Table of Contents

4. Mail Server Security

4.1. Authentication and Encryption

4.1.1. Kerberos Authentication within Active Directory

4.2. SPF and DomainKeys

4.2.1. AXIGEN Signing Module Usage and Configuration

4.3. Mail Filtering

4.3.1. Message Acceptance Rules

4.3.2. Routing Rules

4.3.3. Antivirus / Antispam Filters

4.3.4. Message Rules

4.3.4.1. SIEVE Overview and Implementation in AXIGEN

4.3.5. The AXIGEN Filtering Module

4.3.5.1. Filtering Module Implementation in AXIGEN

4.3.5.2. Configuring the AXIGEN Filtering Module

4.3.5.3. AXIGEN Filtering Module Commands

4.3.6. Activating and Prioritising Filters and Rules

4.3.7. Language Specifications for Policy Configuration

4.3.7.1. SMTP Functionalities (I)

4.3.7.2. SMTP Functionalities (II)

4.3.7.3. SMTP Functionalities (III)

4.3.7.2. SMTP Functionalities (II)

onRcptTo

Called as a result of the 'RCPT TO' command issued by the client
Variable Type Access Method Explanation Value set Default
smtpPort numeric IN,RO The local listener port the client used to connect Range:
0 - 65535
Not Applicable
smtpIp ip IN,RO The local interface IP the client used to connect IP Not Applicable
remoteSmtpPort choice IN,RO The remote port the connection was established through Choice:
    0 - 65535
Not Applicable
remoteSmtpIp ip IN,RO The remote IP the connection was established from IP Not Applicable
isSSLConnection choice IN,RO 'yes' if the connection is encrypted (socket ssl), no if it is not. Choice:
  • yes - the connection is encrypted (socket ssl)
  • no - the connection is not encrypted
Not Applicable
ehloHost hostname IN,RO The hostname the client declares Hostname Not Applicable
isESMTP choice IN,RO 'yes' if the client used EHLO, 'no' for HELO Choice:
  • yes - the client used EHLO
  • no - the client used HELO
Not Applicable
authUser text IN,RO Name of sucessfully authenticated user ('' if the Auth command was incorrectly used) Text string Not Applicable
mailCount numeric IN,RO Verifies if the sender address corresponds to the one used to authenticate.  
Not Applicable
totalMailSize numeric IN,RO Total size of email messages sent in the respective session (in octets).
Not Applicable
remoteDelivery choice IN/OUT,RW Specifies which clients can send remote messages. Choice:
  • all - all clients can send remote messages
  • none - no clients can send remote messages
  • auth - only authenticated clients can send remote messages
auth
localDelivery choice IN/OUT,RW Specifies which clients can send messages locally. Choice:
  • all - all clients can send messages locally
  • none - no clients can send messages locally
  • auth - only authenticated clients can send messages locally
all
maxRcptCount numeric IN/OUT,RW The maximum number of recipients for an email. Range:
0 - 1000
1000
maxDataSize numeric IN/OUT,RW The maximum size of a mail message (KB). Range:
0 - 4294967295
10240
maxReceivedHeaders numeric IN/OUT,RW The maximum size of 'Received' headers after which the email is considered to be looping. Range:
0 - 4294967295
30
DNSBLServer text IN,RO The DNSBL server name used by 'checkDNSBL' method. Text string  
DNSBLResult ip OUT,WO The result of a 'checkDNSBL' call; if the client ip is not found using 'DNSBLServer' the result is an empty string IP  
DNSBLExplanation text OUT,WO The explanation associated with the result returned by a 'checkDNSBL' call Text string  
SPFResult choice IN/OUT,RW Result of the SPF check (possible values: 'None', 'Neutral', 'Pass', 'Fail', 'SoftFail', 'TempError', 'PermError'; can be set manually or by calling the 'checkSPF' method; if the result is 'Fail', the subsequent 'MAIL FROM' commands will fail. Choice:
  • None - TBD
  • Neutral - TBD
  • Pass - the message meets the domain's definition for legitimate messages
  • Fail - the message does not meet the domain's definition for legitimate messages
  • SoftFail - TBD
  • TemprError - TBD
  • PermError - TBD
None
SenderMXCheckResult choice IN,RO Result of the Sender MX verification (possible values: 'Pass', 'Fail', 'Neutral', 'Error'); see 'checkSenderMX' method. Choice:
  • Pass - The sender has a valid MX
  • Fail - The sender does not have a valid MX
  • Neutral - No sender specified, is a NDR message
  • Error - There was an error determining sender MX
Not Applicable
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from; modified automatically along with the 'mailFrom' value. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address; modified automatically along with the 'mailFrom' value. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
rcptCount numeric IN,RO Number of recipients communicated by the client up to the given moment. Range:
Not Applicable
currentRcpt text IN/OUT,RW The current address communicated by the client as recipient; it can be set manually, causing the recipient address to change; if after setting it the 'addRcpt' method is called, the newly set address will be added to the one communicated by the client. Text string Not Applicable
currentRcptFolder text IN/OUT,RW In case of delivery to a local domain, it specifies the folder the email message will be delivered to. Text string INBOX
currentRcptLocalPart text IN,RO Local part of the recipient address; modified automatically when setting 'currentRcpt'. Text string Not Applicable
currentRcptRelayHost text IN/OUT,RW SMTP routing host used to deliver the mail for this recipient. Text string  
isRcptDomainLocal choice IN,RO States if the recipient domain specified by the client is a local one Choice:
  • yes - the recipient domain specified by the client is a local one
  • no - the recipient domain specified by the client is not a local one
Not Applicable
isRcptLocal choice IN,RO States if the recipient specified by the client is a local one Choice:
  • yes - the recipient specified by the client is a local one
  • no - the recipient specified by the client is not a local one
Not Applicable
HeaderName text OUT,WO See header usage methods. Text string Not Applicable
HeaderValue text IN/OUT,RW See header usage methods. Text string Not Applicable
delayDelivery text OUT,WO Enables and configures delay delivery feature. It may be set to an absolute date (format RFC 2822) or to a relative date exprimated as +[[nnh] nnm]nn[s] Text string  
overquotaAction chioce OUT,WO Determine what action the smtp engine shoud take for a recipient that is overquota. N/A reject
isOverquota choice IN,RO Specifies if the current recipient is overquota. Choice:
  • yes - The current recipient will exceed its quota limit if the current mail will be delivered to it
  • no - The current recipient may receive the current mail without exceeding its quota limit
Not Applicable
smtpAction choice OUT,WO Determine what action the smtp engine shoud take for the current command. Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Takes an action conforming with the internal policies
smtpExplanation text OUT,WO The message sent to the client in case of a reject or tmpreject action. Text string A default error message
RFCBreak multival IN,RO List of RFC violation permitted or requested. Values:
  • nofolding - Header lines longer than 78 characters are permitted and no folding is perfomed on those lines
  • bodycrlfcorrection - SMTP IN service is allowed to modify the body of 7Bit mime messages in order to fix invalid line terminator sequences (the single CR, LF or LFCR and CRCRLF sequences found in mail's body are replaced with CRLF)
 
filterName text OUT,WO The name of the extenral filter to be added Text string Not Applicable
filterType choice OUT,WO The type of the external filter to be added Choice:
  • milter - The new external filter is of type MILTER
Not Applicable
filterAddress text OUT,WO The address of the new external filter Text string Not Applicable
addFilterResult choice IN,RO   Choice:
  • ok - The addFilter call was successfull
  • error - The addFilter call failed
Not Applicable
addFilterExplanation text IN,RO   Text string Not Applicable
filterNamePattern text OUT,WO The pattern name of filters to be executed Text string  
'filterName'.result choice IN,RO The execution result of an external smtp filter Choice:
  • pass - The filter was executed and returned a positive result
  • fail - The filter was executed and returned a rejection result
  • neutral - The filter was not selected for execution by the lass executeFilters call
  • error - The filter was not executed because of system errors
Not Applicable
'filterName'.action choice IN/OUT,RW The default action taken by the smtp engine as a result of executing an external smtp filter Choice:
  • accept - The engine accepts the current and the following commands
  • continue - The engine accepts the current command
  • discard - The engine ignores the current command
  • tmpreject - The engine temporary rejects the current command
  • reject - The engine permanently rejects the current command
Not Applicable
'filterName'.explanation text IN,RO The explanation associated with the execution of an external smtp filter Text string Not Applicable
AllowedCountries text OUT,WO List of allowed countries used by checkGeoIP method Text string  
BannedCountries text OUT,WO List of banned countries used by checkGeoIP method Text string  
ActionGeoIPBan choice OUT,WO The default action taken in case the country is banned Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Reject
GeoIPResult text IN,RO Country code associated with the client's ip Text string Not Applicable
IsGeoIPBanned choice IN,RO Determine if client's country is banned Choice:
  • yes - the client's country is banned
  • no - the client's country is not banned
Not Applicable

Methods

Name
Explanation
Input Parameters
Output Parameters
checkGeoIp Determine the client's country code and check if is banned
  • AllowedCountries-List of allowed countries
  • BannedCountries-List of banned countries
  • ActionGeoIP-The default action taken by server in case the country is banned
  • GeoIpResult-The country code associated with client's ip
  • IsGeoIPBanned-The result of checking the country code against allowed/banned countries lists
addFilter Adds an external smtp filter
  • filterName-Specifies the name of the filter to be added
  • filterType-Specifies the type of the filter to be added
  • filterAddress-Specifies the address of the filter to be added
  • addFilterResult-Indicates if the add filter operation was successfull
  • addFilterExplanation-Indicates the failure reason of the add filter operation
executeFilters Execute onRcptTo method for selected filters
  • filterNamePattern-The selection name pattern of filters to be executed
  • 'filterName'.result-The execution result of the filter named 'filterName'
  • 'filterName'.action-The default smtp action taken as a result of executing the filter named 'filterName'
checkDNSBL Checks if the clinent ip is black-listed in server 'DNSBLServer'
  • DNSBLServer-The DNS Black List server used to check the client ip
  • DNSBLResult-The ip associated with the client ip in server 'DNSBLServer'
  • DNSBLExplanation-Explanation associated with the 'DNSBLResult'
checkSenderMX    
  • SenderMXCheckResult-Result of the Sender MX check
addHeader Adds the specified header through the 'HeaderName' and 'HeaderValue' variables
  • HeaderName-Name of the header field to be added
  • HeaderValue-Value of the added field
     
addIfNotExistsHeader Adds the heather only if no other field with the same name exists
  • HeaderName-Name of the header field to be added
  • HeaderValue-Value of the added field
     
removeFirstHeader Deletes the first instance of a field with the 'HeaderName' name from the header
  • HeaderName-Name of the header field to be removed
     
removeHeader Deletes all instances of the field named 'HeaderName' from the header
  • HeaderName-Name of the header field to be removed
     
removeHeaderValue Deletes a specific instance of the field named 'HeaderName' from the header
  • HeaderName-Name of the header field to be removed
  • HeaderValue-The value of the specific instance to be removed
     
modifyHeader Modifies or adds a header
  • HeaderName-Name of the header field to be modified (or added if not exists)
  • HeaderValue-The new field value
     
modifyIfExistsHeader Modifies a header
  • HeaderName-Name of the header field to be modified
  • HeaderValue-The new field value
     
addRcpt Adds the rcpt specified in 'currentRcpt' and 'currentRcptFolder'.
  • currentRcpt-Address to be added in recipient list
  • currentRcptFolder-Delivery folder
     
discardRcpt Ignores a client's request of adding a RCPT, without responding with an error
     
     

onHeadersReceived

Called after the message header is received.
Variable Type Access Method Explanation Value set Default
smtpPort numeric IN,RO The local listener port the client used to connect Range:
0 - 65535
Not Applicable
smtpIp ip IN,RO The local interface IP the client used to connect IP Not Applicable
remoteSmtpPort number IN,RO The remote port the connection was established through N/A Not Applicable
remoteSmtpIp ip IN,RO The remote IP the connection was established from IP Not Applicable
isSSLConnection choice IN,RO 'yes' if the connection is encrypted (socket ssl), no if it is not. Choice:
  • yes - the connection is encrypted (socket ssl)
  • no - the connection is not encrypted
Not Applicable
ehloHost hostname IN,RO The hostname the client declares Hostname Not Applicable
isESMTP choice IN,RO 'yes' if the client used EHLO, 'no' for HELO Choice:
  • yes - the client used EHLO
  • no - the client used HELO
Not Applicable
authUser text IN,RO Name of sucessfully authenticated user ('' if the Auth command was incorrectly used) Text string Not Applicable
mailCount numeric IN,RO Verifies if the sender address corresponds to the one used to authenticate. Range:
Not Applicable
totalMailSize numeric IN,RO Total size of email messages sent in the respective session (in octets). Range:
Not Applicable
remoteDelivery choice IN,RO Specifies which clients can send remote messages. Choice:
  • all - all clients can send remote messages
  • none - no clients can send remote messages
  • auth - only authenticated clients can send remote messages
auth
localDelivery choice IN,RO Specifies which clients can send messages locally. Choice:
  • all - all clients can send messages locally
  • none - no clients can send messages locally
  • auth - only authenticated clients can send messages locally
all
maxRcptCount numeric IN,RO The maximum number of recipients for an email. Range:
0 - 1000
1000
maxDataSize numeric IN/OUT,RW The maximum size of a mail message (KB). Range:
0 - 4294967295
10240
maxReceivedHeaders numeric IN/OUT,RW The maximum size of 'Received' headers after which the email is considered to be looping. Range:
0 - 4294967295
30
DNSBLServer text IN,RO The DNSBL server name used by 'checkDNSBL' method. Text string  
DNSBLResult ip OUT,WO The result of a 'checkDNSBL' call; if the client ip is not found using 'DNSBLServer' the result is an empty string IP  
DNSBLExplanation text OUT,WO The explanation associated with the result returned by a 'checkDNSBL' call Text string  
SPFResult choice IN,RO Result of the SPF check (possible values: 'None', 'Neutral', 'Pass', 'Fail', 'SoftFail', 'TempError', 'PermError'; can be set manually or by calling the 'checkSPF' method; if the result is 'Fail', the subsequent 'MAIL FROM' commands will fail. Choice:
  • None - TBD
  • Neutral - TBD
  • Pass - the message meets the domain's definition for legitimate messages
  • Fail - the message does not meet the domain's definition for legitimate messages
  • SoftFail - TBD
  • TemprError - TBD
  • PermError - TBD
None
SenderMXCheckResult choice IN,RO Result of the Sender MX verification (possible values: 'Pass', 'Fail', 'Neutral', 'Error'); see 'checkSenderMX' method. Choice:
  • Pass - The sender has a valid MX
  • Fail - The sender does not have a valid MX
  • Neutral - No sender specified, is a NDR message
  • Error - There was an error determining sender MX
Not Applicable
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address; modified automatically along with the 'mailFrom' value. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
rcptCount numeric IN,RO Number of recipients communicated by the client up to the given moment. Range:
Not Applicable
HeaderName text OUT,WO See header usage methods. Text string Not Applicable
HeaderValue text IN/OUT,RW See header usage methods. Text string Not Applicable
existsHeader choice IN,RO See 'checkExistsHeader' method. Choice:
  • yes - the header specified by 'HeaderName' was found
  • no - the header specified by 'HeaderName' was not found
Not Applicable
delayDelivery text OUT,WO Enables and configures delay delivery feature. It may be set to an absolute date (format RFC 2822) or to a relative date exprimated as +[[nnh] nnm]nn[s] Text string  
smtpAction choice OUT,WO Determine what action the smtp engine shoud take for the current command. Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Takes an action conforming with the internal policies
smtpExplanation text OUT,WO The message sent to the client in case of a reject or tmpreject action. Text string A default error message
RFCBreak multival IN,RO List of RFC violation permitted or requested. Values:
  • nofolding - Header lines longer than 78 characters are permitted and no folding is perfomed on those lines
  • bodycrlfcorrection - SMTP IN service is allowed to modify the body of 7Bit mime messages in order to fix invalid line terminator sequences (the single CR, LF or LFCR and CRCRLF sequences found in mail's body are replaced with CRLF)
 
filterName text OUT,WO The name of the extenral filter to be added Text string Not Applicable
filterType choice OUT,WO The type of the external filter to be added Choice:
  • milter - The new external filter is of type MILTER
Not Applicable
filterAddress text OUT,WO The address of the new external filter Text string Not Applicable
addFilterResult choice IN,RO   Choice:
  • ok - The addFilter call was successfull
  • error - The addFilter call failed
Not Applicable
addFilterExplanation text IN,RO   Text string Not Applicable
filterNamePattern text OUT,WO The pattern name of filters to be executed Text string  
'filterName'.result choice IN,RO The execution result of an external smtp filter Choice:
  • pass - The filter was executed and returned a positive result
  • fail - The filter was executed and returned a rejection result
  • neutral - The filter was not selected for execution by the lass executeFilters call
  • error - The filter was not executed because of system errors
Not Applicable
'filterName'.action choice IN/OUT,RW The default action taken by the smtp engine as a result of executing an external smtp filter Choice:
  • accept - The engine accepts the current and the following commands
  • continue - The engine accepts the current command
  • discard - The engine ignores the current command
  • tmpreject - The engine temporary rejects the current command
  • reject - The engine permanently rejects the current command
Not Applicable
'filterName'.explanation text IN,RO The explanation associated with the execution of an external smtp filter Text string Not Applicable
AllowedCountries text OUT,WO List of allowed countries used by checkGeoIP method Text string  
BannedCountries text OUT,WO List of banned countries used by checkGeoIP method Text string  
ActionGeoIPBan choice OUT,WO The default action taken in case the country is banned Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Reject
GeoIPResult text IN,RO Country code associated with the client's ip Text string Not Applicable
IsGeoIPBanned choice IN,RO Determine if client's country is banned Choice:
  • yes - the client's country is banned
  • no - the client's country is not banned
Not Applicable

Methods

Name
Explanation
Input Parameters
Output Parameters
checkGeoIp Determine the client's country code and check if is banned
  • AllowedCountries-List of allowed countries
  • BannedCountries-List of banned countries
  • ActionGeoIP-The default action taken by server in case the country is banned
  • GeoIpResult-The country code associated with client's ip
  • IsGeoIPBanned-The result of checking the country code against allowed/banned countries lists
addFilter Adds an external smtp filter
  • filterName-Specifies the name of the filter to be added
  • filterType-Specifies the type of the filter to be added
  • filterAddress-Specifies the address of the filter to be added
  • addFilterResult-Indicates if the add filter operation was successfull
  • addFilterExplanation-Indicates the failure reason of the add filter operation
executeFilters Execute onHeadersReceived method for selected filters
  • filterNamePattern-The selection name pattern of filters to be executed
  • 'filterName'.result-The execution result of the filter named 'filterName'
  • 'filterName'.action-The default smtp action taken as a result of executing the filter named 'filterName'
checkDNSBL Checks if the clinent ip is black-listed in server 'DNSBLServer'
  • DNSBLServer-The DNS Black List server used to check the client ip
  • DNSBLResult-The ip associated with the client ip in server 'DNSBLServer'
  • DNSBLExplanation-Explanation associated with the 'DNSBLResult'
checkSenderMX    
  • SenderMXCheckResult-Result of the Sender MX check
readHeader Read the value of a header specified by 'HeaderName'; the result is stored in 'HeaderValue' variable; if the header has more than one value, the values are separated by new line (CRLF)
  • HeaderName-Name of the header field to be read
  • HeaderValue-The value of the header; set to empty string if the header is not found
checkExistsHeader  
  • HeaderName-Name of the header field to be searched
  • existsHeader-Set to 'yes' if the header is found, 'no' otherwise
addHeader Adds the specified header through the 'HeaderName' and 'HeaderValue' variables
  • HeaderName-Name of the header field to be added
  • HeaderValue-Value of the added field
     
addIfNotExistsHeader Adds the heather only if no other field with the same name exists
  • HeaderName-Name of the header field to be added
  • HeaderValue-Value of the added field
     
removeFirstHeader Deletes the first instance of a field with the 'HeaderName' name from the header
  • HeaderName-Name of the header field to be removed
     
removeHeader Deletes all instances of the field named 'HeaderName' from the header
  • HeaderName-Name of the header field to be removed
     
removeHeaderValue Deletes a specific instance of the field named 'HeaderName' from the header
  • HeaderName-Name of the header field to be removed
  • HeaderValue-The value of the specific instance to be removed
     
modifyHeader Modifies or adds a header
  • HeaderName-Name of the header field to be modified (or added if not exists)
  • HeaderValue-The new field value
     
modifyIfExistsHeader Modifies a header
  • HeaderName-Name of the header field to be modified
  • HeaderValue-The new field value