CanIt-Domain-PRO Administration Guide for Version 10.2.9 AppRiver, LLC 11 December 2020 2 CanIt-Domain-PRO — AppRiver, LLC Contents 1 Introduction 19 1.1 Principles of Operation................................. 19 1.2 Handling False-Positives................................ 19 1.2.1 Spam-Control Delegation........................... 20 1.3 Organization of this Manual.............................. 20 1.4 Definitions........................................ 21 2 Operation 27 2.1 Principles of Operation................................. 27 2.2 Interaction between Allow Rules and Block Rules................... 28 2.2.1 RCPT TO: Actions............................... 28 2.2.2 Post-DATA Actions............................... 30 2.3 Streaming........................................ 32 2.4 How Addresses are Streamed.............................. 32 2.5 How Streaming Methods are Chosen.......................... 33 2.6 Status of Messages................................... 35 2.6.1 Secondary MX Relays............................. 36 2.7 The Database...................................... 36 2.8 Remailing Messages.................................. 37 3 Realms 39 3.1 Introduction to Realms................................. 39 3.2 Realm Names...................................... 40 3.2.1 The base Realm................................ 40 3.3 Creating Realms..................................... 40 3.4 Realm Mappings.................................... 41 3.5 Determining the Realm................................. 42 CanIt-Domain-PRO — AppRiver, LLC 3 4 CONTENTS 3.5.1 Mapping a Domain to a Realm......................... 42 3.5.2 Mapping an Address to a Realm........................ 42 3.5.3 Mapping a Login Name to a Realm...................... 43 3.6 Realm Expiry...................................... 43 3.6.1 Suspending Service to a Realm......................... 43 3.7 Realm Hierarchy.................................... 43 3.8 Realm Custom Fields.................................. 44 4 Streams 47 4.1 Introduction to Streams................................. 47 4.2 Realms......................................... 47 4.3 The Definition of a Stream............................... 47 4.4 Users and E-Mail Addresses.............................. 47 4.5 Mapping......................................... 50 4.6 The Home Stream.................................... 50 4.7 The “default” Stream.................................. 51 5 CanIt-Domain-PRO Setup 53 5.1 Accessing The Web Interface.............................. 53 5.1.1 License Key Screen............................... 53 5.1.2 Login Screen.................................. 54 5.2 The Setup Menu..................................... 55 5.3 Wizards......................................... 56 5.3.1 Basic Setup Wizard............................... 56 5.3.2 RPTN Setup Wizard.............................. 56 5.3.3 Dictionary Attack Detection Wizard...................... 56 5.4 Verification Servers................................... 57 5.4.1 Wildcard Verification Server.......................... 59 5.4.2 SRS and Verification Servers.......................... 60 5.5 Mail Routing...................................... 60 5.5.1 Outbound Relaying............................... 62 5.5.2 Outbound Relaying for Select Domains.................... 62 5.6 Cluster Management.................................. 63 5.6.1 Bandwidth Optimization for Copying Files.................. 64 5.6.2 Altering Services on a Cluster Member.................... 64 5.6.3 Renaming of Cluster Members......................... 65 CanIt-Domain-PRO — AppRiver, LLC CONTENTS 5 5.7 Known Networks.................................... 65 5.7.1 Associating Domains with Known Networks................. 68 5.7.2 Overlapping Networks............................. 69 5.7.3 The SMTP-AUTH Pseudo-Network...................... 69 5.8 Rate-Limiting Outbound Mail............................. 69 5.8.1 Rate-Limiting by IP Address.......................... 71 5.8.2 Fine-Grained Rate-Limiting Rules....................... 71 5.8.3 Notes about Rate-Limiting Rules....................... 73 5.9 Features......................................... 74 5.9.1 Direct Queue Injection............................. 74 5.10 System Check...................................... 75 5.11 Templates........................................ 76 5.12 Theme Customization and Branding.......................... 79 5.12.1 Creating or Editing a Customization...................... 80 5.12.2 Emergency Recovery from Bad Theme Customization............ 81 5.13 HTTPS......................................... 81 5.14 The Domain Mapping Table.............................. 81 5.15 The Address Mapping Table.............................. 83 5.15.1 Wild-Card Entries............................... 84 5.16 The default Stream................................. 85 5.17 Mapping Scenarios................................... 85 5.17.1 Central Scanning with Opt-Out........................ 85 5.17.2 Single Domain................................. 86 5.17.3 Single Domain with Aliases and Mailing Lists................ 86 5.18 Pausing Delivery to Selected Domains......................... 86 5.18.1 Pausing Delivery................................ 86 5.18.2 Resuming Delivery............................... 87 5.19 The Domain Overview Page.............................. 87 5.20 Autotask® Integration................................. 88 5.20.1 Preparing Autotask............................... 88 5.20.2 Preparing CanIt-Domain-PRO......................... 90 5.20.3 Testing the Autotask Integration Settings................... 93 5.20.4 Autotask Settings and Inheritance....................... 95 5.21 ConnectWise® Integration............................... 95 5.21.1 Preparing ConnectWise............................. 95 CanIt-Domain-PRO — AppRiver, LLC 6 CONTENTS 5.21.2 Preparing CanIt-Domain-PRO......................... 103 6 CanIt-Domain-PRO Administration 105 6.1 Global Settings..................................... 105 6.2 SRS (Sender Rewriting Scheme)............................ 109 6.3 Real-Time DNS Blocklists............................... 110 6.3.1 Entering the Master List of DNS RBLs.................... 110 6.3.2 combined.bl.rptn.ca............................... 111 6.4 Phishing URLs..................................... 112 6.4.1 Malicious URL Votes.............................. 112 6.4.2 Known Phishing URLs............................. 114 6.4.3 Delaying Messages because of local Phishing Votes.............. 115 6.5 Users.......................................... 116 6.5.1 User Privileges................................. 117 6.5.2 Adding a User................................. 117 6.5.3 Editing a User................................. 118 6.5.4 Deleting a User................................. 119 6.5.5 Granting Access to Streams.......................... 119 6.5.6 Switching Users................................ 120 6.6 Permitting Users to Opt In............................... 121 6.7 Groups.......................................... 122 6.7.1 Creating, Deleting and Editing Groups..................... 122 6.8 Viewing Active Streams................................ 123 6.8.1 Definition of an Active Stream......................... 124 6.8.2 The Active Stream Display........................... 124 6.8.3 Deleting a Stream................................ 125 6.9 Filtering Outbound Mail................................ 125 6.9.1 DKIM-Signing Outbound Mail........................ 125 6.10 Copying Rules from One Stream to Another...................... 129 6.11 Secondary MX Hosts.................................. 130 6.12 Avoiding Backscatter.................................. 131 6.13 Test Plugins....................................... 131 6.13.1 The PhishingAddress Plugin.......................... 132 6.13.2 The PhishingURL Plugin............................ 132 6.13.3 The OfficeMacros Plugin............................ 132 CanIt-Domain-PRO — AppRiver, LLC CONTENTS 7 6.13.4 The OfficeMacro* Open Plugins........................ 132 6.13.5 The Shortener404 Plugin............................ 133 6.13.6 The NewlySeenDomain Plugin......................... 133 6.14 Emergency Blocking of Delivery Status Notifications................. 133 6.15 Removing All Rules and Settings from a Stream.................... 134 6.16 Provisioning Information................................ 135 6.16.1 Computer-Readable Provisioning Information................. 136 7 External Authentication 137 7.1 Introduction....................................... 137 7.2 User Lookups...................................... 137 7.2.1 IMAP and POP3 Authentication........................ 139 7.2.2 LDAP Authentication and Streaming..................... 141 7.2.3 Azure Active Directory Streaming....................... 145 7.2.4 Program Authentication and Streaming.................... 153 7.2.5 Program Authentication (Legacy Method)................... 157 7.2.6 The account-info Script.......................... 157 7.2.7 The Rewrite User Lookup........................... 157 7.3 Authentication Mappings................................ 158 7.4 Viewing Cached Logins................................. 159 8 Bayesian Filtering 161 8.1 Introduction to Bayesian Filtering........................... 161 8.2 Unauthenticated Voting................................. 161 8.3 The Bayes Journal.................................... 162 8.4 Site-Wide and Realm-Wide Bayes Training...................... 162 8.5 RPTN.......................................... 162 8.6 Ruleset and Geolocation Data Updates........................