Introduction

Email is an essential communication tool, but it also creates serious productivity and security issues. Email offers an entry point in your network for spam and other undesired non-business content, such as malicious code, large file attachments that consume valuable disk space, phishing attempts, information and identity theft attacks, and other damaging content and activity. In addition, email can become a conduit for proprietary data and confidential information to leave the company. Spam, email viruses, malicious code, liability issues, and declining employee productivity are all risks associated with email. Spam commonly accounts for more than half of the email companies receive. Email viruses, Trojan horses, and other malicious files can cause millions of dollars in damage in just a matter of hours. Reports of companies forced into legal action because of staff misuse of email are becoming commonplace. Email remains the lifeblood of modern business communication, but the damages email can cause become more costly each year.

​

What Is MailMarshal SMTP?

MailMarshal SMTP – previously known as Trustwave Secure Email Gateway (SEG) – is a fast, easy-to-use email content security solution that ensures a safe and productive working environment by enforcing your Acceptable Use Policy and protecting against spam, viruses, and other undesirable content. MailMarshal SMTP features a layered security approach to dramatically reduce spam and protect your network. This approach delivers a greater than 97% spam detection rate with less than 0.001% false positives. The product performs up to four times faster than other available products. Key elements of the MailMarshal anti-spam solution include:

• SpamProfiler, an antispam pre-filter that can reject spam email without unpacking and full processing.
• SpamCensor, an advanced antispam engine that can filter most spam before it enters your network.
• SpamBotCensor, an optimized application of SpamCensor that can block spam generated by botnets with even greater efficiency.
• Yara Analysis Engine (YAE), a scripted anti-malware engine to perform deep analysis of messages and attachments.
• Automatic updates for SpamProfiler, SpamCensor, and YAE, responding to the latest trends in Spam.
• Zero Day updates protecting you from significant spam and malware events.
• URLCensor, to reject email based on URLs embedded in messages that are listed on a DNS based blocklist.
• URL checking for suspect URLs using a real-time lookup against a database maintained by LevelBlue.
• TextCensor, to analyze and filter inbound and outbound messages based on language content.

MailMarshal is a gateway product that can be used with any internal company email system or cloud hosted mailbox offering, including Microsoft Exchange, Office 365/Exchange Online, Lotus Domino, Sendmail, and Linux email servers. MailMarshal provides your company with the layered security solution you need to manage email content, fight spam, and transparently enforce your email Acceptable Use Policy. Many organizations today have created policies and guidelines for the appropriate use of email, and employee education programs to deal with the torrent of spam and viruses. MailMarshal can help your company automatically apply email policy and security at the gateway, so you can once again use email safely, securely and productively.

​

What Does MailMarshal SMTP Provide?

As a gateway content security solution, MailMarshal protects your network and your organization. MailMarshal enforces your Acceptable Use Policy to protect against spam, viruses, gateway email attacks, and other undesirable consequences of using email. Easily supporting enterprises with tens of thousands of users, MailMarshal is by far the most powerful, feature rich email content security solution available. MailMarshal scans the content of inbound and outbound email messages, including the headers, message body, and attachments. MailMarshal can detect many conditions, such as:

• Attempted message delivery from a server found on a blocklist
• Presence of a virus (using one or more supported virus scanners)
• Presence of particular phrases in header, message, or attachment
• Size or type of attachments
• Presence of URLs in header, message, or attachment that are found on a DNS based blocklist

The product can also respond to messages that violate your Acceptable Use Policy, by taking actions such as:

• Refusing receipt of a message from a remote server
• Quarantining a message for later review by administrators or users
• Deleting a message
• Redirecting a message
• Archiving a message for future reference

MailMarshal provides email administrators with granular control of policies and the ability to delegate email monitoring and control to other personnel. MailMarshal provides the following web-based user interfaces to meet the needs of a variety of administrators and your email recipients: Management Console Allows email security administrators to configure the product and establish email policy. Also allows email administrators and help desk personnel to monitor and control product activity, and administer quarantined email. Spam Quarantine Management Website Allows email recipients to verify quarantined email and customize spam blocking for their own email addresses. Optional.

​

How MailMarshal SMTP Helps You

Unmonitored email presents both financial and legal dangers to a company. For example, spam represents a dramatic financial threat in terms of the cost of storage, bandwidth, and wasted employee time. Virus infection and malicious code can be costly in employee time, repair time, and lost data. Inappropriate and offensive email content wastes time and is a potential liability. Using MailMarshal, your company can earn a significant ROI as you secure your network, protect corporate assets, reduce the potential for corporate liability, and improve workplace productivity.

​

Filters Email at the Gateway

MailMarshal analyzes email content and attachments entering your network to deliver a greater than 97% spam detection rate with less than 0.001% false positives. MailMarshal protects your network and resources by reducing spam and eliminating other undesirable content before it enters your network. By scanning for viruses and detecting and preventing gateway attacks, MailMarshal helps ensure network availability for business purposes.

​

Delivers Layered Spam Protection

MailMarshal provides a multi-layered approach to email security, pioneering the latest technologies to protect your business from spam, gateway attacks, viruses, phishing attempts, and suspect URLs embedded in email. Using proprietary SpamProfiler, SpamCensor, URLCensor, and TextCensor technology to detect offensive and undesired content, MailMarshal responds to these emails with the actions you define to help enforce your email Acceptable Use Policy.

​

Protects Against Existing and Emerging Threats

MailMarshal integrates a wide variety of anti-spam and anti-threat technology to protect against known threats, as well as regular updates to meet emerging threats. The LevelBlue Labs team continually updates threat detection algorithms to detect new forms of spam, mass mailing worms, and phishing scams. MailMarshal can automatically download these updates to keep your protection levels current. The LevelBlue Labs team also publishes Zero Day updates to meet specific threats. The MailMarshal IP Reputation Service provides real-time updates of a proprietary database of spam-related email servers.

​

Provides Unparalleled Performance

In parallel with superior spam detection and multi-layered threat protection, MailMarshal provides exceptional performance, operating up to four times faster than other spam-detection products. Scalable configurations allow MailMarshal to work for small or large organizations and to grow as your company does. This hard-working product lets you configure for redundancy to meet demanding SLAs and operate MailMarshal in geographically separate locations from a central console.

​

Includes Easy-to-Use Interfaces

MailMarshal is easy to evaluate, install, and use. Default settings provide excellent anti-spam performance “out of the box.” The Management Console provides an intuitive web-based interface that allows both policy configuration and email management. Policy administrators can refine the rules MailMarshal uses to evaluate and reject or deliver email. Email administrators can monitor product effectiveness and manage quarantined messages. An optional Web-based end user management console allows email users to review quarantined email, and establish and manage personal rules for acceptable and unacceptable email. These user interfaces allow various users to easily access the information they need about the MailMarshal solution. Auditors and managers can easily produce reports on MailMarshal activity using the optional web-based Marshal Reporting Console.

​

How MailMarshal SMTP Works

MailMarshal is a server-based Simple Mail Transfer Protocol (SMTP) email content scanning product that is easy to install in new or existing networks with other gateway applications. It complements and is compatible with traditional Internet firewalls, SMTP mail servers, antivirus scanners, and other security applications. MailMarshal includes several components including the Array Manager, one or more email processing servers, a Microsoft SQL Server database, and optional management websites. Small organizations can install the components on a single computer, that can also act as the local SMTP/POP3 email server. Large organizations can install the components across several computers. Enterprises can manage a distributed array of email processing servers with a single Array Manager computer. MailMarshal provides one main user interface (the Management Console), as well as an optional end-user Spam Quarantine Management site.

​

Understanding What MailMarshal Does

The MailMarshal installation functions as the email gateway of an organization. All inbound and outbound email passes through the MailMarshal Server. You can use multiple MailMarshal Servers to provide multiple gateways or to add bandwidth and redundancy to a single gateway. Each MailMarshal Server runs several component services, including the Receiver, Engine, and Sender services. Table 1: MailMarshal component functions All inbound and outbound email enters the MailMarshal Server at the Receiver. At this stage, MailMarshal can apply SpamProfiler checks and Connection Policy rules to messages. Receiver blocking options offer powerful protection because they allow you to refuse incoming email based on criteria such as email not addressed to a recipient in your organization. Connection Policy rules that block email this way conserve resources for other legitimate email. Next, the MailMarshal Engine unpacks each email, expanding any attached archive or compressed files. The Engine then checks each component against Content Analysis Policy Rules you have enabled, including SpamCensor scripts, URLCensor, TextCensor scripts, and any other rules you have enabled. You can alter the effects of MailMarshal rules by changing the rule order and by changing specific characteristics of the rule. MailMarshal also scans email for viruses using antivirus scanning software. MailMarshal supports several integrated scanners with high-throughput interfaces. The product can also use many other antivirus scanners that return results in the required format. However, non-integrated scanners deliver much lower throughput. After the MailMarshal Engine evaluates each email component against the rules, it determines whether to accept, modify, or quarantine the email.

• Accepted email is passed to the MailMarshal Sender for delivery to the appropriate recipients. The sender can enforce use of TLS and DANE validation.
• Modified email can be delivered to recipients with attachments removed.
• Virus-laden email is quarantined.

MailMarshal can also notify administrators of specific actions or notify end-users of quarantined email. You can associate the appropriate rule action when you create or modify rules.

​

Configuring MailMarshal

You configure MailMarshal rules and settings using the Management Console web interface. Changes made and committed in the Management Console are applied through the MailMarshal Array Manager. The Array Manager coordinates the activity of all other MailMarshal Servers in the array and connects with the user interfaces, optional end user quarantine management server, and the database. The initial configuration settings allow MailMarshal to act as the email gateway of an organization. You can enforce a wide variety of Acceptable Usage Policies by customizing the way MailMarshal processes email connections, content, and attachments.

​

Monitoring and Reporting

The Management Console features the Dashboard to summarize MailMarshal activity and server health at a glance. Using the Console, email administrators can review email processing history for a message and view and release any quarantined message. The administrator can grant other users access to specific Console functions. Using this feature, the administrator can delegate basic tasks to help desk or departmental personnel. The Management Console is web-based to allow remote access. Email users can review and manage suspected spam and other quarantined email using daily email digests and the Spam Quarantine Management Web-based console. This console is a Web application you can easily deploy on your intranet Web server running Microsoft Internet Information Services (IIS). Administrators and managers can generate reports on MailMarshal activity using Marshal Reporting Console. Marshal Reporting Console uses SQL Server Reporting Services to produce reports. This is a server application with a website interface. Marshal Reporting Console can deliver reports by web view, email, FTP, or local network files, and can schedule automatic delivery of reports. Marshal Reporting Console is provided as a separate package from LevelBlue. This application is available to all MailMarshal customers.

​

MailMarshal SMTP and MailMarshal Cloud

MailMarshal SMTP is a gateway solution that applies email content security for email inbound from or outbound to the Internet. MailMarshal Cloud is a cloud based solution that applies the power of MailMarshal in a managed cloud solution compatible with cloud based mail providers or premise solutions. For more information about MailMarshal Cloud, see the documentation available on the LevelBlue website.