Mail Assure. Quick Start Guide

Transcription

1 Mail Assure Quick Start Guide Last Updated: Wednesday, November 14,

2 CONTENTS Firewall Settings 2 Accessing Mail Assure 3 Application Overview 4 Navigating Mail Assure 4 Setting up Your Domain 5 Add a Domain 5 Check your New Domain can Communicate with the Mail Server 6 Update Your MX Records 7 Update Your MX Records in Your Domain Provider's DNS Settings 8 To Access the Log Search: 9 Outgoing Filtering 10 Configuring Mail Assure 10 Create the Outgoing User 10 Configure the Abuse Report Address 12 Configuring Your Domains 12 Set up SPF 12 To Set up SPF 13 Set up DKIM 13 Set up Your SMTP Hostname 13 Configuring Your MTA 13 Additional Info 14 Connection Limits 14 Available Outgoing Ports 14 Block Outbound Traffic on Port Automatic Recipient/Mailbox Detection 15 Incoming valid recipient (mailbox) count 15

3 Outbound Sender Count 15 Manually Set up Recipients/Mailboxes 15 Archiving 17 Reporting 18 Adding Webinterface Users 19 Adding an Admin User 19 Adding a Domain User 21 Adding an User 22

4 This Quick Start Guide describes how to get up and running quickly with the Mail Assure application. Firewall Settings - Make sure your firewall is configured to accept Mail Assure traffic Accessing Mail Assure Application Overview Add a Domain Find Destination Server Hostname Update Your MX Records Outgoing Filtering Automatic Recipient/Mailbox Detection Archiving Reporting Adding Webinterface Users For more information on the Mail Assure application, see the Full Online Help

5 Firewall Settings All message delivery for Mail Assure global/us/uk/eu/au/ca comes from the /22 IP range. To prevent your firewall(s) from restricting mail traffic, make sure the IPs from this range are accepted. This can also be specified as: /24, /24, /24 and /24. If you wish to use the telnet test from the webinterface or use LDAP sync/authentication, you need to authorize the webinterface IP / 2001:1af8:4500:a034:101::2. (Note - This is not required for deliveries)

6 Accessing Mail Assure Log into the Mail Assure Control Panel using the URL and credentials provided by your account manager. Once you are logged in you are presented with the application Control Panel - see Application Overview

7 Application Overview Navigating Mail Assure To navigate Mail Assure, use the left-hand Navigation panel or the Dashboard icons to move around the system

8 Setting up Your Domain Now that you have access to the Mail Assure Control Panel, the first thing you need to do is add a domain. If you do not have a specific destination server route to add from the start, the Control Panel will automatically fill in the destination route for you, with a default destination port 25. After setting the destination route, you need to add our MX Records to your domain provider's DNS Settings, in order to point to the Mail Assure Hosted Cloud routes. Add a Domain - Add your domain(s) to the system so you can start filtering incoming and outgoing messages. Find Destination Server Hostname - Find the destination server address whether you are using your local mail server or Office 365. Update Your MX Records - Add MX Records to your Domain Provider's DNS Settings, in order to point to the Mail Assure Hosted Cloud routes. Add a Domain 1. In the Control Panel Dashboard, click on Domains - Add Domain: 2. In the Add domain page, enter your domain name and click Continue. 3. After verifying that the domain name you have entered is correct, make sure that the destination server route is valid: - 5 -

9 For details on how to find your Destination server hostname, see Find Destination Server Hostname. If you do not have a specific destination server route to add from the start, the Control Panel will automatically fill in a suggested destination route for you (this route is detected from the domain's existing MX records), with a default destination port 25. Once you have set your destination route(s) here, they will be displayed in the Incoming > Destinations page. For more information see the full online help, Manage Destinations. 4. To restrict processing of the domain's messages to the data centers for a specific geographic region, choose the territory from the following available Regions: Global (recommended) United States European Union United Kingdom Australia Canada We recommend using the default Global region to make optimal use of our globally distributed cloud and infrastructure redundancy. When selected, our Global data centers are used for filtering, logging and quarantine. 5. Click Add to save your new domain. Now that you have set up your domain with the correct destination host, you need to test that Mail Assure is communicating with the server: Check your New Domain can Communicate with the Mail Server To ensure Mail Assure can communicate with the mail server, carry out a Protection status check: 1. In the Admin Level Control Panel, select Domains > Overview to display all of your domains

10 2. Click on the dropdown alongside the new domain, and select Protection status to check the routes you have set: The Protection status dialog should display connection details. If connection failed, a series of 'Connection timed out' responses are displayed. Use the Protection Status dialog to check the catch-all status of your mail server. If catch-all is enabled, the protection status check will show as failed. In this situation you should either disable catch-all on your server or ensure that the Accept mail only for mailboxes listed in the Mailbox tab option is ticked in the Domains > Mailboxes Overview > Configuration tab page at the Domain Level. See Full Online Help - Mailboxes Overview. Now that your new domain is set up you need to modify your MX Records in your domain provider's DNS Settings, in order to point to the correct Mail Assure routes - see Update Your MX Records. Update Your MX Records Mail Exchange (MX) records are DNS records that are necessary for delivering to your address. An MX record is used to tell the world which mail servers accept incoming mail for your domain and where s sent to your domain should be routed. Assigning multiple MX records, is a failsafe measure you can use in the event your default mail server is down. If your MX records do not point to the correct location you will not receive . To route incoming for your domain through the Mail Assure filter you need to update the MX records in your domain provider's DNS settings. See Update Your MX Records in Your Domain Provider's DNS Settings (below). Prior to changing the MX records, you should check your records' TTL value. We recommend a maximum value of '3600' in order to propagate any DNS changes faster. Higher TTLs can lead to spam not being filtered by our nodes, until the previous record expires, when the TTL is reached. The default MX records are listed in the Default MX host names section in the Server - Settings page accessible from the Admin Level Control Panel, see Manage Server Settings - Default MX Hostnames in the full help. You can check whether your domains have the correct MX Records configured using the MX Verification Tool

11 Update Your MX Records in Your Domain Provider's DNS Settings 1. In your domain provider's DNS control panel add the following records: MX records consist of two parts: the domain name and the priority. The lowest number is the highest priority and is the first one attempted for delivery. Global MX Records (Recommended) mx1.mtaroutes.com (priority 10) mx2.mtaroutes.com (priority 20) mx3.mtaroutes.com (priority 30) mx4.mtaroutes.com (priority 40) We recommend configuring your domain to use the above global MX records. However, where there is a requirement to route data through a specific geographic territory, the below region-specific MX records may be used: EU Region mx1-eu.mtaroutes.com (priority 10) mx2-eu.mtaroutes.com (priority 20) mx3-eu.mtaroutes.com (priority 30) mx4-eu.mtaroutes.com (priority 40) Americas Region mx1-us.mtaroutes.com (priority 10) mx2-us.mtaroutes.com (priority 20) mx3-us.mtaroutes.com (priority 30) mx4-us.mtaroutes.com (priority 40) UK Region mx1-uk.mtaroutes.com (priority 10) mx2-uk.mtaroutes.com (priority 20) mx3-uk.mtaroutes.com (priority 30) mx4-uk.mtaroutes.com (priority 40) AU Region mx1-au.mtaroutes.com (priority 10) mx2-au.mtaroutes.com (priority 20) mx3-au.mtaroutes.com (priority 30) mx4-au.mtaroutes.com (priority 40) CA Region mx1-ca.mtaroutes.com (priority 10) mx2-ca.mtaroutes.com (priority 20) - 8 -

12 mx3-ca.mtaroutes.com (priority 30) mx4-ca.mtaroutes.com (priority 40) Some DNS control panels require you to use a trailing dot (.) after the hostname. Please check with your DNS provider if this is the case for you. 2. Remove the original MX records. Make sure you remove old MX records so that all s are filtered through the Mail Assure cloud. Spammers actively try different MX records (such as the highest numbered priority) to bypass spam filters. DNS changes may take some time before they are picked up by the DNS resolvers world-wide, so may continue to deliver directly to the original MX records without filtering for some time depending on the TTL value set on the DNS server. You can check using the Log Search if the message has passed through the Mail Assure filtering nodes: To Access the Log Search: 1. Log into Mail Assure. 2. In the Domains panel, click on Overview. 3. Click on the relevant domain to display the domain's Dashboard. 4. In the Incoming panel, click on Log search. For more information, see View Incoming Log Search

13 Outgoing Filtering The outgoing filtering solution operates independently from the incoming solution and is used to relay outgoing mail. Configuring Mail Assure Create the Outgoing User Configure the Abuse Report Address Configuring Your Domains Set up SPF Set up DKIM Set up Your SMTP Hostname Configuring Your MTA Additional Info Connection Limits Available Outgoing Ports Block Outbound Traffic on Port 25 Configuring Mail Assure The first thing you need to do is to create an outgoing user. There are three authentication options: IP authentication - all traffic from all domains that come from this authenticated IP is logged on the outgoing user domain that the IP is assigned to. Per domain authentication Per user authentication We recommend using the Authenticating domain option, entering the username and password you have, then all mail to that domain is going to route through the connector regardless of what IP address it comes from. If you wish to filter an entire server, the IP authentication is likely to be the best and fastest way forward. Per domain and per username authentication works very well when you want to have logging on a per domain or user basis. Using this type of authentication requires you to configure your MTA to authenticate with a user and a password for each domain. Create the Outgoing User Configure the Abuse Report Address Create the Outgoing User 1. Log in to the Mail Assure Control Panel. 2. Navigate to the domain you added (Add a Domain)

14 If you use IP authentication (described below) we advise that you create a domain specifically for this. For example, you can use your server hostname as the domain. This domain can then be used for logging and statistical purposes). 3. In the Outgoing panel on the Dashboard, click on Manage users. 4. Either: a. Add an Authenticating User - Add the outgoing user's Username and Password in the Authenticating User tab. or b. Add an Athenticating IP or range - Add the IP address or range of the sending mail server (log into the server to find this out) in the Authenticating IP or range tab. or c. Add an Authenticating domain - Add the Domain name and Password in the Authenticating Domain tab. 5. Click on Add and configure. 6. Edit the required Outgoing user settings. For example, you can configure outgoing connection limits, the Identification header, and various other settings. 7. Click Save. We advise that an Identity header is set for all outgoing traffic - this makes monitoring and taking action against spammers much easier. For more information on the settings available see Add an Outgoing User. See also:

15 Set up Outgoing User Authentication for Multiple Domains Sending from the Same IP Address. Configure the Abuse Report Address When using the Outbound filter, it is advisable to set up an address to receive the abuse reports containing blocked outbound messages. 1. In the Outgoing panel, click on Settings. 2. In the Administrator's contact field, enter the address to send the abuse reports. 3. Click Save. The address that is configured should be an address that has no inbound filtering, and not a "fre " address as these can often cause problems in receiving the reports. It's also possible to use other methods of monitoring the outbound spam, if using ARF reports is not possible. For example you may use API's, CSV reports and/or IMAP. When spammers are reported in your network, either via ARF reports or other means, you should ensure that these problem sources (senders, scripts, etc) are dealt with promptly. Configuring Your Domains Set up SPF Set up DKIM Set up SPF SPF (Sender Policy Framework) is used to restrict which mail servers are allowed to send for your domain name. An example of an SPF would be: example.com. TXT "v=spf1 -all" SPF records are TXT records placed into a domain's DNS settings

16 Forwarding s can sometimes break the SPF. If this is the case we recommend using SRS (Sender Rewriting Scheme - To Set up SPF For clients using our outgoing product, we recommend using the following SPF record: "v=spf1 include:spf.mtaroutes.com -all" If SPF checking is turned on in a domain's Filtering Settings, this causes a hard fail of SPF records that do not match - and the message is quarantined. You can control whether SPF/DKIM/DMARC are enabled in the Filtering Settings for a domain. You can also manage a list of domains and IP addresses with disabled SPF, DKIM and DMARC. SPF checking will prevent any targeted spoofs. If required, you will need to add any intentional spoofing to your SPF records or whitelist the sender (whitelisting the sender is a last resort as this can also be spoofed). If you are using other sources for outbound filtering, you need to make sure you modify the SPF record appropriately. The above is only suitable if all outbound filtering is handled by Mail Assure. Set up DKIM If your sending domains already sign with DKIM, then this should not be changed. We will simply forward the DKIM signed messages along to the recipient. If there is no DKIM signing, you can decide to either sign this on your sending MTA, or sign with Mail Assure. It is not compulsory to sign with DKIM, however it often helps to "authenticate" your senders as much as possible. Set up Your SMTP Hostname Use the following settings to configure your outbound mail flow. SMTP hostname: smtpout.mtaroutes.com (port 587/465) SPF record: v=spf1 include:spf.mtaroutes.com -all Global server: smtpout.mtaroutes.com EU-only server: smtpout-eu.mtaroutes.com US-only server: smtpout-us.mtaroutes.com AU-only server: smtpout-au.mtaroutes.com CA-only server: smtpout-ca.mtaroutes.com Available Ports: 587 Security: TLS Configuring Your MTA Configuring your MTA (Message/Mail Transfer Agent) should be straight-forward. Some mailservers are more versatile than others depending on the systems you are using. As a result, configuration options may vary from one to another. Once your MTA is correctly configured, outbound messages should now be relayed though your Mail Assure filtering server(s)

17 Additional Info Connection Limits Available Outgoing Ports Block Outbound Traffic on Port 25 Connection Limits The filtering servers by default will accept a maximum of 10 concurrent connections from your servers. This ensures optimal delivery speeds. To prevent your server from getting temporary rejects "421 Too many concurrent SMTP connections from this IP address; please try again later." and queuing the messages, please ensure you configure your MTA to open a maximum of 10 connections concurrently. This will prevent a backlog building up on your server(s). Available Outgoing Ports The default and recommended outgoing port is 587 (this supports STARTTLS which will be automatically employed if the connecting server supports it). Port 465 can be utilized, but the likelihood of needing to use this is very rare (please first check with our support team). In case you wish to use port 25 for outgoing , you'll need to specify a secondary IP which will be configured to listen to port 25. Customers will need to update their sending servers. Block Outbound Traffic on Port 25 Spammers can abuse a script on your servers to send out spam directly to port 25, bypassing Mail Assure smarthost filtering. In order to prevent this, we advise forcing traffic over port

18 Automatic Recipient/Mailbox Detection With Incoming filtering, once a domain is added, the system automatically detects the mailboxes behind the domain and counts the number of recipients/mailboxes for which incoming s are processed. The outbound checks are carried out by analyzing all user traffic from sending domains. You can view the number of inbound and outbound mailboxes/recipients in Mail Assure: Incoming valid recipient (mailbox) count 1. Log into Mail Assure. 2. In the Domains panel, click on Overview. 3. Click on the dropdown menu to the left of the domain and select Valid Recipient count. A dialog is displayed showing the number of valid recipients for that domain. Outbound Sender Count You can use the Log Search to view the number of 'From:' domains that your outgoing user is sending from: 1. Log into the Control Panel. 2. In the Domains panel, click on Overview. 3. Click on the outgoing authenticating domain. 4. The domain's Dashboard is displayed. In the Outgoing panel, click on Log search. 5. Enter the data range. 6. Alongside Classification, select Accepted (for accepted s only). 7. Under Columns to be displayed, click on Customize and select From as the only column to display. 8. Select Start search to display the results at the bottom of the page. You can go on to download the report in CSV format using the Export option or the report using the me this report option. If required you can disable this automatic detection and set up your local recipients manually - see Manually Set up Recipients/Mailboxes. Manually Set up Recipients/Mailboxes The system automatically detects the mailboxes/recipients behind your domains (see Automatic Recipient/Mailbox Detection) but you can disable this if required, and manually set up your own local list of valid recipients. Manual Setup of Valid Mailboxes/Recipients 1. Log into Mail Assure. 2. In the Domains panel, click on Overview. 3. Click on the relevant domain to display the domain's Dashboard

19 4. In the Incoming panel, click on Local recipients. 5. You can upload a CSV file with all recipients or add them one-by-one by entering each address individually. 6. To disable automatic detection of recipients and force the system to only accept s for the recipients listed here, select Use local recipients in the Options section. 7. Click Save

20 Archiving To use the Archiving features you must ensure that your domain has been added to the system and the Archive product has been enabled for your domain. To enable archiving for your domain: 1. Go to your domain Control Panel and in the Archive panel, click on Status. 2. Click Enable. The Archive is now enabled and a list of parameters and values is displayed

21 Reporting You can report on mail traffic using the following Mail Assure reports: Outgoing Reports - Report on outgoing mail sent in the last hour, 6 hours, 12 hours, 24 hours or 7 days. Access this from the Admin or Domain level Control Panels - from the Outgoing panel - Outgoing reports. Incoming Log Search - A comprehensive search allowing you to filter on received, blocked and temporarily rejected incoming messages over the past 30 days. Available from the Domain level and User level Control Panels, from Incoming - Log Search. Outgoing Log Search - Same as the Incoming Log Search (described above) but logs all outgoing messages over the past 30 days. Available from the Domain level and User level Control Panels, from Outgoing - Log Search. Mail sent via the Control Panel (My account - Compose ) is not picked up by Outgoing Reports or the Outgoing Log Search. Only mail sent via SMTP using the authenticated user/ip is picked up. Incoming/Outgoing Bandwidth Overview - View the incoming/outgoing bandwidth usage per domain from the Admin Level Control Panel - Incoming - Bandwidth Overview and Outgoing - Bandwidth Overview. Global Statistics - View incoming statistics over a specified time-frame for all the domains you manage from the Admin Level Control Panel, Incoming - Global statistics. Includes spam ratio of spam s to all filtered s and the following metrics: Not Spam messages; Unsure messages; Spam messages blocked; Viruses blocked; Whitelisted and Blacklisted etc. Scout Reports - Scheduled reports that can be configured from the Incoming and Outgoing Log Searches. Protection Reports - Message digests of incoming Spam messages that have been quarantined: On-demand domain report - Allows you to send a report for the specified days to the address you specify. Periodic domain report - Sends a daily digest of all the previous day's blocked messages for all the domain's users. Periodic user report - Sends each individual domain user an overview of the previous day's messages that were quarantined for that user. You can manually add users, import a CSV file of multiple users or enable it for all recipients. Access all of these reports from the Domain Level Control Panel - from the Protection reports panel. The Periodic user report is also available from the User Level Control Panel

22 Adding Webinterface Users Adding an Admin User Admin users automatically access the Admin Level Control Panel when they log in with their Admin user credentials (either their Username or their address). From here they can also access any of their Domain Level Control Panels. Admin users can also use the system to view their spam and access their s in the event their server is offline or unavailable: 1. Log into Mail Assure. 2. In the Webinterface users panel, click on Manage admins. You can add multiple users using the Upload CSV file link or add each user individually. 3. To add users individually, click on Add to open the New admin creation page:

23 4. Add the Username, Password and address for this new user. Users log in to the system using their Username or address. 5. Review the user's access rights, as follows: Allow Sub-Admins - Allows the user to add Sub-admins. Allow release of outgoing spam messages - Allows the user to release outgoing spam messages, train as spam/not spam etc. Even if enabled, this option is currently limited and is dependent on whether access is permitted to the Outgoing Spam Quarantine (by default access to the Outgoing Spam Quarantine is not allowed)

24 Allow Control Panel API usage - Allows the user to execute any of the API calls listed in the Control Panel API Calls page (in the Admin Level Control Panel - Server - Control panel API Calls). Available products - Choose which products the user can access (Incoming mail, Outgoing mail, Archiving) and whether they have access to the Private label area of the application in which branding can be customized. When products are made available to the admin user, that user can then enable those products for other sub-admins (in all domain(s) that the admin user owns). Protection for archived messages - When Active, the user will not be able to view/export archived message content unless they authenticate at User level and are viewing their own messages. Sub-admins cannot over-ride this. When Inactive, the user will be able to view/export all other user's archived message content. Domains limit - this specifies how many domains this admin can add. If you want to limit the number to two domains, then you can set the limit to 2, otherwise use 0 for unlimited domains. The limit is shared with your own limit. For example, if your license is of 20 domains, you cannot set the limit to 0 for a Sub-admin. You can set it to 20, however this means that you will be unable to add domains on your Admin account and all new added domains will be attributed to the Sub-admin account. Adding a Domain User To create a user who can access their own Domain Dashboard, manage their own domain specific settings and use the system to view their spam and access their s in the event their server is offline or unavailable: 1. Log into Mail Assure. 2. In the Webinterface users panel, click on Manage domain users. You can add multiple users using the Upload CSV file link or add each user individually. 3. To add users individually, click on Add to open the New domain user creation page. 4. Select the domain you want the user to access/manage. 5. Enter the user's Password and address. 6. Ensure the Status is set to Active. 7. Click Save. To access the system, the Domain user must use their domain name in the Username field and the Password entered here when logging in. You can only create one Domain user per domain

25 Adding an User To add an user who can access their own user Dashboard, manage their settings and access their s in the event their server is offline or unavailable. 1. Log into Mail Assure. 2. In the Webinterface users panel, click on Manage users. You can add multiple users using the Upload CSV file link or add each user individually. 3. To add users individually, click on Add to open the New user creation page. 4. Enter the Username and Password and ensure the Status is set to Active. 5. Click on Save