-click the rule Deny Trustwave Reputation Service Blocklisted on connection. On the General tab, toggle the Enabled status, and then click Save.
5. Commit the configuration changes.

​

PTR Lookups

MailMarshal can mark or refuse email from external servers that do not have correctly published Reverse DNS (PTR record) information. You can use this method to help guarantee the genuineness of a remote site, and as a layer of anti-spoofing protection. To edit the PTR lookup policy:

1. In the Management Console, select System Configuration and then expand Receiver Properties.
2. Select Host Validation from the right pane menu.
3. To validate hosts sending incoming email using DNS information, toggle on Validate connecting hosts in the DNS. MailMarshal will perform a reverse DNS lookup on each IP address from which email is being sent.
4. Select an option using the radio buttons.
   • Choose Accept unknown hosts to accept email from hosts without appropriate DNS information, but log this fact to the MailMarshal Receiver text log.
   • Choose Host must have a PTR record to block messages from any host that does not have a valid DNS PTR record. Blocked messages are logged in the Windows Event Log and return the SMTP response: 554 No SMTP service here.
   • Choose PTR Record must match the HELO connection string to block messages from hosts whose PTR domain does not match the HELO identification sent by the server. This is the most restrictive option. Blocked messages are logged in the Windows Event Log and return the SMTP response: 554 No SMTP service here.
5. To implement the blocking, click Save and then commit configuration.

​

Blocked Hosts

You can maintain a list of servers that are never allowed to send any email through MailMarshal. MailMarshal will reject SMTP connections from these servers. Entries on this list will generally be servers outside your local LAN. To edit the list of Blocked Hosts:

1. In the Management Console, select System Configuration and then expand Receiver Properties
2. Select Blocked Hosts from the right pane menu.
3. Toggle on Refuse Mail… and then add server names, IP addresses, or IP address ranges to the list. For information about the format of entries, see Help.
4. To implement the blocking, click Save and then commit the configuration.

​

Authentication by Account

MailMarshal can require each computer connecting to it to provide a user name and password. MailMarshal supports the CRAM-MD5, LOGIN, and PLAIN options for SMTP authentication. Additionally, authentication can be within a TLS session. To use authentication by account:

1. Create and maintain a list of accounts using the policy element Accounts. For more information see Setting Up Accounts.
   Note: You can also check authentication using an Active Directory group. For details of this option, see Knowledgebase article Q16649.
2. Configure MailMarshal to advertise ESMTP authentication. For more information see MailMarshal Properties – Advanced.
3. Create a Connection Policy rule using the condition “Where sender has authenticated”. For information about creating rules see Understanding Rules. For information about this rule condition see Where sender did/did not authenticate successfully.
   Note: You can also check the authentication of messages using a Content Analysis Policy rule. For more information, see Where the DKIM verification result is. Using Content Analysis Policy to check authentication provides more flexibility in actions and other conditions, but could reduce security.

​

Preventing Malicious Email Attacks

MailMarshal helps to protect your network from intentional attempts to disrupt your operations. Denial of service attacks can cripple entire networks. Directory harvest attacks initially consume bandwidth and can result in your network receiving additional spam. MailMarshal allows you to tailor denial of service prevention and directory harvest prevention features to suit your network and business requirements. Enable one or both forms of attack prevention if you believe that your network is vulnerable to attack.

​

Understanding Denial of Service Attack Prevention

Denial of service (DoS) attacks cause target organizations to lose access to common business services, such as email. In an email DoS attack, the attacker floods email servers with messages or unused connections, causing the target email servers to slow down or cease operation.

​

How MailMarshal Prevents DoS Attacks

MailMarshal prevents DoS attacks by the following means:

• Identifying external email servers that are attacking your network
• Blocking new connections from attacking servers for a period of time

MailMarshal determines that it is under attack when the number of new connections from any single external server in a short period exceeds a specified number. You specify both the period of time and the maximum number of allowable incoming messages.

​

Optimizing DoS Attack Prevention Settings

To determine the optimum settings for the DoS attack prevention parameters, you can log blocked hosts. You can use the Senders Blocked by DoS Prevention report (from Marshal Reporting Console) to see which servers were blocked. If you are affecting email flow from legitimate sources, you can change the settings to allow more messages through. You can also exclude specific hosts from DoS attack prevention by IP address or address range. You configure DoS settings once for the entire MailMarshal array. However, MailMarshal applies the traffic limits you set at each email processing server. For example, if you use the default setting of 50 connections per minute and your installation is an array of five servers, your network can receive up to 250 connections per minute from any one external server (50 connections at each of 5 servers) When DoS prevention is triggered on one email processing server in a array, the other servers in the array are not affected. When DoS prevention is blocking connections from a server, MailMarshal returns the SMTP response 421, Service not available. A legitimate server that receives this response will try again later.

​

Preventing Denial of Service Attacks

You configure DoS attack prevention by specifying the values MailMarshal will use to evaluate incoming email traffic, the blocking period, and any excluded hosts. You can adjust these values at any time. To configure DoS attack prevention:

1. In the Management Console, select System Configuration and then expand Receiver Properties.
2. Select Attack Prevention in the right pane menu, and select the DoS tab.
3. Select (toggle on) Enable Denial of Service prevention, and specify values. For more information about the fields and settings, click Help.
   
4. Click Save.
5. Commit configuration to apply your changes.

​

Enabling and Disabling DoS Attack Prevention

After configuring DoS attack prevention, you can enable or disable the feature without changing the configuration. To enable or disable DoS attack prevention:

1. In the Management Console, select System Configuration and then expand Receiver Properties
2. Select Attack Prevention in the left pane, and select the DoS tab.
3. Toggle the status of Enable Denial of Service prevention, as needed.
4. Click Save.

​

Understanding Directory Harvest Attack Prevention

In a directory harvest attack (DHA), an attacker attempts to identify valid email addresses by sending randomly-addressed messages to an email server. When a message reaches a recipient without being bounced back, the attacker enters the valid address in a database used for sending spam. The attacker sends messages addressed either to random usernames, or to usernames that follow a common pattern, such as _firstname_lastname_@example.com.

​

How MailMarshal Prevents DHA Attacks

MailMarshal helps to prevent DHAs by the following means:

• Identifying external email servers that are attacking your network
• Blocking email from attacking servers for a specified period of time

DHA prevention identifies which email messages are addressed to valid users by comparing the recipient addresses to a list of users (email addresses). To ensure DHA prevention works correctly, you must configure MailMarshal to check one or more user groups that together contain all valid email addresses of all users in your environment. DHA prevention checks each incoming email for a valid recipient. When the number of messages with invalid addresses, from a single server, and in a short period of time, exceeds a specified threshold, MailMarshal considers itself under attack and blocks incoming mail from the server. You determine the length of time to block the attacking server. When DHA prevention terminates a connection, MailMarshal returns the SMTP response 556 Too many invalid recipient requests. While MailMarshal is blocking connections from a server, MailMarshal returns the SMTP response 421 Service not available. A legitimate server that receives this response will try again later. You can also exclude specific hosts from DHA prevention by IP address or address range.

​

DHA Prevention Settings

You configure DHA settings once for the entire MailMarshal array. However, MailMarshal applies the traffic limits you set at each email processing server. For example, if you use the default setting of 10 messages with invalid recipients per minute, and your installation is an array of five servers, your network can receive up to 50 invalid messages per minute from any one external server (10 messages at each of 5 servers). When DHA prevention is triggered on one MailMarshal email processing server, other servers in the array are not affected. You can adjust the limits depending on your array and MX configuration. To determine the optimum settings for the DHA prevention parameters, you can log blocked hosts. You can use the Senders Blocked by DHA Prevention report (from Marshal Reporting Console) to see which servers were blocked. If you are affecting email flow from legitimate sources, you can change the settings to allow more incorrectly addressed messages through. You can also exclude specific hosts from DHA attack prevention by IP address or address range.

​

Preventing Directory Harvest Attacks

You configure DHA prevention by specifying the values MailMarshal will use to evaluate incoming email traffic. You can adjust these values until you determine the optimum settings for your network. To configure DHA prevention:

1. Create a list of all valid recipients by completing the following steps:
   1. Create one or more Azure Entra, Active Directory or LDAP user groups that together contain all the user email addresses in your environment. For more information, see Creating and Populating User Groups.
      Note: Take care not to miss any users (email addresses) that are valid for email delivery. Select the group(s) at the highest point in the organizational hierarchy that you want to protect to ensure that you include all possible users in that hierarchy.
   2. Select these groups (or a group containing them) when configuring DHA prevention in the following steps.
2. In the Management Console, select System Configuration and then expand Receiver Properties.
3. Select Attack Prevention in the right pane menu, and select the DHA tab.
4. Select (toggle on) Enable Directory Harvest Attack prevention, and specify appropriate values. Specify the group(s) you created to be used during evaluation. For more information about the fields and settings, click Help.
   
5. Click Save.
6. Commit configuration to apply your changes.

​

Enabling and Disabling Directory Harvest Attack Prevention

After configuring DHA prevention, you can enable or disable the feature without changing the configuration. Use the following procedure: To enable or disable DHA prevention:

1. In the Management Console, select System Configuration and then expand Receiver Properties
2. Select Attack Prevention in the right pane menu, and select the DHA tab.
3. Toggle the status of Enable Directory Harvest Attack prevention, as needed.
4. Click Save.

​

Filtering Messages and Attachments

MailMarshal provides a framework that allows you to create an email policy in support of your Acceptable Use Policy. A MailMarshal email policy is divided into Connection Policy, Content Analysis Policy, and Dead Letter Policy. Each of these sections contains one or more policy groups. Each policy group consists of one or more rules. For more information about the options available when creating policy groups and rules, see Understanding Policy Groups and Understanding Rules. The default email policy provided with MailMarshal contains several policy groups containing example and best practice rules: Connection Policies Contains rules that block unwanted emails before they are downloaded to your network. Anti-Malware (Inbound) Contains rules that implement a recommended best practice for virus scanning of email messages sent to your environment from the Internet. Anti-Malware (Outbound) Contains rules that implement a recommended best practice for virus scanning of email messages sent from your environment out to the Internet. Anti-Spam Contains rules that implement a recommended best practice for detection and blocking of spam sent to your environment from the Internet. Blended Threats Contains rules that implement detection of suspect URLs in messages and attachments. Checking can be performed at the time of message processing. With the optional Blended Threat Service, checking can be performed at the time a link is clicked by the email recipient. Attachment Management (Inbound) Contains rules that implement a recommended best practice for filtering attachments sent into your environment from the Internet. Attachment Management (Outbound) Contains rules that implement a recommended best practice for filtering attachments sent from your environment. Policy Management (Inbound) Contains rules to enforce your company policy in regard to receiving email containing prohibited language, credit card details, and so on. These rules also help you enforce SEC and SOC compliance. Policy Management (Outbound) Contains rules to enforce your company policy in regard to sending email containing prohibited language, credit card details, and so on. These rules also help you enforce SEC and SOC compliance. Automated Responses Contains rules that cause MailMarshal to send automated responses to various types of incoming email. Message Archiving Contains rules that specify how MailMarshal archives all inbound and outbound email.