ePrism Email Security System Administrator’s Guide - V11.0 4225 Executive Sq, Ste 1600 Give us a call: Send us an email: For more info, visit us at: La Jolla, CA 92037-1487 1-800-782-3762 [email protected] www.edgewave.com © 2001—2017 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks are hereby acknowledged. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. The Email Security software and its documentation are copyrighted materials. Law prohibits making unauthorized copies. No part of this software or documentation may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into another language without prior permission of EdgeWave. 11.0 Contents Chapter 1 Overview 1 Overview of Services 1 Email Filtering (EMF) 2 Archive 3 Continuity 3 Encryption 4 Data Loss Protection (DLP) 4 Personal Health Information 4 Personal Financial Information 5 ThreatCheck 6 Vx Service 6 Document Conventions 7 Supported Browsers 7 Reporting Spam to EdgeWave 7 Contacting Us 8 Additional Resources 8 Chapter 2 ePrism Appliance 9 Planning for the ePrism Appliance 9 About MX Records 9 Configuration Examples 10 Email Security Outside Corporate Firewall 10 Email Security Behind Corporate Firewall 10 Mandatory 11 Optional 12 Accessing the ePrism Appliance 12 ePrism Appliance Online Help 13 ePrism Appliance Status 13 Appliance Settings 15 Account 15 Licensing 16 Network 17 Appliance Server Configuration 17 IP Address Configuration 18 Services 19 iii DNS Server Configuration 20 External DNS Configuration 21 SMTP 21 Sender Allow List 22 Sender Block List 22 Bounce Suspension List 22 Greylisting 23 System 24 Appliance Server Configuration 24 System Logging Configuration 25 Time Zone Configuration 26 ePrism Appliance Branding 26 Adding a Brand 27 Joining a Brand 28 Administering the New Brand 29 Removing Brands from the Primary Server 29 ePrism Appliance Encryption 30 Viewing the Local Certificate 30 Generating and Downloading a Certificate Signing Request 31 Uploading a Local Certificate 32 Generating a Self-Signed Certificate 33 Uploading an External Certificate and Key 34 Viewing Trusted Certificates 34 Adding Trusted Certificates 34 Removing a Trusted Certificate 35 Configuring ePrism Appliance Encryption Policies 35 ePrism Appliance Troubleshooting 36 Logs 36 Diagnostics 37 Statistics 38 Restarting the ePrism Appliance 39 Chapter 3 EdgeWave Administrator Dashboard 41 Using the Administrator Dashboard 41 Customizing the Dashboard Tiles 42 Using OmniSearch 43 Changing Your Password 43 iv Chapter 4 Accounts 45 Best Practices 45 Configuring with Other Spam Filter Clients 45 Whitelists and Blacklists 45 Quick Start 46 Adding an Account 46 Managing Account Information 46 Managing Administrators 48 Account Administrators 49 System Administrators 50 Chapter 5 Groups 51 Adding a Group 51 Managing Group Information 52 Chapter 6 Domains 53 Adding a Domain 53 Default Domain Settings 54 Domain Settings 54 Domain Group Options 54 Domain Digest Options 55 Personal Dashboard Options 57 Filtering Options 59 Filtering Categories 61 Blocked Messages 63 Foreign Language 63 Attachments 64 Content Filters 65 Configuring Delivery Status Notification 65 Message Annotation 66 Mailbox Discovery 67 Filter by Sender 69 Authentication 70 Unrecognized Recipient Handling 72 Directory Harvest Attack Protection 73 Alias Handling 74 Mail Gateways 74 Email Servers 74 v Boundary Encryption 75 Test Connection 76 Routing and Session Management 76 Email Continuity 79 Moving Domains Between Accounts 80 Deleting a Domain 81 Viewing Domain Status 81 Bulk Email Filtering 82 Email Continuity 83 Configuration 83 Reporting 84 Chapter 7 Outbound IP Addresses 85 Adding an Outbound IP Address 85 Outbound Authenticated Relay Settings 86 Outbound IP Settings 86 Member Domains 87 Outbound Filtering 87 Outbound Filtering Options 88 Outbound Filtering Categories 90 Outbound IP Whitelists and Blacklist 92 Configuring Delivery Status Notification 92 Setting Rate Limits 93 Message Annotation 96 Encryption 97 Configuring the Encryption Service 99 Routing and Session Management 101 Domain-Specific Delivery Exceptions 102 Authentication 104 Special Routing 105 Encryption Service 105 Custom Routing 106 Nicknaming an Outbound IP 106 Viewing Outbound IP Status 107 Moving Outbound IPs Between Accounts 108 Chapter 8 Mailboxes 109 Adding a Mailbox 109 vi Configuring Individual Mailboxes 110 General Settings 110 Change Login Password 111 Digest Options 111 Personal Dashboard Options 112 Filtering Options 114 Filter by Sender 115 Authentication 116 Outbound Mail Options 117 SPF Exceptions Mail Options 118 Mailbox Aliases 119 Creating Mailbox Aliases 119 Autodiscovering Aliases 120 Reversing Autodiscovered Alias Relationships 120 Accessing the Personal Dashboard 120 Unprotecting a Mailbox 120 Deactivating a Mailbox 121 Deleting Mailboxes 121 Chapter 9 Verifiers 123 Adding a Verifier 124 LDAP Verifier 126 VRFY Verifier 129 RCPT TO Verifier 129 Communigate CLI Verifier 130 POP - Authentication Only Verifier 131 Database Verifier 131 Static Verifier 133 Composite Verifier 133 Custom Verifier 134 Testing the Verifier Connection 134 Modifying Verifiers 135 Deleting a Verifier 136 When Verification Servers Fail 136 Chapter 10 Content Filters 137 Creating a Content Filter 137 Modifying a Content Filter 140 vii Adding a Content Filter to a Domain or Outbound IP 140 POSIX Regular Expression Syntax 141 Chapter 11 Notifications 144 Adding a Notification 144 Units of Measurement 148 Editing a Notification 149 Chapter 12 Bulk Operations 150 Bulk Domain Settings 150 Bulk Outbound Settings 151 Bulk Mailbox Settings 152 Chapter 13 Reporting 153 Running a Report 153 Sorting Report Data 154 Releasing Messages 154 Downloading Report Data 155 Subscribing to a Report 155 Reports 156 Charts 157 Advanced Report 158 Delivered Message Report 159 Deferred Queue Report 159 Deferred Queue Summary 160 Instant Spam Digest 160 Message Category Summary 160 Message Handling Summary 160 Quarantine Report 161 DLP Activity Report 161 Top Senders Report 162 Encrypted Attachment Report 162 Audit Trail 163 Mailbox Report 163 ThreatCheck Report 164 ThreatCheck Summary Charts 164 viii Chapter 14 Brand Preferences 166 Personal Dashboard Preferences 166 General Settings 167 Policies Tab 168 Inbound and Outbound Preview Message Page 168 Administrator Dashboard Preferences 169 Branding Preferences 171 Dashboard Logos 171 Dashboard Content 172 Spam Digest Settings 173 Authentication 175 Account Preferences 176 Account Branding 177 Spam Digest Settings 178 Appendix A EdgeWave Message Headers 179 X-MAG-Category Descriptions 179 Appendix B SMTP Session Return Codes 181 ix CHAPTER 1 Overview This document is a general guide for planning, configuring, and operating the EdgeWave ePrism appliance and hosted systems. It describes the features and applications of the system, and will assist administrators in effectively deploying the EdgeWave solution in their environment. Overview of Services EdgeWave offers a complete suite of email security services. The Email Security Suite delivers next- generation services that protect your business with comprehensive end-to-end solutions. The email security services defend against internal and external threats, assure continuous mail stream flow, protect against data loss and help fulfill regulatory compliance requirements, while assuring fast, accurate delivery of business-critical email. EdgeWave takes the complexity out of operating its products and removes the administrative burden from email security. The platform is simple and easy to use. EdgeWave provides two primary services: • Hosted: With the hosted solution, customers do not install any client software. They do not need to modify any of their servers, or train their staff in the use of EdgeWave technology. You enjoy lower bandwidth costs, lower mail server utilization, and lower archival capacity demands. • Appliance: EdgeWave offers a full family of ePrism appliances. The ePrism appliance leverages the resources of the EdgeWave Security Operations Center to provide redundancy and managed service. Chapter 1 Overview 1 Email Security Email Filtering (EMF) The EdgeWave email filter provides email defense against internal and external threats such as spam, viruses, spyware, phishing schemes, identity theft, and other dangerous or offensive content. Our services include inbound/outbound Spam and Antivirus filtering, policy categorization and automated seamless directory integration. EdgeWave technical experts provide proactive monitoring and management designed to stop threats before they get near your internal servers. • Both Inbound and Outbound Protection – Protecting outbound email is critical to preventing dangerous botnet attacks that can turn infected computers into zombie networks. Our Award- winning filtering offers protection from spam, viruses and criminal malware on both inbound and outbound mail streams. EdgeWave’s kernel technology is a proprietary message defense system that eliminates spam, viruses, spyware, phishing schemes, and offensive content. It also stops Directory Harvest Attacks (DHA) and Distributed Denial of Service (DDoS) attacks. • No-Touch Email Security – We host the applications and infrastructure required to protect your organization in a fully