Table of Contents

4. Mail Server Security

4.1. Authentication and Encryption

4.1.1. Kerberos Authentication within Active Directory

4.2. SPF and DomainKeys

4.2.1. AXIGEN Signing Module Usage and Configuration

4.3. Mail Filtering

4.3.1. Message Acceptance Rules

4.3.2. Routing Rules

4.3.3. Antivirus / Antispam Filters

4.3.4. Message Rules

4.3.4.1. SIEVE Overview and Implementation in AXIGEN

4.3.5. The AXIGEN Filtering Module

4.3.5.1. Filtering Module Implementation in AXIGEN

4.3.5.2. Configuring the AXIGEN Filtering Module

4.3.5.3. AXIGEN Filtering Module Commands

4.3.6. Activating and Prioritising Filters and Rules

4.3.7. Language Specifications for Policy Configuration

4.3.7.1. SMTP Functionalities (I)

4.3.7.2. SMTP Functionalities (II)

4.3.7.3. SMTP Functionalities (III)

4.3.7.3. SMTP Functionalities (III)

onBodyChunk

Called every time a piece of the mail body is received.
Variable Type Access Method Explanation Value set Default
smtpPort numeric IN,RO The local listener port the client used to connect Range:
0 - 65535
Not Applicable
smtpIp ip IN,RO The local interface IP the client used to connect IP Not Applicable
remoteSmtpPort number IN,RO The remote port the connection was established through N/A Not Applicable
remoteSmtpIp ip IN,RO The remote IP the connection was established from IP Not Applicable
isSSLConnection choice IN,RO 'yes' if the connection is encrypted (socket ssl), no if it is not. Choice:
  • yes - the connection is encrypted (socket ssl)
  • no - the connection is not encrypted
Not Applicable
ehloHost hostname IN,RO The hostname the client declares Hostname Not Applicable
isESMTP choice IN,RO 'yes' if the client used EHLO, 'no' for HELO Choice:
  • yes - the client used EHLO
  • no - the client used HELO
Not Applicable
authUser text IN,RO Name of sucessfully authenticated user ('' if the Auth command was incorrectly used) Text string Not Applicable
mailCount numeric IN,RO Verifies if the sender address corresponds to the one used to authenticate. Range:
Not Applicable
totalMailSize numeric IN,RO Total size of email messages sent in the respective session (in octets). Range:
Not Applicable
remoteDelivery choice IN,RO Specifies which clients can send remote messages. Choice:
  • all - all clients can send remote messages
  • none - no clients can send remote messages
  • auth - only authenticated clients can send remote messages
auth
localDelivery choice IN,RO Specifies which clients can send messages locally. Choice:
  • all - all clients can send messages locally
  • none - no clients can send messages locally
  • auth - only authenticated clients can send messages locally
all
maxRcptCount numeric IN,RO The maximum number of recipients for an email. Range:
0 - 1000
1000
DNSBLServer text IN,RO The DNSBL server name used by 'checkDNSBL' method. Text string  
DNSBLResult ip OUT,WO The result of a 'checkDNSBL' call; if the client ip is not found using 'DNSBLServer' the result is an empty string IP  
DNSBLExplanation text OUT,WO The explanation associated with the result returned by a 'checkDNSBL' call Text string  
SPFResult choice IN,RO Result of the SPF check (possible values: 'None', 'Neutral', 'Pass', 'Fail', 'SoftFail', 'TempError', 'PermError'; can be set manually or by calling the 'checkSPF' method; if the result is 'Fail', the subsequent 'MAIL FROM' commands will fail. Choice:
  • None - TBD
  • Neutral - TBD
  • Pass - the message meets the domain's definition for legitimate messages
  • Fail - the message does not meet the domain's definition for legitimate messages
  • SoftFail - TBD
  • TemprError - TBD
  • PermError - TBD
None
SenderMXCheckResult choice IN,RO Result of the Sender MX verification (possible values: 'Pass', 'Fail', 'Neutral', 'Error'); see 'checkSenderMX' method. Choice:
  • Pass - The sender has a valid MX
  • Fail - The sender does not have a valid MX
  • Neutral - No sender specified, is a NDR message
  • Error - There was an error determining sender MX
Not Applicable
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address; modified automatically along with the 'mailFrom' value. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
rcptCount numeric IN,RO Number of recipients communicated by the client up to the given moment. Range:
Not Applicable
delayDelivery text OUT,WO Enables and configures delay delivery feature. It may be set to an absolute date (format RFC 2822) or to a relative date exprimated as +[[nnh] nnm]nn[s] Text string  
smtpAction choice OUT,WO Determine what action the smtp engine shoud take for the current command. Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Takes an action conforming with the internal policies
smtpExplanation text OUT,WO The message sent to the client in case of a reject or tmpreject action. Text string A default error message
filterName text OUT,WO The name of the extenral filter to be added Text string Not Applicable
filterType choice OUT,WO The type of the external filter to be added Choice:
  • milter - The new external filter is of type MILTER
Not Applicable
filterAddress text OUT,WO The address of the new external filter Text string Not Applicable
addFilterResult choice IN,RO   Choice:
  • ok - The addFilter call was successfull
  • error - The addFilter call failed
Not Applicable
addFilterExplanation text IN,RO   Text string Not Applicable
filterNamePattern text OUT,WO The pattern name of filters to be executed Text string  
'filterName'.result choice IN,RO The execution result of an external smtp filter Choice:
  • pass - The filter was executed and returned a positive result
  • fail - The filter was executed and returned a rejection result
  • neutral - The filter was not selected for execution by the lass executeFilters call
  • error - The filter was not executed because of system errors
Not Applicable
'filterName'.action choice IN/OUT,RW The default action taken by the smtp engine as a result of executing an external smtp filter Choice:
  • accept - The engine accepts the current and the following commands
  • continue - The engine accepts the current command
  • discard - The engine ignores the current command
  • tmpreject - The engine temporary rejects the current command
  • reject - The engine permanently rejects the current command
Not Applicable
'filterName'.explanation text IN,RO The explanation associated with the execution of an external smtp filter Text string Not Applicable
AllowedCountries text OUT,WO List of allowed countries used by checkGeoIP method Text string  
BannedCountries text OUT,WO List of banned countries used by checkGeoIP method Text string  
ActionGeoIPBan choice OUT,WO The default action taken in case the country is banned Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Reject
GeoIPResult text IN,RO Country code associated with the client's ip Text string Not Applicable
IsGeoIPBanned choice IN,RO Determine if client's country is banned Choice:
  • yes - the client's country is banned
  • no - the client's country is not banned
Not Applicable


Methods

Name
Explanation
Input Parameters
Output Parameters
checkGeoIp Determine the client's country code and check if is banned
  • AllowedCountries-List of allowed countries
  • BannedCountries-List of banned countries
  • ActionGeoIP-The default action taken by server in case the country is banned
  • GeoIpResult-The country code associated with client's ip
  • IsGeoIPBanned-The result of checking the country code against allowed/banned countries lists
addFilter Adds an external smtp filter
  • filterName-Specifies the name of the filter to be added
  • filterType-Specifies the type of the filter to be added
  • filterAddress-Specifies the address of the filter to be added
  • addFilterResult-Indicates if the add filter operation was successfull
  • addFilterExplanation-Indicates the failure reason of the add filter operation
executeFilters Execute onBodyChunk method for selected filters
  • filterNamePattern-The selection name pattern of filters to be executed
  • 'filterName'.result-The execution result of the filter named 'filterName'
  • 'filterName'.action-The default smtp action taken as a result of executing the filter named 'filterName'
checkDNSBL Checks if the clinent ip is black-listed in server 'DNSBLServer'
  • DNSBLServer-The DNS Black List server used to check the client ip
  • DNSBLResult-The ip associated with the client ip in server 'DNSBLServer'
  • DNSBLExplanation-Explanation associated with the 'DNSBLResult'
checkSenderMX    
  • SenderMXCheckResult-Result of the Sender MX check

onDataReceived


Called after receiving the message successfully through the DATA or BDAT commands.
Variable Type Access Method Explanation Value set Default
smtpPort numeric IN,RO The local listener port the client used to connect Range:
0 - 65535
Not Applicable
smtpIp ip IN,RO The local interface IP the client used to connect IP Not Applicable
remoteSmtpPort number IN,RO The remote port the connection was established through N/A Not Applicable
remoteSmtpIp ip IN,RO The remote IP the connection was established from IP Not Applicable
isSSLConnection choice IN,RO 'yes' if the connection is encrypted (socket ssl), no if it is not. Choice:
  • yes - the connection is encrypted (socket ssl)
  • no - the connection is not encrypted
Not Applicable
ehloHost hostname IN,RO The hostname the client declares Hostname Not Applicable
isESMTP choice IN,RO 'yes' if the client used EHLO, 'no' for HELO Choice:
  • yes - the client used EHLO
  • no - the client used HELO
Not Applicable
authUser text IN,RO Name of sucessfully authenticated user ('' if the Auth command was incorrectly used) Text string Not Applicable
mailCount numeric IN,RO Verifies if the sender address corresponds to the one used to authenticate. Range:
Not Applicable
totalMailSize numeric IN,RO Total size of email messages sent in the respective session (in octets). Range:
Not Applicable
remoteDelivery choice IN,RO Specifies which clients can send remote messages. Choice:
  • all - all clients can send remote messages
  • none - no clients can send remote messages
  • auth - only authenticated clients can send remote messages
auth
localDelivery choice IN,RO Specifies which clients can send messages locally. Choice:
  • all - all clients can send messages locally
  • none - no clients can send messages locally
  • auth - only authenticated clients can send messages locally
all
maxRcptCount numeric IN,RO The maximum number of recipients for an email. Range:
0 - 1000
1000
maxDataSize numeric IN/OUT,RW The maximum size of a mail message (KB). Range:
0 - 4294967295
10240
maxReceivedHeaders numeric IN/OUT,RW The maximum size of 'Received' headers after which the email is considered to be looping. Range:
0 - 4294967295
30
DNSBLServer text IN,RO The DNSBL server name used by 'checkDNSBL' method. Text string  
DNSBLResult ip OUT,WO The result of a 'checkDNSBL' call; if the client ip is not found using 'DNSBLServer' the result is an empty string IP  
DNSBLExplanation text OUT,WO The explanation associated with the result returned by a 'checkDNSBL' call Text string  
SPFResult choice IN,RO Result of the SPF check (possible values: 'None', 'Neutral', 'Pass', 'Fail', 'SoftFail', 'TempError', 'PermError'; can be set manually or by calling the 'checkSPF' method; if the result is 'Fail', the subsequent 'MAIL FROM' commands will fail. Choice:
  • None - TBD
  • Neutral - TBD
  • Pass - the message meets the domain's definition for legitimate messages
  • Fail - the message does not meet the domain's definition for legitimate messages
  • SoftFail - TBD
  • TemprError - TBD
  • PermError - TBD
None
SenderMXCheckResult choice IN,RO Result of the Sender MX verification (possible values: 'Pass', 'Fail', 'Neutral', 'Error'); see 'checkSenderMX' method. Choice:
  • Pass - The sender has a valid MX
  • Fail - The sender does not have a valid MX
  • Neutral - No sender specified, is a NDR message
  • Error - There was an error determining sender MX
Not Applicable
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address; modified automatically along with the 'mailFrom' value. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
rcptCount numeric IN,RO Number of recipients communicated by the client up to the given moment. Range:
Not Applicable
delayDelivery text OUT,WO Enables and configures delay delivery feature. It may be set to an absolute date (format RFC 2822) or to a relative date exprimated as +[[nnh] nnm]nn[s] Text string  
smtpAction choice OUT,WO Determine what action the smtp engine shoud take for the current command. Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Takes an action conforming with the internal policies
smtpExplanation text OUT,WO The message sent to the client in case of a reject or tmpreject action. Text string A default error message
filterName text OUT,WO The name of the extenral filter to be added Text string Not Applicable
filterType choice OUT,WO The type of the external filter to be added Choice:
  • milter - The new external filter is of type MILTER
Not Applicable
filterAddress text OUT,WO The address of the new external filter Text string Not Applicable
addFilterResult choice IN,RO   Choice:
  • ok - The addFilter call was successfull
  • error - The addFilter call failed
Not Applicable
addFilterExplanation text IN,RO   Text string Not Applicable
filterNamePattern text OUT,WO The pattern name of filters to be executed Text string  
'filterName'.result choice IN,RO The execution result of an external smtp filter Choice:
  • pass - The filter was executed and returned a positive result
  • fail - The filter was executed and returned a rejection result
  • neutral - The filter was not selected for execution by the lass executeFilters call
  • error - The filter was not executed because of system errors
Not Applicable
'filterName'.action choice IN/OUT,RW The default action taken by the smtp engine as a result of executing an external smtp filter Choice:
  • accept - The engine accepts the current and the following commands
  • continue - The engine accepts the current command
  • discard - The engine ignores the current command
  • tmpreject - The engine temporary rejects the current command
  • reject - The engine permanently rejects the current command
Not Applicable
'filterName'.explanation text IN,RO The explanation associated with the execution of an external smtp filter Text string Not Applicable
AllowedCountries text OUT,WO List of allowed countries used by checkGeoIP method Text string  
BannedCountries text OUT,WO List of banned countries used by checkGeoIP method Text string  
ActionGeoIPBan choice OUT,WO The default action taken in case the country is banned Choice:
  • accept - the server accepts the current command
  • reject - the server rejects the current command and returns a permanent error
  • tmpreject - the server rejects the current command and returns a temporary error
  • abort - the server aborts the connection
Reject
GeoIPResult text IN,RO Country code associated with the client's ip Text string Not Applicable
IsGeoIPBanned choice IN,RO Determine if client's country is banned Choice:
  • yes - the client's country is banned
  • no - the client's country is not banned
Not Applicable

Methods

Name
Explanation
Input Parameters
Output Parameters
checkGeoIp Determine the client's country code and check if is banned
  • AllowedCountries-List of allowed countries
  • BannedCountries-List of banned countries
  • ActionGeoIP-The default action taken by server in case the country is banned
  • GeoIpResult-The country code associated with client's ip
  • IsGeoIPBanned-The result of checking the country code against allowed/banned countries lists
addFilter Adds an external smtp filter
  • filterName-Specifies the name of the filter to be added
  • filterType-Specifies the type of the filter to be added
  • filterAddress-Specifies the address of the filter to be added
  • addFilterResult-Indicates if the add filter operation was successfull
  • addFilterExplanation-Indicates the failure reason of the add filter operation
executeFilters Execute onDataReceived method for selected filters
  • filterNamePattern-The selection name pattern of filters to be executed
  • 'filterName'.result-The execution result of the filter named 'filterName'
  • 'filterName'.action-The default smtp action taken as a result of executing the filter named 'filterName'
checkDNSBL Checks if the clinent ip is black-listed in server 'DNSBLServer'
  • DNSBLServer-The DNS Black List server used to check the client ip
  • DNSBLResult-The ip associated with the client ip in server 'DNSBLServer'
  • DNSBLExplanation-Explanation associated with the 'DNSBLResult'
checkSenderMX    
  • SenderMXCheckResult-Result of the Sender MX check

onRelay

Called before establishing a relay connection in order to determine the connection parameters.
Variable Type Access Method Explanation Value set Default
localInterface ip IN/OUT,RW Local interface IP from which the connection will be attempted. IP  
remoteSmtpHost text IN/OUT,RW Hostname of the remote relay server. Text string  
remoteSmtpPort numeric OUT,WO The remote port the connection will be established to Range:
0 - 65535
Not Applicable
remoteSmtpIp ip OUT,WO The remote port IP the connection will be established to IP Not Applicable
authUser text OUT,WO User name used for authentication to the remote server Text string None
atuhPasswd text OUT,WO The user's password used to authenticate Text string  
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
rcptCount numeric IN,RO Number of recipients communicated by the client. Range:
Not Applicable
isFromLocalDomain choice IN,RO 'yes' if the mail was created locally, 'no' if it was received through SMTPIn Choice:
  • yes - the mail was created locally
  • no - the mail was received through SMTPIn
Not Applicable
mailSize numeric IN,RO Mail size in octets. Range:
Not applicable
maxConnections numeric OUT,WO Maximum number of allowed connections to the destination host Range:
0 - 4294967295
5
maxRcptCount numeric OUT,WO Maxium number of recipients to deliver to in a single SMTP transaction (0 means unlimited) Range:
0 - 1000
0
smtpConnectTimeout numeric OUT,WO TCP timeout for SMTP relay connection Range:
300
chunkSize numeric OUT,WO The maximum size of a data block that can be sent through BDAT Range:
0 - 4294967295
102400B(100KB)
allowStartTLS choice IN/OUT,RW 'yes' if the STARTTLS extension is allowed, 'no' if otherwise. Choice:
  • yes - STARTTLS extension is allowed
  • no - STARTTLS extension is not allowed
yes
allowPipelining choice IN/OUT,RW 'yes' if the PIPELINING extension is allowed, 'no' if otherwise. Choice:
  • yes - PIPELINING extension is allowed
  • no - PIPELINING extension is not allowed
yes
allow8BitMime choice IN/OUT,RW 'yes' if the 8BIT extension is allowed, 'no' if otherwise. Choice:
  • yes - 8BIT extension is allowed
  • no - 8BIT extension is not allowed
yes
allowBinaryData choice IN/OUT,RW 'yes' if the BINARY extension is allowed, 'no' if otherwise. Choice:
  • yes - BINARY extension is allowed
  • no - BINARY extension is not allowed
yes
requestAuth choice OUT,WO 'yes' if authentication is mandatory, 'no' if otherwise Choice:
  • yes - authentication is mandatory
  • no - authentication is not mandatory
no
strict7BitMime choice OUT,WO 'yes' if transmitting binary data to clients that do not advertise supporting such data is not allowed Choice:
  • yes - transmitting binary data to clients that do not advertise supporting such data is not allowed
  • no - transmitting binary data to clients that do not advertise supporting such data is allowed
yes
sslEnabled choice OUT,WO 'yes' if the purpose is to establish a SSL connection Choice:
  • yes - The connection is established with SSL enabled
  • no - The connectin is established with SSL disabled
no
plainConnAuthTypes multival IN/OUT,RW Allowed authentication types for a plain connection (possible values: 'all', 'none' or a 'plain', 'login' and 'cram-md5' combination). Values:
  • all - All authentication types are allowed for plain connections
  • none - No authentication type is allowed for plain connections
  • plain - PLAIN authentication is allowed for plain connections
  • login - LOGIN authentication is allowed for plain connections
  • cram-md5 - CRAM-MD5 authentication is allowed for plain connections
crammd5
secureConnAuthTypes multival IN/OUT,RW Allowed authentication types for a SSL connection (possible values: 'all', 'none' or a 'plain', 'login' and 'crammd5' combination). Values:
  • all - All authentication types are allowed for secure connections
  • none - No authentication type is allowed for secure connections
  • plain - Plain authentication is allowed for secure connections
  • login - Login authentication is allowed for secure connections
  • crammd5 - Crammd5 authentication is allowed for secure connections
all

onDeliveryFailure

Called when the mail delivery failed for a certain group of recipients.
Variable Type Access Method Explanation Value set Default
mailFrom text IN,RO The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
sendNDR choice OUT,WO Specifies if the NDR will be sent or not Choice:
  • yes - The NDR will be sent
  • no - The NDR will not be sent
yes
ndrAttachSource choice OUT,WO Specifies if the original email message will be attached to the NDR Choice:
  • no - original email is not attached to the NDR
  • yes - original mail is entirely attached to the NDR
  • header - only the header of the original mail is attached to the NDR
yes
ndrSubject text OUT,WO Email subject sent as NDR (by default it is a hard-coded message) Text string TBD
ndrSender text OUT,WO The Mail From field of the NDR header Text string mailer-daemon@'primaryDomain'
ndrMessage text OUT,WO Text of the NDR message Text string TBD
ndrRcptMessage text OUT,WO Part of the message specified for each recipient individually; it can refer to the 'ndrRcptAddress' and 'ndrRcptFailInfo' fields Text string TBD
ndrMessageFooter text OUT,WO Message ending of the NDR mail Text string TBD
ndrRetryCount numeric IN,RO No. of delivery retries. Range:
Not Applicable
ndrRcptAddress text IN,RO Recipient address for which the delivery has failed. - can only be used when setting the 'ndrRctpMessage' variable Text string  
ndrRcptFailInfo text IN,RO Reason for which delivery has failed for a certain user - can only be used when setting the 'ndrRcptMessage' variable Text string  

onTemporaryDeliveryFailure

Called when the mail delivery has temporarily failed for a certain group of recipients.
Variable Type Access Method Explanation Value set Default
mailFrom text IN/OUT,RW The address specified in mail from. Text string Not Applicable
mailFromLocalPart text IN,RO The local part of the address specified in mail from. Text string Not Applicable
mailFromDomain text IN,RO The domain of the mail from address. Text string Not Applicable
mailFromAuthUser text IN,RO The authenticated user specified in the mail from command. Text string Not Applicable
mailFromSize numeric IN,RO The email size specified in the mail from command. Range:
Not Applicable
sendNDR choice OUT,WO Specifies if a temporary error NDR will be sent or not Choice:
  • yes - The temporary error NDR will be sent
  • no - The temporary error NDR will not be sent
no
ndrAttachSource choice OUT,WO Specifies if the original email message will be attached to the NDR Choice:
  • no - original email is not attached to the NDR
  • yes - original mail is entirely attached to the NDR
  • header - only the header of the original mail is attached to the NDR
header
ndrSubject text OUT,WO Email subject sent as NDR (by default it is a hard-coded message) Text string TBD
ndrSender text OUT,WO The Mail From field of the NDR header Text string mailer-daemon@'primaryDomain'
ndrMessage text OUT,WO Text of the NDR message Text string TBD
ndrRcptMessage text OUT,WO Part of the message specified for each recipient individually; it can refer to the 'ndrRcptAddress' and 'ndrRcptFailInfo' fields Text string TBD
ndrMessageFooter text OUT,WO Message ending of the NDR mail Text string TBD
ndrRescheduleDate numeric IN,RO Date the email is scheduled to be delivered again Range:
 
ndrRetryCount numeric IN,RO No. of delivery retries. Range:
Not Applicable
ndrRemainingRetryCount numeric IN,RO No. of remaining delivery retries after which the mail delivery will be abandoned. Range:
Not Applicable
ndrRcptAddress text IN,RO Recipient address for which the delivery has failed. - can only be used when setting the 'ndrRctpMessage' variable Text string  
ndrRcptFailInfo text IN,RO Reason for which delivery has failed for a certain user - can only be used when setting the 'ndrRcptMessage' variable Text string