> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing MailMarshal Configuration

> Manage licenses, back up and restore configuration, configure domains, routes, relaying, delivery, accounts, DKIM, DMARC, array nodes, TLS, advanced options, and command line tools.

This chapter discusses a number of configuration options and tasks that maintain and customize your MailMarshal environment.

## Managing Your MailMarshal Licenses

MailMarshal requires a valid license key in order to process email. When you install MailMarshal, the installation process inserts a temporary license key valid for 30 days from the time of installation. Contact a LevelBlue Sales Representative to purchase the product and receive a full license key, or to request an extended trial. If you have received a valid full key, you can enter it at any time using the procedure given in [Entering a License Key](#entering-a-license-key).

Install licenses at the array level. The licenses apply to all MailMarshal installations in an array.

Full MailMarshal license keys are normally keyed to the Windows domain SID. If you move the Array Manager server to a different domain the key will become invalid. MailMarshal will notify you and generate a temporary key valid for 14 days. You should immediately request a new key using the procedure given later in this section.

> [!NOTE]
>
> **Note:** MailMarshal is licensed according to the number of email users in your organization (excluding distribution lists and role accounts). The licensed number is encoded in the product key and shown in the Console. Exceeding the licensed number will not have any effect on email processing.
>
> For computers not joined to a domain, LevelBlue can provide a key based on your computer SID or the list of local email domains.

### Reviewing Installed Licenses and Maintenance

Use the Management Console to view the details of all installed license keys, including the key expiry date, maintenance expiry date, number of users, and any optional features licensed.

To view details of the currently installed license:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu, select **License**.

   This pane shows full information about the key and maintenance contract expiry. Information about maintenance expiry is retrieved daily from LevelBlue web servers. Current maintenance is required to use frequently updated features such as SpamCensor, SpamProfiler, and the Marshal IP Reputation Service.

   1. You can select how MailMarshal will behave if the license expires or becomes invalid.
      * If you select **Pass through all email,** MailMarshal will function as an email relay. MailMarshal will pass messages on to their destinations without applying any engine based policy
      * If you select **Halt all processing and hold all email**, MailMarshal will continue to accept messages so long as there is available disk space for the incoming queue. MailMarshal will not deliver any messages until you enter a valid license or change this option to pass through all email.
   2. To apply the selection, click **Save** and then commit the configuration.

### Requesting a New License Key

To include all information required for LevelBlue to generate an appropriate key, request the key through the Management Console.

To request a new license key:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu, select **License**.
3. Click **Request Key.**
4. Complete the required information on the Request License Key panel. MailMarshal will append the information required to generate a unique key.

   > [!TIP]
   >
   > **Tip:** To assist in identifying your organization, include the Unique Customer Reference Number as found on order confirmations.
5. To email the request to LevelBlue, click **Send Request**.

   > [!NOTE]
   >
   > **Note:** When you click Send Request, MailMarshal also places the additional request information on the Clipboard. You can paste this information to any application if you need to send a request manually.

### Entering a License Key

When you receive a key from LevelBlue, use the Management Console to enter it and verify its validity.

To enter a license key:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu, select **License**.
3. Click **Enter Key.**
4. Enter the key, and select how MailMarshal will behave if the license expires or becomes invalid.
5. Click **Save.** MailMarshal will report the validity of the key you entered.
6. *If your key expired,* MailMarshal might have stopped the Engine service. Verify that all services are running on all email processing servers by completing the following steps:
   1. In the left pane of the Management Console, click **Mail Servers**.
   2. MailMarshal displays all servers in the array. Select a server and click **Server Properties**.
   3. *If a MailMarshal service is stopped,* click **Start**.

Repeat step c to verify each server service in your array is started.

## Backing Up and Restoring the Configuration

You should back up your MailMarshal configuration at the following times:

* Before and after you make substantial MailMarshal configuration changes.
* Before applying an upgrade.

> [!NOTE]
>
> **Note:** You can make backups automatically once a day and/or after every configuration commit. Daily backups are enabled by default. See [Automatic Configuration Backup](#automatic-configuration-backup).

You can restore the configuration when you want to make the following changes:

* Create a new Array Manager server.
* Return to a previous version of your email policy.

In addition to the following backup and restore procedures, you can back up and restore the configuration using a command line prompt. For more information see [Using the Configuration Export Tool](#using-the-configuration-export-tool).

You can import your user and group information using the MailMarshal Management Console. For more information see, [Configuring User Groups](/documentation/mailmarshal/user-guide/email-policy-elements.md#configuring-user-groups).

You can also import user group information using a command line prompt. For more information see [Using the Group File Import Tool](#using-the-group-file-import-tool).

For more information about backing up the `\Quarantine` folders and the MailMarshal database, see the LevelBlue Knowledgebase.

### Backing Up the Configuration

Backing up the MailMarshal configuration includes running Backup in the Management Console and backing up the following additional files:

**Table 24: Files to include in configuration backup**

| Computer | Folder | Files |
| - | - | - |
| Array Manager | Folder you specify during Backup operation (by default, `InstallPath\ConfigurationBackup`) | manual or automatic backup zip file (for example, `MailMarshal-ver-Manualbackup_datetime.zip`) |
| Array Manager | `InstallPath` | filetype.cfg |
| Array Manager (*optional*) | `InstallPath\Logging` | \*.log |
| Email processing servers | `InstallPath\Quarantine` and `InstallPath\Quarantine\ValidFingerprints` | \*.\* |

Where `InstallPath` indicates the location where you installed the product. The default install path is `\Program Files\Trustwave\Secure Email Gateway`.

> [!NOTE]
>
> **Note:** Backups do not include members of groups imported through directory connectors.

To back up the MailMarshal configuration:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu, select **Backup**.
3. *If you use DKIM signing,* select the option to include DKIM keys.
4. Click **Backup Now**. The backup is created in the `ConfigurationBackup` subfolder on the Array Manager.

   > [!TIP]
   >
   > **Tip:** To ensure the backup is not deleted by the backup retention policy, copy this file to another location.
5. *If you have created file type rules*, back up the `filetype.cfg` file in the `\InstallPath` folder.
6. Make a note of each MailMarshal email processing server computer name.
7. On each MailMarshal email processing server computer, back up the `\InstallPath\Quarantine` and `\InstallPath\Quarantine\ValidFingerPrints` folders by following the instructions in Knowledgebase article Q10220.
8. Make a note of the MailMarshal database computer name.
9. On the database computer, back up the MailMarshal database by following the instructions in Knowledgebase article Q10221.

### Automatic Configuration Backup

MailMarshal can back up configuration automatically. Automatic backup can be on a daily schedule and/or after each configuration commit. Daily backup is enabled by default.

Automatic backups include the same configuration items included in manual backups. To make a full automatic backup, you should schedule backup of the files mentioned in the previous section.

Automatic backups are stored in the subfolder `\ConfigurationBackup` within the MailMarshal installation on the Array Manager server. The backup file name shows the product version and date of creation.

To enable, disable, or set the retention period for automatic backups, in the Management Console navigate to **MailMarshal Properties > Array Properties > Backup.**

### Restoring the Configuration

Restoring the MailMarshal configuration requires a number of steps. You can restore the configuration if you are creating a new Array Manager server, or if you want to return to a previous version of your email policy.

For additional steps required to restore a configuration saved in MailMarshal 8.2, see [Using the Configuration Export Tool](#using-the-configuration-export-tool)

> [!NOTE]
>
> **Note:** The restored data does not include the members of groups imported through directory connectors. **To retrieve the group members:** After restoring the configuration, in the left pane of the Configurator right-click User Groups and select **Reload User Groups**.

To restore your MailMarshal configuration:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu, select **Restore**.
3. Select a file to restore from the list. Backups are stored in the subfolder `\ConfigurationBackup` within the MailMarshal installation on the Array Manager server. The backup file name shows the product version and date of creation.
4. Click **Restore.** Enter the password to restore DKIM keys, and then click **OK.**
5. To restore custom file type definitions, copy the backup `filetype.cfg` file to the `\InstallPath` folder on the Array Manager computer.
6. To repopulate users in Azure Entra, LDAP and Active Directory user groups with current members:
   1. In the left pane of the Management Console, select Policy Elements. In the right pane, expand **User Groups**.
   2. For each Connector based group, select the group and then click **Reload**.
7. To retrieve the latest Spam Censor definition file, `spamfilter.xml`:
   1. From the left menu, select **System Configuration**.
   2. Select **Automatic Updates** in the **left pane** and click **Check for Updates Now.**
   3. When the update is complete, click **OK** and then click **Commit Configuration**.
8. On each MailMarshal email processing server computer, restore the `\InstallPath\Quarantine` and `\InstallPath\Quarantine\ValidFingerPrints` folders by following the instructions in Knowledgebase article Q10220.
9. On the database computer, restore the MailMarshal database from the backup copy. For more information about restoring a database file, see the Microsoft SQL Server or SQL Express documentation.
10. To connect to a new or existing MailMarshal database, connect to the database using the MailMarshal Server Tool. For more information, see [Joining a Node to an Array](#joining-a-node-to-an-array) and [Working with Array Communications](#working-with-array-communications).

## Configuring Local Domains

You configure a list of local email domains when you install MailMarshal. You may need to update this configuration if you change internal email servers, or if you add more Internet domains.

> [!NOTE]
>
> **Note:** The list of local domains configured in MailMarshal should always match the DNS MX records that direct email from the Internet to MailMarshal.

You can specify delivery options for local domains as part of a Route Table. Delivery options include relay to an internal email server (known as a **relay domain** in earlier versions of MailMarshal), or POP3 delivery by MailMarshal (known as a **POP3 domain** in earlier versions of MailMarshal).

If you are using an array of MailMarshal email processing servers, you can choose to set different delivery routes on each email processing server.

Local Domain settings also include DKIM and DMARC configuration, and a list of details of "executives" used in fraud detection rules.

To view the list of configured Local Domains, in the left pane of the Management Console click System Configuration, and then select **Local Domains** from the right pane menu.

### Changing Local Domains Information

You can change the list of domains MailMarshal recognizes as local.

> [!NOTE]
>
> **Note:** To change delivery locations for Local Domains, see [Configuring Routes](#configuring-routes).

To change the list of local domains:

1. In the left pane of the Management Console click System Configuration, and then select **Local Domains** from the right pane menu.
2. The Local Domains window displays a list of the local domains, and the administrative addresses and other information associated with each domain.\
    ![Local Domains window listing configured domains with administrator and server addresses](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/local-domains.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=7d5810d36e3b4b1e1d59105e937fd88d)
3. Select the action you want to perform:
   * To create a new local domain listing, click **Add.**
   * To edit an existing local domain listing, highlight it and then click **Edit.**
   * To delete an existing local domain listing, highlight it and then click **Delete.**

For details of the fields on the Local Domain windows, see Help for each window.

## Configuring Routes

MailMarshal uses Routing Tables to determine where and how to deliver email messages. When you install MailMarshal, the Configuration Wizard creates a basic Routing Table with a single entry for Local Domain email and a single entry for outgoing email.

You can add entries to the Routing Table to support a number of routing scenarios, such as:

* **Load Balancing:** Multiple entries for the same destinations, used alternately.
* **Fallback Delivery:** Additional entries for the same destination, used only when delivery fails.
* **Custom delivery** for a domain: Additional destination entries, used to deliver email addressed to specific local or remote domains through specific servers.
* **SMTP Authentication** for a route: Authenticated connection to the server that MailMarshal uses to deliver messages for the route.

A routing destination can be defined by an IP address, a host name, MailMarshal POP3, or DNS MX resolution.

You can create additional routing tables to support different routing from each processing server in a MailMarshal Array. For more information about advanced routing configuration, see Knowledgebase article Q11914.

To view the list of configured Routing Tables, in the left pane of the Management Console click System Configuration, and then click **Routes**.

### Editing Routing Table Information

You can add new routing tables, and edit existing tables.

> [!NOTE]
>
> **Note:** To change the tables used for delivery, see [Configuring Delivery Options](#configuring-delivery-options).

To change the routing tables:

1. In the left pane of the Management Console click System Configuration, and then click **Routes**.
2. The Routes window displays a list of the routing tables.
3. *If you want to create a new routing table,* click **Add.**
4. *If you want to edit an existing routing table*, highlight it and then click **Edit.**
5. The Routing Table listing shows a list of destinations.\
    ![Routing Table window listing destinations, routes, and status](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/routing-table.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=b87e7549b27a89656cc603d42af12fd3)

   > [!NOTE]
   >
   > **Note:** A destination can be "Local Domains," "Default Route" (normally used for delivery of outgoing messages and shown as **\***), or a specific domain.
   >
   > Each destination entry can be associated with one or more routes.
   >
   > Each route has a priority expressed as a number. Lower numbered routes to a destination will be used first.
   >
   > For routes that are delivered by hostname or DNS, you can choose to use IPv4, IPv6, or either as available.
   >
   > A route can support SMTP authentication (indicated in the table as \[AUTH]).
   >
   > Some routes can be marked as "down". See [Marking Routes as Down](#marking-routes-as-down).

   1. To create a new destination entry, click **Add.**
   2. To associate a new route with a destination entry, on the Domain Routing window, click **Add.**
      * If you want MailMarshal to deliver outbound email directly, set a destination of **Resolve using DNS** for the Default Route.
      * If you want to send all outbound email to a firewall, or to a relay server at your ISP, add a route using the IPv4 address, IPv6 address, or host name. When you send outbound email to another server, that server is responsible for final delivery.
      * If you want to create load-balanced delivery for a destination, add multiple routes with the same priority. (Set priority on the Advanced tab of the Route Entry window.)
      * If you want to create a primary and fallback delivery option for a destination, set a lower number (higher priority) for the primary route. (Set priority on the Advanced tab of the Route Entry window.)
      * To adjust the order of destination entries, use the arrow buttons on the route table window.

        > [!NOTE]
        >
        > **Note:** If you have route table entries for specific domains, you may need to adjust the order of destinations to ensure proper handling. For example, consider the following routing table:
        >
        > ```text theme={null}
        > popusers.example.com     POP3
        > *.example.com            exchange01.example.com:25, IPv4
        > Local Domains            10.52.0.1:25, IPv4
        > * (default)              DNS, IPv4
        > ```
        >
        > In this order, email addressed to `popusers.example.com` is delivered to POP3 mailboxes on the MailMarshal server, but email addressed to any other subdomain in `example.com` is forwarded to the relay server `exchange01.distant.example.com` on `port 25`. If you change the sequence and put `*.example.com` first in the list, email addressed to `popusers.example.com` is relayed before it can be delivered to the POP3 mailboxes, because `pop.example.com` also matches `*.example.com`.
      * If you want to use authenticated SMTP connections, select from the options on the Authentication tab of the Route Entry window. Determine the appropriate username, password, and supported methods from the administrator of the remote server. MailMarshal supports the CRAM-MD5, LOGIN, and PLAIN options for SMTP authentication. Additionally, authentication can be within a TLS session. For more information about the supported methods and behavior of this feature, see Help.\
         ![Route Entry Authentication tab with SMTP authentication credentials and logon security options](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/route-entry-authentication.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=b99f4b0743293526ba9471e97db6ca91)
6. *If you want to delete an existing routing table,* highlight it and then click **Delete.**

For additional details of the routing table options, see Help for each panel.

### Marking Routes as Down

For Routing Table destinations that are delivered to specific servers by FQDN, hostname, or IP address, you can suspend delivery by marking the route as "down". This function can be useful if you know that all servers for a particular domain will be out of service. When a route is marked as "down", messages are queued, and the time a route is "down" does not count toward the message timeout. The status (Up or Down) displays on the Routing Table window. For more details of this functionality, see Help for this window.

## Configuring Relaying

MailMarshal uses Relay Tables to determine which computers are allowed to send outgoing email through the MailMarshal installation. When you install MailMarshal, the Configuration Wizard creates a basic Relay Table that typically allows outgoing email from your Local Domain email server.

You can add entries to the Relay Table to support relaying from additional locations inside or outside your local network. Relaying is only allowed by explicit entries in the table.

> [!NOTE]
>
> **Note:** Some earlier versions of MailMarshal allowed relaying from the Local Domain server without requiring an explicit setting. This version requires an explicit entry in the Relay Table for each source.

You can create additional relay tables to support different relaying permissions from each processing server in a MailMarshal Array. For more information about advanced routing configuration, see Knowledgebase article Q11914.

To view the list of configured Relaying Tables, in the left pane of the Management Console click **System Configuration**, and then click **Relaying**.

### Editing Relay Table Information

You can add new relay tables, and edit existing tables.

> [!NOTE]
>
> **Note:** To change the tables used to control relaying on each processing server, see [Configuring Delivery Options](#configuring-delivery-options).

To change the relay tables:

1. In the left pane of the Management Console click **System Configuration**, and then click **Relaying**.
2. The Relaying window displays a list of the relaying tables.\
    ![Relay Table window listing allowed and denied relay sources](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/relay-table.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=0be8ecefd655ac5151f202e6c9f313e8)
3. Select the action you want to perform:

   * To create a new relaying table, click **Add.**
   * To edit an existing relaying table, highlight it and then click **Edit.**
   * To delete an existing relaying table, highlight it and then click **Delete.**

   Each relay table can include multiple entries that define the servers allowed and denied relaying permission. You can use a single IPv4 or IPv6 address, a hostname, or a MX lookup for a domain.

For details of the relaying table options, see Help.

## Configuring Delivery Options

MailMarshal distinguishes between "inbound" and "outbound" email.

Inbound email is email delivered to your organization. MailMarshal determines how to deliver this email based on your local domains. For more information about local domains see [Configuring Local Domains](#configuring-local-domains).

Outbound email is email delivered to locations outside your local domains. MailMarshal can deliver this email directly using DNS lookups, or by forwarding all email to a relay host.

You configure basic delivery options using the Configuration Wizard when you install MailMarshal. You can make changes later if required.

### Configuring Default Delivery Options

You can make changes to default delivery options for the entire installation using MailMarshal Properties.

To configure delivery options:

1. In the left pane of the Management Console click **System Configuration**, expand **Sender Properties**, and then click **Delivery**.\
    ![Sender Properties Delivery page with DNS servers and default routing and relay tables](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/sender-delivery.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=817b885beb13e83798c6be1557bd669e)
2. Enter a primary DNS (Domain Name Server) address used by your organization. Optionally enter a secondary DNS address. These servers should be in the local network if possible, but in any case no further away than your ISP. They must be able to resolve domain names outside your organization.

   > [!NOTE]
   >
   > **Note:** MailMarshal does not use the DNS servers configured in Windows networking.
   >
   > If MailMarshal must perform DNS lookups through a firewall, the firewall must permit both TCP and UDP based lookups.
3. Select a Routing Table that defines how MailMarshal should deliver email messages. For more information about Routing Tables, see [Configuring Routes](#configuring-routes).
4. Select a Relaying Table that defines the servers MailMarshal will allow to send outgoing mail. For more information about Routing Tables, see [Configuring Relaying](#configuring-relaying).
5. To complete the changes, click **Save** on the MailMarshal Properties window and commit the configuration.

### Configuring Delivery Options For A Specific Server

If you are using an array of MailMarshal servers, you can choose to set delivery options for each server.

To set delivery options for a specific server:

1. In the left pane of the Management Console click **Mail Servers.**
2. Select a server in the list and click **Edit**.
3. Click the **Delivery** tab.
4. Select **Customize the Delivery Settings.**
5. Change the entries as desired. For details of the fields and settings, see [Configuring Default Delivery Options](#configuring-default-delivery-options).

## Setting Up Accounts

MailMarshal accounts consist of a user name and password. You can use accounts for two purposes:

* To authenticate user connections using a Connection Policy rule, or check for authenticated connections using a Content Analysis rule. For more information, see [Where sender did/did not authenticate successfully](/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#rule-conditions-for-connection-policy-rules) and [Where the DKIM verification result is](/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#where-the-dkim-verification-result-is).

  > [!NOTE]
  >
  > **Note:** If you use this feature to allow one or more accounts to relay email, consider the following best practices:
  >
  > Ensure that these accounts have strong passwords. If an account password is guessed by a malicious person, MailMarshal could become an open relay. Change the passwords periodically.
  >
  > Use accounts that are only used for this purpose, and not Windows accounts with other permissions. Password transmission during authentication is not strongly secured.
  >
  > You can also check authentication using an Active Directory group. This option does not require you to enter account details in MailMarshal. It may be useful if many accounts are allowed to authenticate, or if accounts change frequently. For details, see Knowledgebase article Q16649.
* To specify users for the MailMarshal POP3 server. If you will be using accounts for POP3 delivery, set up a default routing table with POP3 routing for all required domains before creating accounts. For more information about POP3 domains, see [Editing Routing Table Information](#editing-routing-table-information).

  > [!NOTE]
  >
  > **Note:** The MailMarshal POP3 server is not designed to be used in an installation with more than one email processing server.

### Creating Accounts

Create accounts using the MailMarshal Management Console.

To create accounts:

1. In the left pane of the Management Console click **Policy Elements**, and then click **Accounts**.
2. Click **Add**.
3. Enter the details for the user name and authentication information in the New Account window.
4. Enter one or more appropriate SMTP aliases for email delivery to this account's POP3 mailbox. Enter the complete addresses. Use the Enter key to complete each entry. Only use domain names for which MailMarshal is functioning as a POP3 local domain server, based on the active Routing Table.

   > [!NOTE]
   >
   > **Note:** If the routing table includes POP3 delivery for "Local Domains," you can enter the special value `Local Domains` for the domain part of the alias (for example, `someuser@Local Domains`). This entry ensures that email directed to the account name at any local domain will be correctly delivered. This value is case sensitive and the space between words is required.
   >
   > If you want to use the account only for authentication, type `none`.
   >
   > If you enter the same SMTP alias in more than one POP3 account, messages directed to that alias will be delivered to all of the mailboxes.
5. If the password fields are blank, MailMarshal will use Windows authentication to determine access for this account. In this case, ensure that the account name matches the name of a valid Windows user account that can be authenticated on all email processing servers.
6. To add the account, click **Save.**
7. Continue to add other accounts.
8. Click **Commit Configuration Changes**.

### Editing Existing Accounts

Edit an account to change the password or email addresses associated with the account.

To edit an existing account:

1. In the left pane of the Management Console click **Policy Elements**, and then click **Accounts**.
2. Double-click the account you want to edit.
3. Change the password and aliases as required.
4. Click **Save.**

### Deleting Accounts

Delete accounts that are no longer required. If you delete an account used for email delivery, you should also delete the delivery folder from the MailMarshal sending queue directory.

To delete an account:

1. In the left pane of the Management Console click **Policy Elements**, and then click **Accounts**.
2. Select the account you want to delete.
3. Click **Delete**.
4. To remove the delivery folder, on the processing server use Windows Explorer. Within the MailMarshal installation navigate to the `\Queues\Sending\` directory.
5. Back up the contents of the subdirectory for the account that you deleted.
6. Delete the subdirectory.

## Configuring Email Batching

MailMarshal supports batch receipt and sending of email messages where you do not want to have an on-demand connection to the downstream email server. Mail batching is implemented through the `MMGetMail.exe` helper application. You can use this application in batch files or custom scripting. For more information about `MMGetMail`, see Knowledgebase article Q10285.

> [!NOTE]
>
> **Note:** The integrated Mail Batching and Dial-Up Networking functions that were available in earlier versions of MailMarshal have been discontinued.

## Configuring DKIM

MailMarshal can sign and validate messages with DomainKeys Identified Mail (DKIM). Signing can be controlled by policy, and validation results can be used in policy conditions.

To use DKIM for received messages you must enable message validation. To use DKIM for sending from local domains, you must enter key information for each local domain and then add a rule to apply signatures.

To configure DKIM validation:

1. In the left pane of the Management Console click **System Configuration**.
2. From the right pane menu expand Receiver Properties and select **DKIM**.
3. To enable DKIM validation, check the box **Enable DKIM Detection.** To disable the feature, clear the box.
4. To apply the changes, commit the configuration.

To configure DKIM keys for local domains:

1. In the left pane of the Management Console click **System Configuration**.
2. In the right pane, click **Local Domains**. Select a domain, and then click **Edit**.
3. Click the DKIM tab.
4. Click **Add** to generate or import a key, and select appropriate settings. For details, see Help.

   > [!NOTE]
   >
   > **Note:** Keep a copy of the key file in a secure location. DKIM signing keys are not included in the MailMarshal configuration backup.
5. Ensure that you have published a DNS TXT record that includes the related public key. The DKIM Key window provides the appropriate record text for the key.\
    ![DKIM Key window showing the selector, DNS name, publish status, and DNS record text](https://mintcdn.com/levelblue-5324744e/x21QTv9fJshn3W3y/images/mailmarshal/dkim-key.png?fit=max\&auto=format\&n=x21QTv9fJshn3W3y\&q=85\&s=0a1f1ab33c8251fefb35b925f4a8578b)

   > [!NOTE]
   >
   > **Note:** The TXT record will have a name like *selectorname*.`_domainkey.`*domain.TLD* (for example, `20190822._domainkey.example.com`).
   >
   > For more information about creating and publishing keys for DKIM, see Knowledgebase article Q20841.
6. **To sign messages**, once the DKIM key is created and published, use a Content Analysis Rule to apply the DKIM signature. See [Apply DKIM signature](/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#apply-dkim-signature).

## Configuring DMARC

MailMarshal can participate in DMARC for local domains you specify. DMARC relies on SPF and DKIM. For an overview of all required configuration, see LevelBlue Knowledgebase article Q20650.

To use DMARC, you must set up information for one or more local domains and then enable DMARC for each domain. You can then choose to configure Content Analysis rules to take action on incoming messages depending on the results of DMARC validation.

> [!WARNING]
>
> **Important:** Enabling DMARC for a local domain causes DMARC validation and reporting to be performed for all messages addressed to the domain, as well as including the required DMARC information with each message sent from the domain through MailMarshal. This behavior is required by the DMARC framework.

To configure DMARC for a local domain:

1. In the left pane of the Management Console click **System Configuration**.
2. In the right pane, click **Local Domains**. Select a domain, and then click **Edit**.
3. Click the DMARC tab.
4. Ensure that a DMARC DNS record has been found and displayed. If a record does not display, investigate further that the record does exist and will be propagated to public DNS.
5. Select **Enable DMARC**.
6. Configure and enable rules to apply DMARC policy and accept DMARC reports. Rules are included in the default rules for new installations, and in a special policy group that is created on upgrade.

You can review DMARC results by sending DMARC report email to a third party site.

## Managing Array Nodes

A MailMarshal installation consists of an Array Manager and one or more email processing servers, also known as array nodes.

### Managing Node Services

You can view the status of the MailMarshal services on each email processing node, and stop or restart the services, from the MailMarshal Management Console.

To see an overview of the status of services on each node, in the left pane of the Management Console click **Mail Servers.**

To see details of the status of services on a particular node, and to stop or restart the services:

1. In the left pane of the Management Console click **Mail Servers.** The list shows all servers and a summary of the state of each server. (For more details about the information listed, see Help.)
2. In the right pane select the server you want and click **Edit**.
3. Select **General** from the left pane to see the Services listing and to see the status of each service installed on the node.
4. To stop one or more services, select them in the list then click **Stop.**
5. To start one or more services, select them in the list then click **Start.**
6. To restart all services, click **Restart all**.

> [!NOTE]
>
> **Note:** If you stop services from this window, they will remain stopped until you start them. Committing the configuration will not start the services.

### Adding and Deleting Nodes

You can add email processing servers (nodes) to a running MailMarshal installation to add capacity or redundancy. You can also delete existing nodes from an installation.

#### Adding a Node

You can add a node at any time without affecting other nodes. After adding the node, adjust email routing so that the new node shares in email processing. Contact your Internet Service Provider or DNS administrator, as necessary.

> [!NOTE]
>
> **Note:** Adding a node does not create automatic load balancing.

To add a node to a MailMarshal installation:

1. Log on to the new server.
2. Install MailMarshal.
3. During installation, select the option "I want to join an existing array" and enter the name of the existing Array Manager.
   * You must provide both a Windows account that can connect to the Array Manager, and an Array Join credential managed through the MailMarshal Server Tool.

For more information, see [Installing MailMarshal as an Array](/documentation/mailmarshal/user-guide/installing-and-configuring.md#installing-mailmarshal-as-an-array).

#### Deleting a Node

You should delete a node to cleanly remove it from the MailMarshal array. Before deleting a node, adjust email routing so that the node to be deleted does not process any email. Contact your Internet Service Provider or DNS administrator, as necessary.

To delete a node from a MailMarshal installation:

1. Stop MailMarshal services on the node using the MailMarshal Management Console.
2. If you want to preserve messages from quarantine folders stored on the node, back up the Quarantine folder in the MailMarshal installation folder on the node.
3. Uninstall MailMarshal on the node server using the Add/Remove Programs application in Control Panel.
4. During the un-installation process, MailMarshal will attempt to remove the node records from the array installation.
   * To remove the node records from configuration you must provide both a Windows account that can connect to the Array Manager, and an Array Join credential managed through the MailMarshal Server Tool. Currently this is the only way to remove a node from configuration.
5. In the Management Console, an un-installed node that has not been removed will show a blank status.

### Joining a Node to an Array

You can join an email processing server (node) to a MailMarshal array. After joining the array, the node will retrieve policy configuration from the Array Manager.

To join an existing node to a MailMarshal installation:

1. Log on to the node server.
2. Run the MailMarshal Server Tool from the MailMarshal program group.
3. On the Node > Array page, enter the local port, and the port and server name for the Array Manager. Select **Join Array,** and then click **Apply.**
   * You must provide both a Windows account that can connect to the Array Manager, and an Array Join credential managed through the MailMarshal Server Tool.

### Customizing Settings for Nodes

Since the purpose of a MailMarshal array is to replicate configuration over a number of processing servers, most settings will be the same for all nodes. You can configure the following settings for each node:

**Server name and general information**

For each email processing server, you can view and change the server name and the description and location notes.

> [!NOTE]
>
> **Note:** Only change the server name here if you have changed the computer name of the email processing server.

**Delivery information**

For each email server in an array, you can specify DNS servers, and the relay and routing tables to use. One use of this override would be to allow geographically separated MailMarshal servers to deliver inbound email to different internal email servers.

**Internet Access information**

For each email server in an array, you can specify proxy settings (or direct access) that will allow the server to retrieve SpamProfiler updates over the Internet.

**Inbound TLS information**

For each email server in an array, you can configure Transport Layer Security (TLS) usage including a certificate.

**Server Threads**

For each email server in an array, you can configure the number of processing threads used.

**Advanced server information**

For each email server in an array, you can choose one or more IP addresses and ports the MailMarshal Receiver will bind to. You can specify what percentage of available threads each address:port can use. This setting allows you to reserve some Receiver capacity for specific connections (for instance to ensure that outgoing email will be accepted even if incoming volume is high)

> [!NOTE]
>
> **Note:** By default, the Receiver binds to port 25 on all configured IP addresses. This setting allows MailMarshal to receive all email sent to each email processing server at the default SMTP location. If you customize the Receiver bindings, ensure that you add a setting for each configured address.

You can specify a host name, which may be required if this information is not entered in the Windows networking properties. You can also select whether the email processing server should be preferred by the Array Manager as a host to be used in sending notifications.

## Understanding Secure Email Communications

MailMarshal allows you to secure outgoing and incoming email using transport layer security (TLS), an implementation of secure sockets layer (SSL). MailMarshal supports the enhanced security of Perfect Forward Secrecy (PFS).

TLS secures the privacy of the communications channel and provides one-way authentication. TLS is generally used to provide a secure (encrypted) transport over which email communications including the headers, body and attachments are delivered. TLS can also assist in verifying server authenticity.

Use TLS when you want to secure your organization's email from being read by unauthorized users inside or outside of your organization. Secure email may be required if your organization sends or receives mail containing information that is protected under laws, such as the US Health Insurance Portability and Accountability Act (HIPAA).

TLS uses public-private key pair encryption on each MailMarshal server to secure an email communications channel and to authenticate itself to clients.

> [!NOTE]
>
> **Note:** TLS slows your email operations to a limited degree.
>
> TLS works only when ESMTP (EHLO extensions) is enabled. (This is the default setting.) TLS does not work with HELO.

## Securing Email Communications

You can use MailMarshal to secure incoming and outgoing email communications. MailMarshal allows you to decide where and under what conditions you want to use TLS. Setting up TLS involves three tasks:

1. Creating or importing a TLS Certificate
2. Enabling TLS for mail incoming to MailMarshal
3. Enabling TLS for mail outbound from MailMarshal.

> [!NOTE]
>
> **Note:** For more information about configuring TLS, see Knowledgebase article Q11636.

When TLS is configured, you can use rules to take action on incoming messages based on the use of TLS and details of the SSL certificate used by the remote server.

### Working with Certificates

Each MailMarshal server using TLS makes its secure status public using a certificate. MailMarshal stores TLS Certificates on each server. For each MailMarshal server with which you want to use TLS, you must generate or obtain an authentication certificate. To perform these tasks, use the TLS Certificate Wizard.

Certificates have expiration dates. Starting two weeks before a certificate expires, MailMarshal sends a daily renewal reminder email to the MailMarshal administrator.

The TLS Certificate Wizard allows you to perform the following tasks:

* Generate a Certificate Signing Request (CSR) that you submit to a third-party certificate authority
* Import X.509 and PKCS#7 key-certificate backup files supplied by a certificate authority
* Generate self-signed certificates
* Save server-specific key-certificate pairs as PKCS#12 files
* Import PKCS#12 files

To create or manage certificates:

1. In the left pane of the Management Console, expand **Mail Servers.**
2. In the right pane listing of servers, edit the MailMarshal server for which you want to configure TLS.
3. Click **Inbound Security (TLS)**.
4. Click **TLS Certificate Wizard**.
5. Enter the required information on each tab to complete the certificate task you are performing. For more information about the workflow and the fields on each tab, click **Help**.
6. On the server pane, click **Save**.

### Securing Inbound Communications

Using TLS is optional for incoming email. You can enable or disable TLS, and set the minimum required cipher strength for inbound connections. You can enable Perfect Forward Secrecy (PFS) by selecting an Elliptic Curve to be used for key exchange.

MailMarshal requires you to set incoming email TLS configuration on each email processing server in an array. Repeat the following task for each email processing server.

To enable TLS for inbound connections on a MailMarshal email processing server:

1. In the left pane of the Management Console, expand **Mail Servers.**
2. In the right pane, select **Servers** and then select the name of the email processing server for which you want to configure TLS.
3. Click **Inbound Security (TLS)**.
4. Specify the appropriate values. For more information about the options, click **Help**.

   > [!NOTE]
   >
   > **Note:** The **Enable TLS** option is available only when a valid certificate is installed on the server.
5. On the server pane, click **Save**.
6. Commit configuration changes.

When a message is received with TLS, the Received: header line is marked with the version of TLS and the cipher used. For instance:

```text theme={null}
Received: from client03 (Not Verified[127.0.0.1]) by vm-example03 with Trustwave SEG (v10,0,662,1) (using TLS: TLSv1, AES128-SHA).
```

You can use Connection or Content Analysis rules to take action based on the TLS status, the TLS protocol that was used, and the SSL certificate that was used. You can choose to classify, accept, reject, or quarantine messages depending on the information encoded in the certificate. You can check the validity date, permitted certificate use, certificate domain, trust, and revocation status. For full details of the available options, see Help for the Rule Condition "Where the TLS client certificate matches criteria."

> [!NOTE]
>
> **Note:** Ensure that the processing servers can connect to Internet locations using HTTP and HTTPS. This access is required for checking of Certificate Revocation Lists. You can use a proxy server for web access if required; see [Customizing Settings for Nodes](#customizing-settings-for-nodes).

### Securing Outbound Communications

Using TLS is optional for outgoing email. You can enable TLS, require TLS for specific domains, set the minimum cipher strength, and choose whether to offer a client certificate when requested by a remote server. Outbound TLS uses Perfect Forward Secrecy (PFS) if advertised by the remote server.

MailMarshal applies the TLS configuration for outbound email across all email processing servers in the array.

To enable TLS for outbound email:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane, expand **Sender Properties > Outbound Security (TLS)**.
3. Specify the appropriate values. For more information about the options, click **Help**.
4. On the server pane, click **Save**.
5. Commit configuration changes.

When a message is sent using TLS, MailMarshal classifies the message as "Delivered successfully over TLS." You can review this information in the Console, and report on it using Marshal Reporting Console.

> [!NOTE]
>
> **Note:** You can also require delivery over TLS based on rule conditions. See the rule action [Deliver the mail via TLS only](/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#deliver-the-mail-via-tls-only).

## Setting Advanced Options

MailMarshal allows you to configure a number of advanced settings. These settings default to values that are reasonable in the majority of cases. In specific cases you may need to change them. For full details of the settings, see Help for each pane on the Advanced Setting window.

### MailMarshal Properties – Advanced

These options affect delivery and processing of email. If more than one MailMarshal server is included in an array, these options affect all servers. Some options can be overridden for each processing node (see [Customizing Settings for Nodes](#customizing-settings-for-nodes)).

**Engine Blended Threats exclusions**

Allows you to maintain a list of domains (or domain wildcard patterns) that will never be rewritten for Blended Threat scanning.

**Engine Executive Name List**

Allows you to maintain a list of personal names and/or email addresses that will be used to help with detection of targeted fraud email for all incoming messages managed by this server. You can also maintain separate lists for each domain, using the Local Domain settings. For more information about this facility, see the technical reference "MailMarshal BEC Fraud Detection Basics," available from the documentation section of the LevelBlue website.

**Engine Advanced options**

Allows you to set options for RTF stamping and unpacking depth.

**Receiver Advanced options**

Allows you to set behaviors of the MailMarshal Receiver, including greeting strings, advertising of ESMTP, and other items.

**Sender Advanced options**

Allows you to set behaviors of the MailMarshal Sender, including ESMTP sending and deadlettering options.

**Server Threads**

Allows you to configure threading for optimal performance.

**Templates**

Allows you to override the administrative notification messages built in to MailMarshal.

**Times**

Allows you to set retry and expiration timeouts for the Receiver and Sender services.

**Commit Scheduling**

Allows you to specify times of day when configuration changes should be committed at the MailMarshal node processing servers. This functionality is designed to allow deferred commits so as to minimize impact on systems during the business day. The commit schedule is relative to the time zone of each processing server.

**Product Improvement Program**

Allows you to opt in or out of the Product Improvement Program. See Help for details.

To configure advanced server options:

1. In the left pane of the Management Console, click **System Configuration.**
2. In the right pane menu tree, navigate to the required option, found under Advanced System Properties, Engine Properties, or other Advanced items.
3. Specify the appropriate values. For more information about the options, click **Help**.
4. Click **Save**.

### Advanced Settings

The Advanced Settings page of the Console (**Configuration > Advanced Settings**) allows you to manage additional detailed settings for the MailMarshal installation. These settings generally replace the Registry configuration items that were used in earlier versions. For more information see Help and LevelBlue Knowledgebase articles.

The Console also includes an Advanced Settings page for each email processing server, found under **Management > Mail Servers**.

### Setting Up Syslog Integration

MailMarshal can send advanced information about messages and message handling to a Syslog server. Information that can be sent includes:

* Message records
* Content (message attachment) information
* Rejected message (connection blocking) details
* Quarantine Audit (message release) details.

> [!NOTE]
>
> **Note:** The MailMarshal Syslog integration does not handle Windows event log messages. You can forward event log information to a Syslog server using third party tools.

Before enabling Syslog in the Management Console, you must create a database to store the formatted information temporarily before it is sent. To configure this database, use the MailMarshal Server Tool (**Array Manager > Syslog Database** tab).

To configure Syslog servers and record formats:

1. In the left pane of the Management Console, click **System Configuration.**
2. Navigate to **Array Properties > Syslog**.
3. Select **Enable Syslog**, and then configure the information required to connect to the Syslog server. You can select:
   * The server name or IP address and listening port
   * The transport method (UDP, TCP, or TCP with TLS)
     * If you select TCP with TLS, the certificate of the Array Manager REST API interface is used.
   * The record format
   * The hostname and application name to include in the Syslog records
4. In the Templates section, select the types of data to be sent, and configure templates to control the data included in each record.

For more information, click **Help**.

### Setting Up Azure Information Protection Integration

MailMarshal can scan documents protected by Azure Information Protection (AIP) Rights Management.

MailMarshal provides full support for the following (including scanning, message repacking, and viewing in the Console), provided that MailMarshal has the correct rights to read the protected content:

* Restricted-permission message (RPMSG)
* Office documents in either binary format (also known as compound files), or ECMA-376 Office Open XML format.
* Generic pfiles (files unpacked from a protected message, including images, documents, zip files, and any files supported by MailMarshal).

> [!NOTE]
>
> **Note:** MailMarshal does not scan or change documents delivered by direct link (where the email client does not support AIP Rights Management and the user clicks a link that retrieves the document from Azure directly). In these cases the original content is delivered over the link, and MailMarshal does not have access to this data.

Before enabling AIP in the Management Console, you must install the Rights Management Service (RMS) Client on all processing servers. The RMS Client installer is available from a link on the MailMarshal installer Prerequisites page.

To validate the presence of the RMS client:

1. In the left pane of the Management Console, click **System Configuration.**
2. Edit the properties of each server, and navigate to the Azure Information Protection tab.

To enter and validate AIP credentials:

1. In the left pane of the Management Console, click **System Configuration.**
2. Navigate to **Array Properties > Azure Information Protection**.

For more details, see Knowledgebase article Q21029, and Help for this Management Console page.

> [!WARNING]
>
> **Caution:** If you enter and commit incorrect details for AIP, messages that require the AIP RMS functionality will be deadlettered. If AIP RMS components are detected in a message but no AIP credentials are available, this fact is logged in the Engine log.

### Setting Node Properties – Advanced

These options affect delivery and processing of email. If more than one MailMarshal server is included in an array, these options can be set for each server.

* Receiver Binding
* Server Host Name
* Notification Delivery

For more information about these settings, see [Customizing Settings for Nodes](#customizing-settings-for-nodes).

### Working with Array Communications

When MailMarshal is configured as an array of servers with an Array Manager and one or more other servers as email processing servers, the MailMarshal servers communicate over TCP/IP. By default, MailMarshal uses port 19001. If the Array Manager and email processing services are installed on the same server, by default the email processing services use port 19002.

You can configure these settings using the MailMarshal Server Tool, which is installed on each server. You must configure the settings on each server individually.

> [!NOTE]
>
> **Note:** Do not attempt to make changes in the MailMarshal Management Console application while using the Server Tool.

#### Changing Array Port Settings

You can change the TCP ports used by the MailMarshal services. For instance, you may want to alter the default port numbers to enhance security.

To change the port settings:

1. Log on to the server using an account with Administrator permissions.
2. Run the MailMarshal Server Tool from the MailMarshal Tools group in the MailMarshal program group.
3. *If the server is an email processing server* (not an Array Manager or standalone server):
   1. On the Node > Array page, you can change the Node Port used by the services to listen for communications from the Array Manager. When you apply this change and restart the services, MailMarshal will report the change to the Array Manager.
   2. You can also change the Array Manager port used by the services to connect to the Array Manager. This entry must match the port specified at the Array Manager.
4. *If the server is an Array Manager:* On the **Array Manager > Ports** page, you can change the port used by the Array Manager to accept connections from email processing servers and the SQM component.

   > [!NOTE]
   >
   > **Note:** If you change this value, to restore full functionality you must also change the corresponding value in the SQM website configuration if installed.

#### Changing the Database Location

You can change the location of the MailMarshal database using the Server Tool on the Array Manager server. Because most configuration information is stored in the database, in general you should only use this option if you must change the Microsoft SQL Server on which the database is hosted.

When you create a new database, MailMarshal does not retain Spam Quarantine Management logins and related data.

To change the database location:

1. Back up the MailMarshal configuration.
2. Log on to the Array Manager server using an account with Administrator permissions.
3. Run the MailMarshal Server Tool from the MailMarshal Tools group in the MailMarshal program group.
4. If you want to move the existing database:
   1. Stop all MailMarshal services.
   2. Move the database to the new location using Microsoft SQL Server tools.
5. On the Database page, enter the new SQL Server name and database name. Click **Apply.** If necessary, MailMarshal will present options to use or recreate an existing database. *If you have moved a database and selected it,* choose **Use** and click **OK.**
6. If the Array Manager also hosts a processing node, MailMarshal will offer to rejoin the node to the array. You must complete this step either now or later.
7. MailMarshal will ask to restart services. You must complete this step either now or later.
8. Restore the MailMarshal configuration.
9. *If the installation is an array with additional processing nodes*, use the Server Tool on each email processing server to rejoin the servers to the array. See [Joining a Node to an Array](#joining-a-node-to-an-array).

### Changing Folder Locations

You can change the default location for MailMarshal logging, quarantine, message unpacking, and message queues on each email processing server using the MailMarshal Server Tool. For more information about the how these folders are used, see [Understanding MailMarshal Folder Locations](/documentation/mailmarshal/user-guide/planning-your-installation.md#understanding-mailmarshal-folder-locations).

To change the locations of folders:

1. Using the MailMarshal Management Console, stop the MailMarshal services on the email processing server where you want to move folders.
2. Log on to the email processing server using an account with Administrator permissions.
3. Run the MailMarshal Server Tool from the MailMarshal Tools group in the MailMarshal program group.
4. On the Array Manager > Folders page and/or the Node > Folders page, change the locations. You can enter a full path relative to a local drive letter, or a partial path relative to the MailMarshal installation folder.
5. Click **OK.** The Server Tool will offer to copy files from the old locations. The Server tool will also offer to restart the MailMarshal services.
6. The Server Tool will not delete files from the old locations. You can safely do so using normal Windows procedures.

> [!NOTE]
>
> **Note:** You can change the location of an individual folder. For more information, see [Working with Folders](/documentation/mailmarshal/user-guide/email-policy-elements.md#working-with-folders).

## Using the Group File Import Tool

The MailMarshal Group File Import Tool is a command-line tool you can use to import information into MailMarshal user groups.

Run the `GroupFileImport.exe` from the MailMarshal `\InstallPath` folder. By default, the installation path is `\Program Files\Trustwave\Secure Email Gateway`.

> [!WARNING]
>
> **Caution:** Replacing the membership of a large group can take a significant amount of time. If you plan frequent changes to groups that are actively used in rules, consider using Connector based groups or the REST API.

To use the group file import tool:

1. Using a text editor such as Notepad, create the input file that contains the names of the groups and user email addresses you want to import. For more information, see [Group File Import Text File Format](#group-file-import-text-file-format).
2. Log onto the Array Manager computer as a member of the local Administrators group or other user account with permissions to modify the registry.
3. Open a command window and navigate to the folder where you installed MailMarshal.
4. Type the group file import command with the options you want to specify. For more information, see [Group File Import Command Format](#group-file-import-command-format).
5. After the users and groups are imported, close the command window.

> [!NOTE]
>
> **Note:** User and group information is synchronized to processing servers within a few minutes. Configuration commit is not required.

### Group File Import Text File Format

To use this tool, create a file using a plain text editor, such as Notepad. The file contains group names followed by a list of email addresses of the users in each group. You can also use the asterisk (\*) wildcard to allow address matching. The following text illustrates the file format to use:

**Table 25: Group File Import file syntax**

| Element | Description |
| - | - |
| \[New Group] | Group name |
| [Jim@example.com](mailto:Jim@example.com) | Email address |
| [John@example.com](mailto:John@example.com) | Email address |
| q\*@example.com | Several email addresses specified using wildcard |

### Group File Import Command Format

Use the following syntax and options to issue the command:

```text theme={null}
GroupFileImport.exe [options] {-f inputfilename}
```

The following example imports user addresses from `mygroups.txt`, and merges the addresses into the group if the group name already exists.

```text theme={null}
GroupFileImport.exe -m -f mygroups.txt
```

**Table 26: Group File Import command options**

| Option | Use |
| - | - |
| -h \{*computer name or identifier*} | Array Manager name or IP address. Defaults to `localhost`. |
| -p \{*IP Port*} | Array Manager port (defaults to `19001`). |
| -n \{*text*} | Text string prefixed to all group names at import, such as *File Group:* |
| -m | Merge imported data. **Cautions**: If a group in the import file has the same name as an existing group, existing items in the group are not deleted. MailMarshal adds new items from the import file group. Using the command without the -m switch deletes all members from an existing group before importing the file contents. |
| -v | Verbose mode. Generates warnings about individual group members for troubleshooting. |
| -u \{*user name*} | User name used to connect to the Array Manager server. Defaults to the logged-on user. |
| -d \{*domain*} | Domain in which the user name is found. |
| -k \{*password*} | Password associated with the user name. |
| -? | Prints help for the utility. |

## Using the Configuration Export Tool

The MailMarshal Configuration Export Tool is a command line tool that allows you to export and import MailMarshal configuration settings from a command line interface or batch file. The input and output of this command is a zip archive that contains the MailMarshal configuration information.

> [!NOTE]
>
> **Note:** To import a configuration saved from MailMarshal 8.2 in XML format, use the Configuration Converter Tool described in [Using the Configuration Converter Tool](#using-the-configuration-converter-tool).

You can use the Configuration Export tool from any system that has HTTPS access to the Array Manager and the Config Service site. Default settings assume the tool is running on the Array Manager computer. Open a command prompt to run the command.

> [!WARNING]
>
> **Caution:** This version of the tool has different functionality compared to earlier versions. Some options have different meanings or defaults.

### Export Configuration Command Format

The syntax and options of the `MMExportCfg.exe` command are as follows:

```text theme={null}
MMExportCfg.exe -u {username} -p {password} [other options]
```

The following example imports the MailMarshal configuration from `myconfig.zip` to the local system.

```text theme={null}
MMExportCfg.exe -u admin -p admin -i -f myconfig.zip
```

**Table 27: Configuration Export Tool command options**

| Option | Use |
| - | - |
| -h | Display help. |
| -f | Specifies the name of the file for export or import. Use the extension .zip |
| -d \{*password*} | On export, include DKIM keys and protect them with the password. On import, import DKIM keys that are protected by the password. |
| -v | Show verbose information about the import or export. |
| -a \{*URL*} | Array Manager URL. Defaults to `https://localhost:19006`. |
| -c \{*URL*} | Config Service URL, used to log in and get a credential (JWT ticket) to access the Array Manager. Defaults to `https://localhost:19007`. |
| -u \{*username*} | Username to authenticate. This is always a MailMarshal username, not a Windows credential, regardless of the settings for Management Console authentication. |
| -p \{*password*} | Password to authenticate. |
| -i | Imports the configuration from the specified file. Without the -i option, the command **exports** the configuration. |
| -r | On import, replace DLL files such as Unpacker and FileType with the files from the import. If you do not include this option, the currently running copies of DLL files will not be changed. |

## Using the Configuration Converter Tool

You can use the Configuration Converter to update the format of a configuration file saved from MailMarshal 8.2.3 or later 8.2 release. The syntax and options of the `MMConvConfig.exe` command are as follows:

```text theme={null}
MMConvConfig.exe {inputfile.xml} {outputfile.zip}
```

For example:

```text theme={null}
MMConvConfig.exe 823Backup.xml updatedReadyToRestore.zip
```

## Using the Config Service Admin Tool

The MailMarshal Config Service Admin Tool is a Windows application that allows you to manage the following items:

* Database and website connectivity settings of the Management Console
* Superusers of the Management Console and API
* Authentication method for the Management Console. Available methods include MailMarshal authorized users/passwords, Windows Authentication, or SAML based Single Sign On.
* Windows groups to check for allowed Windows users of the Management Console (if Windows Authentication is configured).

To use the tool, log on to the server hosting the Management Console website, using a Windows account with administrative permissions (for example, as a member of the Windows administrator group on the system). From the Start menu select **MailMarshal Config Service Admin Tool**, or navigate to the `Config Service` subfolder in the MailMarshal installation folder, and run `SegCfgServiceAdminTool.exe`. For more information, see Help for the tool.