SYSADMIN Commercial Mail Servers

Testing the Axigen, Kerio, and Merak commercial mail servers MAIL CALL Deutsche Post World Net

They run on Red Hat Enterprise , cost money, and juggle browser-based admin GUI. After a short learning curve, admins will have every- messages: these three commercial mail servers aim to convince admins thing under control in a single window (Figure 1). they are worth the price. BY JÖRG FRITSCH, PATRICK NEST Axigen supports legacy func- tionality, including a simple folder struc- he task appears so simple: a mail suitability for groupware, and perfor- ture. A practical feature for the admin: receives and sends email. mance on powerful hardware. users can easily handle many daily TSuitable software has been tasks, modify views and user data, or around since the birth of the Internet. Axigen Mail Server even change passwords. Our stress test The major players include , The Axigen mail server is the only prod- demonstrated that the webmail GUI can , Q-Mail, Microsoft Exchange, and uct in the test that does not claim to be easily handle several thousand . Lotus Notes. But right now, many new an alternative to Microsoft Exchange or Linux-based products are starting to Lotus Notes. Instead, it competes with Limited Webmail leave the developer labs. These new the commercial version of Sendmail [9]. The program lacks a search feature for products aim to be quicker and better Axigen provides a neatly structured keywords in the subject line or body of than the industry favorites. We tested three candidates from this Buying the Axigen Mail Server new breed of mail servers. Our test en- Axigen Mailserver version 1.2.4 comes in variants called Gateway, Business, and Servi- tries include commercial mail servers by ceprovider [1]. Axigen Gateway (EUR 95 / US$ 120) entitles you to use the product as a Axigen [1], Kerio [4], and Merak [7]. All front-end relay server without local domains and mailboxes. Business and Servicepro- of these products are new developments vider differ with respect to the licensing. The price for Axigen Business depends on the that are not based on existing Open number of local mailboxes (25 mailboxes for EUR 190 / US$ 240; 1,000 mailboxes for Source servers. We used Red Hat Enter- EUR 1,450 / US$ 1,810). The price of the Serviceprovider license variant depends on the prise Linux 4 as our test platform. The number of hosted domains (50 domains for EUR 535 / US$ 669; 300 domains for EUR core test criteria were administration, 1,700 / US$ 2,124). The unlimited edition costs EUR 2,900 / US$ 3,624. look and feel, webmail functionality, http:// www. axigen.com/ mail-server

56 ISSUE 73 DECEMBER 2006 WWW.LINUX - MAGAZINE.COM Commercial Mail Servers SYSADMIN

Testing the Axigen, Kerio, and Merak commercial mail servers MAIL CALL

Figure 1: The clear-cut Axigen web administration interface, showing the service selection and other basic settings.

based on their headers. The Sieve exam- the only candidate to detect the send- ple in Listing 1 passes messages tagged mail daemon running on Red Hat Enter- by SpamAssassin with a score of 7 or prise Linux 4 and occupying port 25. more to a junkmail folder in the user’s The server continued to provide con- inbox. You can also use Sieve to create vincing service, including good integra- header rules for messages. tion of virus and spam protection fea- tures (Figure 2). With its Outlook con- Proprietary Scripting nector, and a web GUI for groupware, Axigen use a proprietary scripting lan- Kerio deserves to be taken seriously as guage, AFSL (Axigen Filters Scripting an alternative to the Microsoft Exchange Language) to communicate with virus Server 2003. and spam filters. AFSL scripts specify Kerio provides client software for ad- the application to handle incoming mail ministration and monitoring. The client, the email, as well as a multidrop func- first, possibly to support spam and virus which will run on various operating sys- tion (catchall). The multidrop feature tagging. The sieve scripts then evaluate tems, just like the mail server itself, or- stores emails not addressed to a specific the tags. Axigen provides scripts for the ganizes management tasks in a style user in a generic folder. Improved anti- free Clam-AV virus scanner. If you intend reminiscent of Microsoft. You can’t help virus and anti-spam features would be to use a different scanner, you will need thinking that Kerio has tried to emulate nice, too. According to Axigen’s support, to write the script yourself, or get in the Exchange Server management inter- most of these features will be incorpo- touch with the support team, who face in a Linux product. And this makes rated in the next version 2.0. proved to be very responsive in our case. a lot of sense, if you take the target mar- Generally speaking, filtering is difficult Axigen also implements the Sender ket into consideration: Kerio aims to at- with Axigen. If you intend to automati- Policy Framework (see the “SPF and tract customers away from the Microsoft cally flag mail as spam or virus-infected, Caller-ID” box). You can enable the product, and give them a familiar envi- or according to your own criteria, you mechanism via the Web GUI. ronment at the same time. will have to get to know the sieve stan- Multiple user task and address book dard (RFC 3028 and 3685, [3]). The Axi- Kerio Mail Server management is also organized along Mi- gen server will handle user-defined Sieve The Kerio mail server [4] shone right crosoft lines. We had no trouble organiz- scripts [2] that filter and sort messages from the installation phase. Kerio was ing appointment and coordinating task-

Listing 1: Sieve Script Buying the Kerio Mail Server

01 require [“fileinto”, The basic license for Kerio 6 for 20 users without an AV scanner costs EUR 500 / US$ 625. “comparator-i;ascii- Another 20 user licenses are available for EUR 200 / US$ 250; 100 additional users cost numeric”]; EUR 870 / US$ 1,087; a 250 user package costs EUR 1,950 / US$ 2,435. 1,000 users cost 02 if header :value “gt” : just less than EUR 8,000 / US$ 9,996; Kerio does not offer an unlimited license. comparator “i;ascii-numeric” See http://www.kerio.com/kms_home.html. “X-SPAM-SCORE” “7” { Kerio mail is available with a pre-licensed antivirus scanner. McAfee increases the price 03 fileinto “inbox.junk”; by about one half. The basic version includes one year’s software maintenance. Kerio 04 } also provides other maintenance options.

WWW.LINUX - MAGAZINE.COM ISSUE 73 DECEMBER 2006 57 SYSADMIN Commercial Mail Servers

type or file extension. This helps admin- istrators adhere to enterprise policies that ban executables and MP3 files, for example. The Kerio mail server has a wide range of anti-spam faetures, from the proprie- tary Spam Eliminator to Blacklists such as ORDB and Spamcop, to Caller-ID [6] and Sender Policy Framework (see the “SPF and Caller-ID” box) or the delayed SMTP Greeting dialog. Merak Mail Server The Merak mail server [7] surprises ad- ministrators with its feature-richness at first, but on closer inspection, many use- ful features are concealed by the unintui- tive user interface. For example, Merak has functions for testing an antivirus scanner with the Eicar test virus, and it combines Spamassassin with Bayesian filters. Figure 2: Kerio integrates virus and spam protection nicely with the mail server and adminis- After completing the installation, the tration software. The GUI gives useful explanations of individual settings. command line wizard helps you set up the admin user, and a default domain. within group projects via the webmail mailbox credentials centrally via Active The program then gives you a choice of interafce with Outlook, Entourage, and Directory. three tools: one for the command line, other clients [5]. the second a browser-based GUI, and a Kerio provides its own Active Direc- Virus and Spam Protection third a remote administration console. tory Extensions (for Microsoft AD), and The Kerio mail server includes a licensed The three tools differ greatly with re- Open Directory Extensions (for the version of the McAfee Antivirus Engine. spect to feature scope and application: Apple equivalent) to help integrate the In our lab, the program automatically only the console (Figure 3) gives admin- product into existing directory service detected other virus scanners (such as istrators central access to the full set of infrastructures. In a Microsoft environ- Sophos AV) and listed them as options in features. We also had a problem with the ment, the administrator can install the a selection menu. You can even scan fact that the Merak mail server will act extensions on an AD catalog server, and with two antivirus products. This is a as a relay for all private IP addresses then add the Kerio Mailserver Account in good idea to help you catch new viruses, (RFC 1918) by default. Users and Computers on the Active Di- as the time span between a new virus Although the server achieved just one rectory Management Console. This gives becoming known and the manufacturer sixth of the throughput claimed by the administrators the ability to manage publishing a pattern update can vary. Merak website in our lab (according to In contrast to security-only products Merak it should be able to handle 20,000 Buying the Merak for email ([11]), Kerio does not give ad- emails per second on a dual Pentium Mail Server ministrators the ability to notify internal system), it still had the highest through- Merak 8.5 comes in variants with six to recipients of incoming viruses. On a put of all the mail servers tested. The seven plugins/ modules. The standard more positive note, Kerio will block webmail interface includes a collection version with an unlimited number of email attachments based on the Mime of skins and layouts. In contrast to its users and domains (including the web mailer) is EUR 735 / US$ 918. Add-on SPF and Caller-ID modules for anti-spam, anti-virus, or lowed to send mails for this from ad- groupware are licensed by the user. The Sender Policy Framework (SPF) is Groupware for 500 users costs EUR 860 an SMTP extension introduced in 2003 dress, based on the policy published via / US$ 1,074. The Merak Mailserver Lite that allows users to identify messages DNS. http:// www. openspf. org. Bundle for 12 users, including anti- with spoofed email sender addresses. SPF is the successor to the RMX (Re- spam, anti-virus, and groupware, costs To allow this to happen, the DNS zone verse MX) project and merged with RMX EUR 315 / US$ 393. http:// www.merak- file of the sending domain has additional in 2004. RMX only supported evaluation mailserver.com information that specifies which SPF of the standard MX record in a zone file. All prices include one year’s software clients are allowed to send mail via the In contrast to this, SPF supports complex maintenance. A migration tool is avail- mail server in the domain. For each in- policies that allow you to authorize serv- able. Merak charges EUR 50 / US$ 62 for coming message, the receiving mail ers in third-party domains or clients on the smallest version (50 users). server checks if the remote server is al- the LAN as relays for your own domain.

58 ISSUE 73 DECEMBER 2006 WWW.LINUX - MAGAZINE.COM Commercial Mail Servers SYSADMIN

two competitors, Merak was incapable of handling several thousand email mes- sages in a user inbox. In some cases, we were unable to open jam-packed user mailboxes in the webmailer. Unlike Kerio, Merak can’t offer full in- tegration with a directory services envi- ronment. Although the server supports LDAP for allowing mail clients to access its internal directory structure (address books, public folders, calendars), it can’t sync with Active Directory or use AD’s user administrator features. This leaves the administrator no alternative but to maintain user data separately, both on the Merak mail server and in Active Di- rectory. After setting up a user account on both systems, users can at least au- thenticate against Active Directory on the mail server or web client. Figure 3: Only the console gives administrators central access to all of the Merak mail serv- Again in contrast to Kerio, Merak sells er’s settings. The product has such an enormous range of functions that the cluttered inter- separate licenses for the groupware func- face can’t hope to cover them all. tion. The Merak licensing model is com- plex and difficult to understand. To help can add other products manually, simply benchmarks, we ran the software on a administrators understand, the console by specifying the path to the executable lab machine (see the “Test Environ- provides a license window, which also or shared library. Merak was the only ment” box.) The most important test cri- gives you a useful overview of add-in product in our test that notified internal terion was the number of test messages, features. users of virus-infected emails. To provide all of 10 Kbytes each, that the mail The Merak mail server was originally spam protection, Merak implements server would accept for local users in developed by a Czech software com- greylisting and SpamAssassin [12]. boxes within one minute [13]. pany, Icewarp [8], and the same people A mail server can be set up at different developed the virus scanner used by the Benchmarks locations on a LAN. It can reside behind Merak mail server. The GUI supports the All three candidates had to prove their a mail relay, behind a virus scanner, or AVG, F-Secure, and McAfee engines. You value under lab conditions. For our as a mail gateway between the Internet

Table 1: Benchmark Product Single connection, Single connection, 200 connections, Error with 200 POP3 3 Webmail 3 IMAP 3 10-KByte mail Header only 10-Kbyte mail Connections Axigen 1,295 [Msg/ min] 105,694 [Msg/ min] 4,174 [Msg/ min] 41 [Err/ min] – ✓ – Kerio 1,353 [Msg/ min] 156,410 [Msg/ min] 8,477 [Msg/ min] 0 [Err/ min] 5,414 [Msg/ min] ✓ – Merak 1,363 [Msg/ min] 24,878 [Msg/ min] 16,981 [Msg/ min] 7 [Err/ min] 1,333 [Msg/ min] – – Sendmail 1 984 [Msg/ min] 925 [Msg/ min] 1,520 [Msg/ min] 1,988 [Err/ min] n.a. n.a. n.a. Sendmail 2 not tested not tested 5,221 [Msg/ min] 0 [Err/ min] n.a. n.a. n.a. 1) Default configuration 2) Optimizations: MaxDaemonChildren and RefuseLA set to 248 3) Tested with 1000 mails in the Inbox

ADVERTISEMT SYSADMIN Commercial Mail Servers

and the confusing feature scope detract slightly from Merak's performance. The Kerio mail server was the most trustwor- thy mail server in the test. Kerio was the only server not to make a single error under lab conditions. Favorite If you ask us which of the test candi- dates was our favorite, we would have to go for the Axigen mail server. The server is not suitable for companies looking for a mail server with groupware functional- ity, or wishing to migrate from Microsoft Exchange to Linux. But if you are look- ing for a good mail server with excellent webmail support, you will be very happy with the Axigen server. The Kerio mail server is a well de- Figure 4: The reporting tool on the Kerio admin console confirms our test results. The test signed product that impresses with its software delivers 10 Kbyte messages via a single connection. Kerio can handle about 500 groupware functionality and Active Di- messages within 20 seconds, at a rate of 1,500 messages per minute. rectory integration. And the Kerio server proved its reliability under strict lab con- and the internal network. The require- neous TCP/ SMTP connections. In both ditions. The Merak server left us with an ment profile differs greatly in all cases. A scenarios, the test software sent 10 ambivalent impression. The product at- mail server on a LAN behind a relay or KByte messages. A third test ruled out tracts users with its enormous feature AV scanner has to accept as many emails overhead from filesystem activity; we scope, but Merak takes much more time as possible over as few simultaneous simply required the server to process to understand than either of its competi- TCP connections as possible (one to email headers; the messages did not tors in the test. ■ four). Our test for this scenario used a have a body. single connection. The final test concerned POP3 server INFO A server that is used as an Internet performance, if the product came with a [1] Axigen Mail Server: mail gateway has to handle a large vol- POP3 server. In this case, the client at- http:// www. axigen. com/ mail-server/ ume of messages from a large number of tempted to empty a jam-packed user [2] Email filter samples with Sieve: systems. To cover this application, we inbox – in other words, the server only http:// wiki. fastmail. fm/ index. php/ ran a throughput test with 200 simulta- had to maintain one connection. SieveExamples The tests were performed for 60 to 90 [3] Sieve RFCs: 3028, 3685, 3598, 3431, Patent Pitfalls minutes, however, the results stabilized and 3894: http:// www. ietf. org/ The Caller-ID draft was proposed by Mi- after approximately 10 to 15 minutes and [4] Kerio mail server: http:// www. kerio. com/ kms_home. html crosoft in 2004. The technology and im- did not vary until the end of the test. We plementation are similar to SPF. How- included the results for a Sendmail dae- [5] Kerio groupware functions: ever, Microsoft’s Caller-ID syntax is mon [10] as reference values. We ran http:// www. kerio. com/ kms_collabora- tion. html XML-based, and parts of it are patented. Sendmail in its default configuration [6] Kerio info on Caller-ID: In 2004, there were several attempts to with a typical tweak: 248 child processes http:// www. kerio. com/ callerid merge SPF and Caller-ID as the Sender- (MaxDaemonChildren) and a RefuseLA [7] Merak mail server: http:// www. ID, however, the attempts failed due to value of 248. problems with patents. http:// www. merakmailserver. com/ Products/ Table 1 gives the results of the test Merak_Linux_Mail_Server_Software/ microsoft. com/ spam (see also Figure 4). In our lab, the three [8] Icewarp: http:// www. icewarp. com Besides these technologies, Yahoo’s DK test candidates achieved surprisingly (Domain Key) http:// antispam. yahoo. [9] Sendmail.com: good throughput rates, and this qualifies http:// www. sendmail. com com/ domainkeys, and its successor them as candidates for medium-sized to DKIM (Domain Keys Identified Mail), [10] Sendmail.org: which was developed and standardized large enterprises. http:// www. sendmail. org by the IETF http:// mipassoc. org/ dkim/ The Axigen mail server appears to be [11] Clearswift Mimesweeper: are worthy of mention. DKIM aims to better suited to Internet providers, due http:// www. mimesweeper. com ensure the integrity and authenticity of to its configuration options, however, the [12] Spamassassin: messages on the path between mail throughput is not as good as the other http:// spamassassin. apache. org servers. The method is based on addi- two servers. [13] Postal benchmark utility for mail tional DNS information, and on crypto- Merak shone with fast throughput, servers: http:// www. coker. com. au/ postal/ graphic methods. although the unintuitive configuration,

60 ISSUE 73 DECEMBER 2006 WWW.LINUX - MAGAZINE.COM