Looking at the message list, can you see what the message Scores are and the Result? You may see relatively high scores and the result of Whitelisted. It's common for people to whitelist their own domains, which can result in this spoofing situation. Worse still, white listing messages affects the filters. The e-mail message structures, sender addresses and message content of whitelisted messages are all trained with the dynamic spam filters. This skews the results of the dynamic filters in the wrong direction. So, if you have whitelisted your own domain, then this situation has to be dealt with along with the spoofing issue.

We have a specific setting to deal with self-sent e-mail. Navigate to ..

Filters > Filter Settings > Sender

.. and enable the feature to Block Self Sent e-mail.

If these messages were whitelisted, reset the Bayesian filters by navigating to ..

Filters > Filter Settings > Bayesian

.. navigate to the bottom of the page and click the Reset Bayesian Database button. That should get you back to a normal state.

1. Navigate to: Server Admin > Users;
2. Select your user account;
3. Ensure your email address is correct under the General tab;
4. On the Notifications tab enable Notify when there is a software update.

When the server software updates the server will send you a notification message. We will update our website and Twitter feed when there is a general release, but the best way to be notified that an update has occurred is to have your server send the notification message to you directly .

All support requests need to be via our online helpdesk portal at: https://helpdesk.perfectmail.com . We provide support for your mail administrator. We do not provide end-user support. Each organization will have a single authorized support contact, who will make support requests through our helpdesk portal.

Creating support tickets helps everyone by ensuring an issue is clearly stated and providing continuity for support staff if the ticket is transferred to another support person. The information contained in support tickets is used as a source for creating Knowledge Base Articles available on our website: http://www.perfectmail.com

Contacting individual staff for support issues is discouraged. ​Staff members may be unavailable to assist you for various reasons. When you create a support ticket notification is sent to all available support staff, giving you a more timely and effective support response.

Before creating a support ticket, search our website to see if we have an available Knowledge Base Article on your issue: http://perfectmail.com/learn

To register an account to receive support:

1. Visit our helpdesk portal at: https://helpdesk.perfectmail.com
2. Click the "Register" button to create a new account, filling in your contact information.
3. A validation message will be sent to the email address you registerd with. Using your mail client, click the validation link contained in that email.

To create a support ticket:

1. Visit our helpdesk portal at: https://helpdesk.perfectmail.com
2. Login to the helpdesk portal using the email address and password you used during registration.
3. Update "My Profile" with your Company/Organization (Important!) and additional contact information, then click "Update".
4. The helpdesk portal allows you to search a subset of our Knowledge Base. However, our website http://perfectmail.com is a better source for this information. The menu bar provides links to access the Knowledge Base, Submit a Ticket and View Tickets.
5. Click "Submit a Ticket" to create a support ticket. Fill in the Subject and Description and attach any files. Click "Submit" at the bottom of the page when ready.
6. You will receive email notification when changes are made to your support ticket.

Make sure the Subject is informative. Subjects like "bug" are not convey much information. Similarly, the description should contain as many details as possible. Describe in as much detail as possible what you were doing at the time of receiving the errors, what might have been happening with your infrastructure and what steps you have taken to resolve the issue. Feel free to include screen shots of errors or log entries. Details help the support team to understand what to look for when replicating the issue.

Support tickets are also the best place to ask usage questions. This lets us convert your question into a Knowledge Base Article so we can provide the great support for the entire PerfectMail community.

Recipient filtering/Recipient verification is the process where inbound messages, from the Internet are verified as being valid on your Exchange server. If this feature is turned off "all e-mail addresses will be accepted" by both Exchange and PerfectMail.

Starting with Exchange 2013, the Exchange FrontEnd Transport service, by default, no longer rejects invalid recipients during the SMTP conversation. For recipient verification to function, the following needs to be done.

Please ensure you have the appropriate permissions to perform this task.

1. Ensure the Exchange Anti-Spam Agents are installed. You can check via Exchange Management shell with the following EMS command:
   Get-TransportAgent
2. Make sure that Recipient Filter Agent is listed and enabled. If it is not, install it with the following command:
   & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1
3. Ensure that the Recipient Filter Agent is enabled. Use the following command:
   Enable-TransportAgent "Recipient Filter Agent"
4. Enable AddressBook. All of your domains need to be using Address Book to check for recipients. To check, run the following command:
   Get-AcceptedDomain | Format-List Name,AddressBookEnabled
5. If Address Book is disabled for any domains for which the Exchange server is authoritative, fix that with the following command, once for each such domain:
   Set-AcceptedDomain name_of_domain -AddressBookEnabled $true
6. At this point, restart the Microsoft Exchange Transport service.
7. Ensure that Recipient Validation is enabled. Run the following command:
   Set-RecipientFilterConfig -RecipientValidationEnabled $true
8. Again, restart the transport service.
9. Allow access to the Default receive connector. In the Exchange Administrative Center, go to Mail Flow : Receive Connectors.
10. Edit the default connector, go to the Security tab and ensure that anonymous users are allowed. This lets PerfectMail use the connector for recipient verification.
11. Test that Recipient Filtering works. On the PerfectMail console, go to Tools > SMTP Test. Set the "Server IP" to the IP address of your Exchange server, leave the "From" address blank and put a bogus email address in the "To" field. The Subject and Message fields can be blank. Click "Send". The server responses should be similar to the following:
    [+] Connected to 192.168.1.1 << myexchange.mydomain.com Microsoft ESMTP MAIL Service ready at... >> HELO perfectmail.mydomain.com << 250 myexchange.mydomain.com Hello ... >> MAIL FROM: <> << 250 2.1.0 <>... Sender ok >> RCPT TO: <bogus_user_123@mydomain.com> << 550 5.1.1 <bogus_user_123@mydomain.com>... User unknown >> QUIT [-] Closed connection

So what happened?

Your server failed to open a connection with the remote mail server. The connection is the first step before the servers can exchange any content at all; literally before they can even say "hello". This is a connection level issue, which means this has nothing to do with either the sender/recipient addresses or the message content. There is nothing more that can be recorded in the log files as there would be no more information other than we couldn't even get a connection.

Possible issues:

1. Your server is blocked by some reputation service, such as https://spamhaus.org;
2. The remote mail server was experiencing network issues or heavy traffic;
3. The remote mail server is limiting connections from your server (hourly, daily, greylisting, etc.);
4. The remote mail server has purposely been configured to not accept a connection from your server.

Solutions:

1. Check to see if you are on an RBL list, such as https://www.spamhaus.org/lookup;
2. Wait a little while and try sending again;
3. Contact the remote mail administrator to see if they are having issues or if your mail server has inadvertently been "black listed".

Using the server console, if you see the message "accept() returned invalid socket" in /var/log/pmlog, this usually indicates the server does not have sufficient memory to service the number of concurrent mail threads.

Example:

Perfectmail: accept() returned invalid socket (Numerical result out of range), try again
Nov 22 19:20:45 myserver last message repeated 10 times

Consider increasing your server memory. A busy PerfectMail server may require 4Gb of memory, or more.

Milter (pm): error connecting to filter: Connection refused by /var/pm/run/socket
Milter (pm): to error state

This signifies the PerfectMail service is not currently running. Restart the Anti-Spam service on the dashboard using the power icon .

Important: If this occurs when the server is busy it can signify the server has run out of memory. A busy PerfectMail server may require 4Gb of memory, or more.

Milter (pm): error connecting to filter: Connection refused by /var/pm/run/socket
Milter (pm): to error state

If you are comfortable with linux, you can also check the /var/log/pmlog file for the following error messages in /var/log/pmlog..

Perfectmail: accept() returned invalid socket (Numerical result out of range), try again
Nov 22 19:20:45 myserver last message repeated 10 times

This usually is accompanied with a periodic restarting of the PerfectMail service, as the server tries to fix itself. Example:

Perfectmail: accept() returned invalid socket (Numerical result out of range), try again
Nov 22 19:20:45 myserver last message repeated 10 times
Nov 22 19:25:08 myserver pmCheck[5391]: Not Running: (0 threads; Load 0.30 1.05 0.97 1/89 32564 0)
Nov 22 19:25:08 myserver pmCheck[5391]: STOPPING
Nov 22 19:25:09 myserver pmCheck[5391]: STARTING

When this happens, the server has insufficient memory to support the number of concurrent threads. A busy PerfectMail server my require 4Gb of memory or more.

To resolve the issue, reboot your PerfectMail server a couple of times. We added code to purge network cards from the plug-and-play repository. It may take a couple of reboots for the changes to take effect.

GreyListing can be disabled in the web admin interface:

1. Login to the web admin interface;
2. Navigate to: Filters > Filter Settings > Actions (tab);
3. Uncheck GreyListing.

The anti-spam service analyzes the content of each message. If the anti-spam server sees email coming from a source that doesn't appear to be a regular email peer of a recipient (based on bi-directional traffic) and has certain spammy constructs or content, the message may be delayed (greylisted). The server then waits for a few attempts to send the message or a few minutes.

A normal mail server will queue a message that has been "temporarily rejected" and retry transmission in 5, 10, 15 or 30 minutes later, depending on the sending server's settings. Spam engines and bulk marketing services will not queue these messages. Often they try to force their way past GreyListing mechanisms by quickly re-sending the message a few times, then moving on to the next recipient. GreyListing is a good technique to help reduce spam originating from industrial spamvertizing sites.

In your logs you see the same message logged multiple times as the sending server tries to force its way past the grey-listing engine.

You can see GreyListing activity in the Email Activity reports, Mail Activity Log and the Transmission Log.

If needed PerfectMail™ support staff are able to connect to your PerfectMail server to perform maintenance when you request it.

If such action is needed your PerfectMail support staff will give you instructions on how to give us access to the server via the SSH or Web service.

You can also explicitly deny access to your server using the following configuration page: Server Admin > Server Settings > Support (tab)

Similarly, review your organization's firewall settings to restrict access to your PerfectMail server.

Following is a full disclosure of all data reported to PerfectMail™ from a PerfectMail™ product. PerfectMail™ is a high touch product giving the following benefits:

• Statistical Reporting gives us clear & early warning of developing spam trends.
• Server Monitoring ensures early notification of problems.
• Quick & Effective customer support.
• Off-site Backups provide additional peace of mind. If needed we can quickly provide assistance or build a fully configured replacement machine.

Automatic Server Updates

The following updates occur automatically. To disable automatic updates, update the related settings on the Security Settings page:

• Anti-virus Update - Virus update checks are performed every 10 minutes. If an update is available, it will be installed automatically.
• Anti-spam Update - Anti-spam update checks are performed hourly. If an update is available, it will be installed automatically.
• Software Update - Software updates are available periodically. If configured, your server will download software updates and install them automatically.

Server Support Data

The following data elements are normally reported back to PerfectMail™ for support and analysis purposes. To disable any of these reporting features update the Server Admin > Server Settings page on the Web Interface. If support & reporting features are disabled your PerfectMail™ product will still send notification that these features are disabled. No e-mail message content is ever sent to PerfectMail™; except for those messages the client wishes to have examined for spam content.

• Statistical Reporting: Statistical information regarding the effectiveness of the anti-spam software; i.e. number of rejects, tags, accepts, RBL's, mining attempts, spam traps, etc.
• Report Spam: The client user or administrator forwards a spam e-mail to PerfectMail™ for review. Included with the reported spam e-mail are the PerfectMail™ server name and the email address of the submitting user.
• False Positive Investigation: For each false positive release, a message is sent to PerfectMail™ for analysis. If the client has requested false positive investigation, we may examine the message to determine what the problem may be. Even with this option, PerfectMail™ staff will contact the client for permission to perform such investigations.
• Server Monitoring: Hourly health reports allow us to see if there are any issues with the product. These messages describe the state of the databases, but do not include any elements of their content. If there is an issue with a database, a notification message containing the machine name and data table name is sent to PerfectMail™ for information purposes. The PerfectMail™ product is able to self-fix its databases. Administrator intervention is rarely required. In the event of a process crash, a core file (describing what the program was doing the issue occurred) may be sent for analysis.

This is not web-crawling activity, so the robots.txt file is not downloaded. Rather PerfectMail acts as a user-agent, acting on behalf of the message recipient, to verify weblinks contained in received email messages. If PerfectMail is probing a webpage on your website it is because a link to that webpage was included in an email that was received.

PerfectMail webprobes can be identified by the User-Agent String: PerfectMail/2.0 (http://perfectmail.com/kb/web_probe)

Efforts are made to cache website information to minimize webprobe activity.

The correct solution to this problem is for the sending mail server's administrator to create a DNS PTR record to return the mail server's FQDN.

The quick fix solution to the problem (within PerfectMail) is to add the sending mail server's IP address to the No Server Check list. Navigation: Filters > Sender > No Server Check.

Explanation

Domain Name Services (DNS) are the phone book of the Internet. DNS is responsible for performing many types of look ups... Two key look up types are

Address Lookups - Taking a fully qualified domain name (e.g.: mailserver.mydomain.com) and returning a static IP address (e.g.: 1.2.3.4)
DNS Name -> Address lookups are handled using DNS Address (also known as 'A') records

Reverse Lookups - Taking an IP address (e.g.: 1.2.3.4) and returning a fully qualified host name (e.g.: mailserver.mydomain.com)
DNS Address -> Name lookups are handled by DNS Pointer (also known as 'PTR') records

You can view the DNS records for PerfectMail.com here - http://who.is/dns/perfectmail.com

You can easily view your own DNS records. Simply copy/paste this link into a web browser and add your domain name to the end: http://who.is/dns/<yourDomain>

A Relay Host is any machine that either originates an e-mail transaction, or acts as a Relay for other mail servers to forward e-mail to a target mail server

DNS Best Practice

PerfectMail looks at the DNS configuration of sending e-mail servers to determine if the sending server is a spam engine or a legitimate e-mail server. To understand how PerfectMail assesses a mail server's DNS records, we need to look at the Best Practice for creating and managing DNS records for Mail Servers.

DNS For Well Configured Mail Servers

Properly configured mail servers have a minimum of two DNS records...

1. An Address (A) record that takes the mail server's fully qualified name to an IP address, and
2. A Pointer (PTR) record that takes that IP address and returns the same mail server fully qualified name.

Most mail server (or mail gateway servers) have an assigned static IP address. It is a Best Practice for all Internet facing servers to have both Address records and Pointer records.

Spam Engine DNS Records

The vast majority of spam engines on the Internet are computers infected with one or more spam viruses. These machines are typically Microsoft Windows PCs connected to a retail broadband Internet connection.

Retail broadband Internet providers use Dynamic Host Configuration Protocol (DHCP) to assign temporary IP addresses to their customers computers (or modems/firewall appliances). When DHCP assigns a temporary IP address to your computer/router/firewall, it updates the Internet Provider's DNS service with an Address (A) record for your computer. This might look something like r186-49-230-196.dialup.adsl.anteldata.net (taken from a spam sample) which would resolve to 186.49.230.196 (note the IP address is part of the fully qualified name). What retail broadband Internet providers do not do is create Pointer (PTR) or IP Address -> Fully Qualified name lookup DNS records for their non-business customers.

Fly-by-night operations, spammers, compromised PCs, etc. are not entities that are generally willing or able to get PTR records from their ISPs. This makes the presence or absence of DNS PTR records a good measure of the sending mail server's legitimacy.

PerfectMail Test For Mail Server DNS

When PerfectMail gets an inbound e-mail connection, PerfectMail performs a DNS Pointer (PTR) lookup on the IP address of the sending mail server. If the DNS Pointer (PTR) lookup fails, PerfectMail adds a score (+8 Relay Host: No DNS PTR record) to the message because the sending mail server does not follow DNS Best Practices.

Please note: this score is added because the sender's mail server has a DNS configuration problem. The issue does not lie with PerfectMail.

Quick Fix Solution

If you need to configure PerfectMail now to receive messages from a peer mail server with DNS PTR, RBL or SPF configuration problems...

1. Log in to your PerfectMail Administrator's portal (web site)
2. Add the sending mail server's IP address to the No Server Check list. Navigation: Filters > Sender > No Server Check.

E-mail messages from domains and IP addresses listed on the No Server Check list do not undergo any incoming mail server based DNS (both A and PTR), RBL or SPF checks. Valid peer mail servers that receive increased scores due to any DNS, RBL or SPF tests should be listed under No Server Check. This includes valid peers e-mail servers that:

• Have no DNS PTR record
• Are RBL (Real Time Block) listed
• Have poorly configured or incorrect SPF (Sender Policy Framework) records

Preferred Solution

The preferred approach to eliminating this score to add a valid DNS PTR record:

1. Contact the mail administrator of the sending organization and tell them what is going on with their mail server. Tell them that adding a score for a missing PTR records is a common strategy used by all anti-spam systems.
2. Suggest they contact their Internet Provider (who delegates static IP addresses to their customers). 
3. Have them request their provider create a DNS PTR record to map the IP address of the mail server to the FQDN of the mail server

This is usually done by calling the Internet Provider's help desk or filing a trouble ticket with the Internet Provider to create the DNS PTR record

Alternative Solutions

The following alternative solutions will eliminate PerfectMail scoring on known valid e-mail peers where DNS for those peers is not configured according to Best Practices.

Solution 1 - Add the Sending Mail Server's FQDN to the White List

1. Log in to your PerfectMail Administrator's portal (web site)
2. White list the sending mail server's FQDN. Navigation: Filters > Sender > White List. Add the Sending Mail Server's FQDN to the Whitel List. This will allow all inbound e-mail from the mail server.

Solution 2 - Add the Sender's Domain to the White List

1. Log in to your PerfectMail Administrator's portal (web site)
2. White list the sender's Domain. Navigation: Filters > Sender > White List. Add the Sender's Domain to the Whitel List. This will allow all inbound e-mail from any mail server where the sender's e-mail address uses the same domain name.

This should be avoided if possible. The problem with this approach is that spammers can use any domain name they want in the messages From field. If spammers use your peer's Domain name (and you've white listed that domain). the spam will be delivered.

The "hidden" Message Headers are very useful when your email administrator is investigating an email issue. Sometimes mail clients will remove Message Headers when messages are forwarded, so you may be asked to copy and forward this information to your email administrator.

Different versions of Outlook organize their menus in different ways. In general, to find the Message Header information in Microsoft Outlook do the following:

1) In an open message, click the File tab. You may not see the file tab in your mail client. In this case click the "Quick Access" icon at the top left corner of the message (which will give you access to other commands such as "New", "Print", "Save", and "Properties".
2) Click Properties.
3) The Message Headers appear in the "Internet headers" box, which may be located on the "Details" tab.
4) Highlight the headers with your mouse and press Control+C to copy the information.

You may also find the "Message Source" available on this page. This contains the complete email message in its raw form, which is also very useful for message analysis.

The Exchange Admin Center (EAC) is the web based management console for Microsoft Exchange Server 2013. The EAC replaces the Exchange Management Console (EMC) and the Exchange Control Panel (ECP) which were the two interfaces used to manage Exchange Server 2010. Because the EAC is a web based management console, you will need access this console by pointing your web browser at your mail server, (e.g. https://mail.mydomain.com/ecp )

Routing e-mail through a Smart Host

Use the EAC to create a Send Connector to route outbound email through a smart host:

1. In the EAC, navigate to "Mail flow > Send connectors", and then click the "Add +" icon.
2. In the "New send connector" wizard, specify a name for the send connector and then select "Custom" for the "Type". You typically choose this selection when you want to route messages to computers not running Microsoft Exchange Server 2013. Click "Next".
3. Choose "Route mail through smart hosts", and then click the "Add +" icon. In the "Add smart host" window, specify the IP address, such as 192.168.100.1, or the fully qualified domain name (FQDN), such as mydomain.com. Click "Save". For "Smart host authentication", choose the type of authentication required by the smart host. Make sure the Authentication type is set to "no authentication".
4. Under "Address space", click the "Add +" icon. In the "Add domain" window, make sure SMTP is listed as the "Type". For "Fully Qualified Domain Name (FQDN)", enter * to specify that this send connector applies to messages sent to any domain. Click "Save".
5. For "Source server", click the "Add +" icon. In the "Select a server" window, choose a server and click the "Add +" Icon. Click "OK".
6. Click "Finish".

Once you have created the send connector, it will in the Send connector list.

This new analysis engine takes content filtering to the next level. It looks for pre-defined signatures in both the message and headers using a powerful matching engine. Using defined templates RX Scanner is able to identify what type of message is being being presented to the recipient. When a phishing target is identified, RX Scanner performs validation and verification of the message against well-known and published validation information available from the actual phishing target.

RX Scanner is an effective defense against well-known phishing attacks. Unlike spam campaigns where the content of e-mail can be varied infinitely to defeat anti-spam solutions, phishing attacks depend on a limited number of well defined target sites (e.g. Facebook). For a phishing campaign to be effective the phishing messages must resemble something the target site might send. Once a targeted phishing site is identified RX Scanner then performs a number of verification functions to confirm whether or not the message is legitimate.

As a bonus, this technique can also be use to block those well known spam campaigns that never seem to go away.

Company Defined Security Policies:

Content filters may be set by Company Defined Security Polices to try to prevent potentially dangerous content from entering an organization. The content filtering settings can differ from one company to another depending on the type of company, market sector, government restrictions or arbitrary IT administrator decisions. Filters may also be to prevent data loss be controlling the type of documents that can be transmitted outside an internal network; which may also prevent incoming transmission of such documents depending on the filter implementation.

Examples of such security policies include the blocking of:

- Dangerous file types including executable files, Active X and Applets;
- Files containing macros or other scripts including JavaScript;
- Zip archives, large zip archives, nested zip archives;
- Password protected zip and pdf files;
- HREF links to files outside of the document (sometimes occurring in pdf files);
- Files whose MIME type does not match its extension;
- Encrypted files;

Unfortunately, such systems may give little or no indication of what aspect of the message is triggering a content block. Further complicating diagnosis is the fact that administrators may be tweaking such rules as new threats are identified and as false positive reports are coming in.

Depending on the filter configuration these messages may be rejected outright or they may be deferred. In normal mail transmission "deferral" is meant to be a temporary measure. When deferral is used to impose security policies it will generally result in messages getting stuck in the local mail queue.

The best course of action to take when this sort of behavior appears to be happening is to contact the e-mail recipient or mail administrator for the organization and bring this problem to their attention.

Because PerfectMail is actively testing your infrastructure it may identify issues you may not normally be aware of. This most often occurs when transient network/connectivity issues occur. Sometimes transient issues with resolve themselves after a short time span. You may find when you manually test the issue it has already be resolved.

Examples of this sort of network behavior can include ISP maintenance activity, restricted bandwidth due to very large file downloads, etc.

If server validation warning messages occur infrequently you can ignore them. However, consistent ongoing warning messages may signify potential problems with your network infrastructure.

After resolving any warning or error conditions, the validation script will automatically clear any warning or error messages.

You can find the Server Status summary on the Dashboard in the Server Status box. Detailed validation results are available under "Reports > Server Status". You can run the validation script manually on the PerfectMail Dashboard screen using the "Validate Server Settings" button. To configure the validation tests go to "Server Admin > Server Settings > Validation (tab).

Global Settings:

If required, you can restrict the global "message view" setting for all PerfectMail administrators. Connect to the administrator web interface and navigate to "Server Admin > Server Settings" and select the "Security" tab. Here you can adjust the setting for "Allow message viewing" to prevent message content viewing in the admin interface.

Restrict User Settings:

Under "Server Admin > Users" you can click on the "Permissions" tab of a user and change their type from "Administrator" to "User". An "Administrator" has full access to the PerfectMail web interface. Not every administrative user needs full access. You'll need at least one full "Administrator", but most other users can be set as the "User" type. Then you can select the administrative permissions each user has, including "View message content" setting.

Allow End Users to Manage Their E-mail:

With PerfectMail your users can manage their own e-mail without needing administrator access. PerfectMail offers an E-mail Activity Report and Self-Service Console, which allows each user to view and manage their e-mail activity without seeing another persons e-mail.

You can enable these features using "Server Admin > Server Settings > Activity Report (tab)". You need to make sure the "Local Server Web URL" is set correctly for your server - it needs to be the URL that *can* be hit from wherever your users are. (Sometimes organizations have problems with internal private networks vs. public networks with respect to DNS resolution; or having the ability to access the PM server because of firewall rules.)

After these features are enabled you go to "Domain Admin > Domains", select a domain, click on "Edit Addresses" (in the bottom right corner of the screen), and edit the settings for each user using the "Self Service Console" or "Activity Report" tabs.

The Activity Report sends an e-mail activity report which may include "one click" links so users can manage their e-mail directly from the report. It can also include a link to go to the Self Service Console.

The Self Service Console is a limited user based interface so an end user can manage their own e-mail. They can get into the interface via a link on the Activity Report or can log in directly to the PerfectMail interface using their e-mail address and password. This password can be set by and administrator or by the users themselves on the "Settings" tab.

Administrator Audit Log:

PerfectMail also includes an Audit Log so you can see what your PerfectMail administrators are doing. You can find the Audit Log at "Server Admin > Audit Log". Auditing helps to track administrator activities so you can have peace of mind in knowing what is happening with your PerfectMail server. Auditing can also act as a preventative measure if your administrators know their activities are being audited.

- Connection rate throttle (Total number of connections per second across the whole server)
- Bad recipient rate throttle (After a number of bad addresses start adding delays.)
- Client rate throttle (Maximum number of messages per minute, per sending server.)
- Client connection throttle (Maximum number of concurrent connections allowed per sending server.)
- Greeting pause (A short imposed pause on the initial connection to identify and block "slamming".)
- Maximum recipients per message.
- Maximum message size.

When troubleshooting this sort of situation it is best to replace any host-names configured in the PerfectMail interface with IP addresses. PerfectMail primarily uses IP addresses to track servers, so this may help eliminate any DNS issues including local DNS resolution.

Relay Servers:

Each relay server needs to be configured in PerfectMail. When you add your mail server as a destination for a filtered domain (Domain Admin > Domains) it is automatically registered as a valid outbound relay host. However, in some cases the outgoing e-mail messages may appear to be arriving at the PerfectMail server from a different IP address. (This often happens when firewalls are configured to send and receive e-mail traffic using different IP addresses.) Also, you may have additional servers that send e-mail for your organization. Any IP address that should be accepted as a valid outgoing relay server, that is not listed as a destination in the Domain configuration page, needs to be added to the Relay Servers page (Domain Admin > Relay Servers).

Outgoing Relays - are hosts that will have their e-mail relayed to the Internet. These hosts receive no filtering.

Incoming Relays - are hosts that are permitted to relay e-mail inbound from the Internet. These hosts will not be directly checked against reputation databases, RBL services, etc. Listing your Incoming Relays allows PerfectMail to identify where the effective edge of your organization is. This allows PerfectMail to identify the "actual" sending mail host for testing against reputation databases.

Mail Server Relay Configuration:

Your mail server must be configured to relay through PerfectMail. Each mail server has a specific way of configuring this setting. The default relay host for a mail server is most often called a "Smart Relay Host", so look for that in your documentation.

Microsoft Exchange users can refer to the following KnowledgeBase article for more information: http://perfectmail.com/kb/microsoft_exchange_smart_host

Troubleshooting Smart Relay Settings:

To troubleshoot your smart relay settings make the configuration changes mentioned above, then navigate to the PerfectMail Transmission Log (E-mail > Transmission Log). You can watch e-mail transmission activity using this page. Click the "Last Hour" button to watch see your mail transmissions. (To refresh the screen press the "Last Hour" button again.)

There may be many messages being transmitted through your mail server concurrently. The Message ID for each e-mail is displayed in blue on this page. You can click on the Message ID to display just the log entries for that particular message.

Any outgoing e-mail from your mail server should be displayed on this page. If you are not seeing e-mail from your mail server, then there is a problem with the smart host relay setting on your mail server.

If you are seeing outgoing e-mail from your mail server, check the status to see if the messages are indeed being sent. If not, note the IP address that the e-mail originated from and any error messages. This IP address must be listed as either a destination address in the Domain configuration page or as an Outgoing Relay.

This means:

1) PerfectMail will not be able to filter these messages, and

2) there will be no record of these messages in the PerfectMail interface.

If your users are not receiving e-mail that is sent locally, these messages may be getting filtered by your mail server (e.g. Exchange) or they may be placed in the local mail client (e.g. Outlook) Junk folder. Outlook may be performing additional spam filtering, that PerfectMail cannot control.

You can find your complete licensing information by navigating to "Server Admin > License", to find the License Number along with other items.

If there is no License Number definied then there may have been an issue with the initial server setup. Contact our support staff (http://helpdesk.perfectmail.com) and we will get you a License Number and Activation Code as soon as possible.

The Activity Report contains the subject lines of all the e-mail that you were sent, including the subject lines of all the spam messages that were blocked. There may be enough spam content contained within this report to cause your additional spam filtering software to block the report.

Unfortunately there is nothing we can do to influence what Outlook does with such messages other than to add the "sender" address to the users "contact list".

If the mail client (e.g. MS Outlook) is performing additional spam filtering, you may find there are other messages that are getting filed in the junk folder. Sometimes we will receive reports of "false positives" that result from incorrect filtering at the mail client, that have nothing to do with the PerfectMail product.

If the Activity Report is not in your junk folder, ask your e-mail administrator to check in the activity log to see if the activity report was sent by searching for your e-mail address and the phrase "Activity Report" over the last week. There should be daily entries showing that the report was sent. If the report was not sent check the settings for the user in question and check that the Activity Report is configured correctly.

You can also do things on the website to make these message less readable to electronic devices. However, such techniques also make the addresses less available to your website users. But there are some strategies that can help. One thing you can do is present and image of the e-mail address rather than the text itself. Another thing you can do is to present a messaging page where people can send messages directly via your website;make sure to include a captcha element to discourage e-mail address harvesting engines.

If you have a website developer you can use their coding skills to obfuscate your e-mail addresses using JavaScript. On your website replace the domain portion of your e-mail addresses with a bogus address (or better yet a spam trap!) Then use a JavaScript function to rewrite the web page after it is loaded in the web browser. Spammer e-mail scraping programs are unlikely to execute javascript to rewrite the web page, so this should be an effective method of protecting your e-mail addresses.

In the example below the e-mail address "user@mydomain.com" is protected by displaying it on the initial web page as "user_smith@mydomain.com", then rewriting that e-mail address after the web page loads. Make sure you add "user_smith@mydomain.com" to the list of Spam Traps (or Spam Honey Pots) on the PerfectMail Administrators Interface at "Filters > Spam Traps".

Example Web page:
--------------------------------------------------------------------------------
<html>
<head>
<script>
function dom_replace(src,tgt,node){
if (!node) node=document;

if (node.nodeType==1){
if (node.nodeName=='A') node.href = node.href.replace(src,tgt);
}else if (node.nodeType==3){
node.nodeValue = node.nodeValue.replace(src,tgt);
}

var len = node.childNodes.length;
var child;
for (var i = 0; i < len; i++) {
child = node.childNodes[i];
dom_replace(src,tgt,child);
}
}
</script>
</head>
<body onload="dom_replace('_smith@mydomain.com','@mydomain.com');";>
<p>In this example I protect addresses for mydomain.com by replacing them with a bogus address.</p>
<p>This method works with both normal HTML text and hyper linked e-mail addresses as well.</p>
<p>
user_smith@mydomain.com<br/>
<a href="mailto:user_smith@mydomain.com">user_smith@mydomain.com</a>
</p>
</body>
</html>
--------------------------------------------------------------------------------
The interesting thing is, when you look at the source code for the web page (by pressing <CTRL>+U) you will still see the original e-mail address.

You can also generalize this by embedding the domain replacement in the function, then placing that function in a separate file that you could simply include in all your web pages, where needed.

When a mail server does not properly complete a mail transmission, either by dropping the connection or due to a timeout, the communication channel is broken. This shows up in your log file as a "Milter Error". This is simply an error notification showing that there was a timeout issue.

Following is an example to demonstrate this behavior:

Jul 20 09:45:40 perfectmail sendmail[19312]: rzKgjD5s029413: from=, size=7935, class=0, nrcpts=1, msgid=<83785233522355324@mailhost.somedomain.com>, proto=ESMTP, daemon=MTA, relay=mailhost.somedomain.com [10.50.31.69]
Jul 20 09:56:12 perfectmail sendmail[19312]: r7KGjD5s029413: Milter (pm): timeout before data read
Jul 20 09:56:12 perfectmail sendmail[19312]: r7KGjD5s029413: Milter (pm): to error state
Jul 20 09:56:12 perfectmail sendmail[19312]: r7KGjD5s029413: to=, delay=00:10:32, pri=37935, stat=Please try again later

You can see the time span from the first to the second line of the log file. It took over 10 minutes for the sending server to transmit some very basic information (from and to), which timed out the mail connection.

----- Transcript of session follows -----
... while talking to smtp.example.net.:
>>>> DATA
550 5.1.1 ... User unknown

Here's a bounce from another mail server which attempts to be friendlier:
Hi. This is the qmail-send program at example.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

10.10.10.10. does not like recipient.

Remote host said: 550 MAILBOX NOT FOUND
Giving up on 10.10.10.10.

----- The following addresses had permanent fatal errors -----

SMTP error messages usually consist of a 3-digit numeric code (e.g. 550) followed by a plain text description of what the problem is. In this example we see: 550 MAILBOX NOT FOUND. If we look closer there were a number of errors in this example:

550 5.1.1 ... User unknown
550 MAILBOX NOT FOUND

In general return codes in the 500 range are permanent errors and return codes in the 400 range are temporary errors. For temporary errors the mail server is saying it can not perform the task at the present moment, but try again later. Notice the two entries had the same 550 code bug different descriptions. Different mail servers interpret SMTP codes differently and may give different, but similar, plain text descriptions.

From this example, it is plain there is a problem with the recipient address. It likely does not exist, so either there was a mistyped e-mail address, the address may no longer be valid, or there may be a problem with the receiving mail server (which happens much more often than you would believe.)
 

Common Error Messages:
Mailbox Not Found, Invalid Mailbox, User Unknown, Not Our Customer - These are all saying pretty much the same thing. In the "someone@example.com" bounce examples above, the mail server "example.com" doesn't have an account for anyone with the email name "someone". Often these errors are due to mis-typing the recipient e-mail address. Double check the e-mail recipient. You may be using an old e-mail address, make sure the address is current.

Mailbox Unavailable - This is most often the same as "Mailbox Not Found", though it may also mean that there is a problem with the receiving mail server. Check to make sure that you have the email address correct, wait a while and try again, and if it still bounces, try contacting the recipient some other way.

Mailbox Full, Quota Exceeded - Sometimes this will show up as a part of a "Mailbox Mnavailable" message. The recipient has too much e-mail in their inbox and their mail server is refusing to accept any more. This is most common with web-based e-mail services which limit how much mail can accumulate for a particular mail account. This can also be a sign of an abandoned mail account, where the account owner has stopped checking their e-mail. In any case, you'll need to contact the recipient through some other means.

Host Unknown, Domain Lookup Failed - There is no mail server that hosts the domain portion of the e-mail address being sent to, (i.e. the example.com part of the e-mail address). A common reason is again, a mis-typed e-mail address. Make sure you typed it in correctly. This may also happen when an organization changes its domain name.

Unable to Relay - This is a terribly obscure error message, but also becoming more and more common as ISPs try to crack down on spam. Mail is sent by relaying e-mail from one server to the next. There could be many servers involved, but typically it's the mail server at your ISP relaying your email to the mail server at your recipients ISP. In general, a mail server must "know" either the sender of an email, or its recipient, in order to safely transmit mail. Mail servers that do not enforce this requirement are called "open relays" and can be exploited by spammers to send out tons of spam. Things get complicated because not all ISPs agree on what it means to "know" the sender of an email. All of these might result in an "Unable to Relay" message, depending entirely on the servers and ISPs involved. Sometimes this error will happen only occationally. In this situation there is problably a mail server configuration error on the recipients part. This happens more more frequently than you would think and even very large organizations suffer from this problem.


Temporary Errors:
Errors like "no adequate servers", "Connection Timed Out", "Resources temporarily unavailable.", "Out of memory" all typically indicate a problem with a mail server that you probably don't have any control over. They are, in general, temporary, and should resolve themselves over time. Look carefully at the bounce message; the email server involved may continue to automatically try to deliver your email without any action required on your part.


Blacklist Filters:
If you see messages that indicate your email was "blocked", or "listed in", and references to sites that have things like "spamcop", "dynablock", "blackhole", "spamhaus" and similar in their names, then your email was probably intentionally blocked because the receiving system thinks your ISP's mail server is a source of spam.

Various blacklisting services try to identify servers which are sources of spam. They then make that list available to ISPs, who in turn can block email coming from these sources. The problem is that criteria for addition and removal from these blacklists are vague, at best, and getting a server removed from blacklists can be very difficult. If this happens to mail you send, get in touch with your ISP and explain that their server may be on a blacklist somewhere, and then try to use a different email address, or a different email account of your own, to contact your intended recipient. You might also tell your recipient that their ISP is improperly blocking legitimate email.
Content Filters:

Much like blacklists, content filters are an approach many ISPs now implement to stem the tide of spam for their clients. Most will simply discard email that looks like spam, but some servers will actually send a bounce. Phrases in the bounce message like "Message looks like spam", "keywords rejected by the anti-spam content filter", "scored too high on spam scale" and similar means that your email, for whatever reason, tripped the spam filters on the receiving end. Your email looks too much like spam.

What does it mean to "look like spam"? Here, again, things get vague. That definition will vary greatly based on how your recipient's email server has been configured. Obvious possibilities are the use of pornographic words or phrases, HTML formatted email, currently popular drugs being hawked by spammers, or even having something that looks too much like a sales letter or a scam. The best approach is to scan the bounce for any clues (sometimes there's more information), and then validate your recipient can get any email by sending a simpler message. Assuming that all works, then re-work your message as best you can to not look like spam.


When a Bounce Isn't Really a Bounce:
Be careful! There's a class of viruses these days that propagate by "looking like" bounce messages. They instruct you to open an attachment for more information. Don't. Especially if you don't recall sending the message in the first place. Don't open any attachment, especially one accompanying what looks like an email bounce unless you are absolutely positively certain that it's legitimate.

You may also be getting bounce messages for email you didn't send. There's another class of virus that "spoofs" or fakes the "From" address on email messages, and as a result you could be getting bounce messages that have nothing to do with you.

Anti-Obfuscation:
Anti-Obfuscation is a technique that identifies attempts to disguise words. For example, Anti-Obfuscation maps "\/ 1 @ g r @" to "Viagra", "><@n@x"> to "Xanax", etc. The word score is scaled to match the measure of obfuscation. This technique is very successful. (However, in some instances this technique can give erroneous results if the listed word is similar to other non-offensive words; so use this with care.)


Suffix Matching:
Suffix Matching is a technique that attempts to match a "root word" to variations of that word "by suffix". For example, applying Suffix Matching to the word "run" will match variations "runs", "runned", "running", etc.

If the Suffix Matching option is applied to a "phrase", then Suffix Matching will only apply to the last word in the phrase.


A Warning on Anti-Obfuscation:
Understand the impact of Anti-Obfuscation and Suffix Matching when matching phrases in the content filters. These techniques try and match words and phrases by matching "possible variations" that may be used to try and avoid detection.

This may become a problem when you are trying catch a "specific phrase". For example, if you try and match the word "C A S I N O" when looking for spam and have Anti-Obfuscation turned on it will also match "casino", which may result in inappropriate scoring. This may become more problematic when both Anti-Obfuscation and Suffix Matching are used.

To restore your settings, including Black/White lists, etc., start up the old system and navigate to the web interface "Server Admin > Backup". Create a new backup (add a comment), then click the "Existing Backups" tab. Click on the backup you created to download it.

On the new server navigate to "Server Admin > Backup". Click the "Browse" button, select the backup file you downloaded and click the "Upload" button. Once again, click over to the "Existing Backups" tab, click the radio button beside the uploaded backup and click one of the restore buttons.

"Restore Domain and Filter Settings" - Will restore all of the domain configuration, spam settings, etc.

"Full Server Restore" - Will restore everything, including network settings. (Network settings will only take affect after the server is rebooted.)

Neither of these options will restore your license information. License information is always server specific.

When the new server is in production open a support ticket to let us know about the server change. We will update your licensing information as needed.

Overview of the Junk Email Filter:
http://office.microsoft.com/en-ca/outlook-help/overview-of-the-junk-email-filter-HP010355048.aspx

Change the level of protection in the Junk Email Filter:
http://office.microsoft.com/en-ca/outlook-help/change-the-level-of-protection-in-the-junk-email-filter-HP010356454.aspx?CTT=5&origin=HP010355048

Be careful when supplying your e-mail address to any survey, contest or the like. Such things will most likely get your e-mail address placed on any number of spammer lists.

It may be an Exchange configuration error, or there may be a problem with the Exchange software. Make sure your exchange server is fully patched. If the problem persists you may need to seek the advice of a Microsoft Exchange expert or contact Microsoft for further support.

- Customer feedback
- Feature requests
- Bug reports
- General Q&A, etc.

For Q&A we recommend searching our website for information as a first step. We maintain a KnowledgeBase of information that we regularly contribute to. If you can't find information on our website, send us an e-mail and we'll a) send you the answer and b) create a KnowledgeBase article so others can get the same information.

Billable Support:
Billable Support incidents include those items that are not deemed to be the direct responsibility of our development or support team, such as:

- Investigations into issues where the solution is readily available on the KnowledgeBase or on the Interface.
- Investigations into "why" e-mail is treated a certain way, or followup with external e-mail senders.
- System maintenance that we would normally be provided by the customer.
- Investigation of configuration and server issues that are not directly related to the PerfectMail product itself.

Basically, if there is something wrong with our system, or if we don't provide sufficient information for you to perform an investigation yourself the Support Incident is NOT billable. We will assist you with the issue and/or update our product and/or KnowledgeBase to ensure either the problem is resolved or that you can perform the investigation yourself.

If you have the tools/information to reasonably be able to diagnose or perform the tasks you need to do but either lack the expertise or inclination to deal with the issue in house, then this would become a Billable Support Incident. Often Billable Support Incidents occur when the local admin does not have sufficient experience/training with e-mail/SMTP to understand the basic ideas of what happens during an e-mail exchange at the SMTP protocol level.

Most of our customers will rarely "burn" a support incident, so 1 or 2 incidents per year is a reasonable number. In fact, I believe we has communicated several times already and non of these exchanges have resulted in a billable incident, (unlike the behavior you may experience with some other vendors.)

If you want to push off your local e-mail administrative and diagnostic tasks to our support staff, we are happy to assist you. These tasks would be Billable Support Incidents where we would log into your server and perform diagnostics or administration. For this sort of support you can purchase a Support Pack (of varying sizes) to ensure you have the support you need. We can send you pricing for this (available on our website) if you are interested in this sort of service.

E-mail Priority:
There are 3 types of e-mail priorities that are commonly understood: Urgent, Normal and Bulk. The mail client program (e.g. Outlook) will set the priority of the e-mail and this priority will be used to determine what happens to an e-mail if there is some sort of error during transmission.

E-Mail Errors:
The remote mail server has two options when there is an error. It can return a permanent error code, something in the range of the numbers from 500 to 599. A permanent error condition (e.g. 550) will result in an immediate return of the e-mail to the sender.

The remote mail server may also return an error code signifying a temporary error either in it's configuration or server state (e.g. the server is too busy to handle the e-mail message). These error codes ranging from 400 to 499 specify the type of error and tell the sending server to try and re-transmit the e-mail after a short delay. Normally this allows for server conditions to change.

Queue Warning:
Your mail server will try to resend an e-mail with a temporary error for a number of hours. If transmission does not succeed it will send a warning message to the sender, but keep trying to send the e-mail.

Queue Return:
After a longer period of time the server will give up on sending the e-mail and return it to the sender with a notification of the delivery failure.

PerfectMail Warning/Return Thresholds:
You can update how long PerfectMail will try to resend e-mails temporary delivery errors. Using the web admin interface, navigate to the MTA Settings page (Server Admin > MTA), click on the "Warning/Return Thresholds" tab, make any required changes and click the "Update" button.

WARNING: Changing Mail Transport Agent (MTA) Settings can have serious implications on the ability of your mail server to handle/deliver e-mail in a timely manner. Modifications to these settings should be made with caution and by administrators with knowledge of how these settings will impact the Mail Transport Agent.

To resolve this issue the recipient organization needs to resolve their infrastructure issues.

In large organizations, with many mail servers, this issue may be a transient error isolated to a particular mail host or cluster configuration (e.g. in a mail server failover situation.) If you are unable to contact the organization to have them resolve your issue, waiting a short time and resending may be all you need to do.

References: http://www.ietf.org/rfc/rfc1846.txt

≷A title=http://office.microsoft.com/ href="BLOCKED::http://office.microsoft.com/">Office Online</a>

This is an Outlook security feature that may occur when URLs are copied from one email message and pasted into another message. This is not a common problem, but we have had some reports where it has been seen in Outlook 2003 and Outlook 2007. It may be do to Internet Security Settings on your PC or in Outlook or may be a result of anti-virus or anti-spam software installed on your PC.

You may be able to control it by adjusting the blocked external context setting in Outlook. In Outlook go to: "Got to Tools > Options > Security". Here you can selec to "Change Automatic Download Settings" and make appropriate adjustements. You may also fix this problem by setting Outlook to use the "Internet Zone" (on the same page).

Note: We do not recommend lowering the internet Security settings or Setting Outlook to use a less restrictive Internet Zone. Resetting the Internet Zone to use the default settings may help.

Warning: Using any zone other than Restricted will lower your security and could leave you open to possible infection from Java exploits.

As a security consideration the default configuration is to not allow SSH access via the admin account. This task is left for your Linux administrator to perform, if necessary. A qualified Linux administrator should be able to easily perform this task.

In general, Linux administration is not needed; in fact it is discouraged. Updating the configuration of your PerfectMail server may render it non-functional. If you do need to make changes to the Linux release hosting PerfectMail, you do so at your own risk. Make sure you have full backups and plan to recover in case there is an issue.

If you are running an older OS release of our product, you can download the latest release from our website: http://perfectmail.com/download

If you do need to update Linux packages you do so at your own risk. Make sure you have full backups and plan to recover in case there is an issue.

If you are running an older OS release of our product, you can download the latest release from our website: http://perfectmail.com/download

In most instances your PerfectMail server will be fully functional after a server migration, with no impact to production or functionality. However you will need to register a newly created PerfectMail server.

There are two types of server migrations that are generally be performed with PerfectMail servers:

1) Migration of data to a newly installed PerfectMail server. When you create a new PerfectMail anti-spam server instance, that instance comes with a fully functional 60 day license. This will let you set up your new environment and perform your migration at your leisure. When you are ready to put the new server into production let us know and we will assign your license to the new server.

2) Migration of a virtual server within the virtualization host server or across host servers. In most cases the virtual server will be migrated intact with the virtual hardware components being maintained. Your existing PerfectMail anti-spam license will remain functional. In fact this sort of server migration will be seamless to your PerfectMail server.

In any case, if you have any issues, let us know. We will be happy to assist you.

If you have any issues at all, let us know. We will be happy to assist you.

Content that is not stored in the local archive can not be viewed or restored.

If this becomes a problem, you can adjust the Archive Settings on your Perfectmail server to select what sort of message content is stored locally. To update the Archive Settings go to the Administrator Web Interface and navigate to "Server Admin > Archive > Message Storage tab" and select the message types to store.

211 System status, or system help reply
214 Help message

220 Service ready
221 Service closing transmission channel
421 Service not available,

250 Requested mail action okay, completed
251 User not local; will forward to
252 Cannot VRFY user (e.g. info is not local). but will take message for this users and attempt delivery
450 Requested mail action not taken: mailbox unavailable (e.g. mailbox busy)
550 Requested action not taken: mailbox unavailable (e.g. mailbox not found or no access)
451 Requested action aborted: error in processing
551 User not local; please try
452 Requested action not taken: insufficient system storage
552 Requested mail action aborted: exceeded storage allocation
553 Requested action not taken: mailbox name not allowed (e.g. mailbox syntax incorrect)
354 Start mail input; end with .
554 Transaction failed

Normally this sort of activity would be "unusual" and a high indication of spam. However, this may not be true if your users work remotely and send their e-mail from servers located outside of your organization.

To block "self-sent" e-mail log into the Web Administrator interface and navigate to Filters > Filter Settings > Sender Tab, and enable "Block self sent e-mail".

To allow "self-sent" e-mail from a particular server, either:

1) White list the sending server or domain in Filters > Sender > White List tab; or
2) Disabling the "Self Sent" anti-spoofing test on Filters > Filter Settings > Sender Tab.

Normally this sort of activity would be "unusual" and a high indication of spam. However, this may not be true if your users work remotely and send their e-mail from servers located outside of your organization.

To block "self-sent" e-mail log into the Web Administrator interface and navigate to Filters > Filter Settings > Sender Tab, and enable "Block self sent e-mail".

Spoofing is so hard to stop because there is no way to validate an e-mail within the message itself. This is an inherent problem with the SMTP design. With DKIM and SPF you have some sort of validation technique, but the adoption of these methods is relatively sparse; though we do see the acceptance of SPF increasing.

For anti-spoofing we recommend the "verify e-mail option" as a minimum. Some organizations will never see e-mail coming from the internet as "sent" from their domain. However, when you have situations where people send from their home accounts "using their work e-mail address" the "block" options can result in many false positives.

To configure anti-spoofing options log into the PerfectMail web interface and navigate to Filters > Filter Settings > Sender tab; there are 3 options:

Verify e-mail address: Verify the existence of e-mail addresses from hosted domain, but coming from the outside. (Recommended.)

Block self sent e-mail: Block e-mail sent by a user to their selves, but coming from outside. (Recommended for most organizations.)

Block all: Block all e-mail from the outside that is reportedly from a hosted domain. (Restrictive)

Note: To PerfectMail the outside world is anything that is not defined as a part of your infrastructure. Your mail servers and relay servers are all considered "inside", while everything else is considered "outside". PerfectMail is smart enough to recognize mail coming through "inbound" relays and will consider the first "outside" hop as the outside originator.

1) Log into the PerfectMail Administrator Interface,
2) Navigate to Domains Admin > Domains,
3) Select (click) the appropriate domain, then click on "Edit Addresses" button at the bottom right of the page
4) Select (click) the appropriate e-mail address, and select (click) the "Activity Report" tab,
5) Adjust Activity Report settings. Make sure to "Enable Reports" and set your "Report Frequency" to Daily, Weekly or Monthly, as needed.

However, in rare circumstances this can also signal a problem with your local DNS resolution. DNS resolution is required for e-mail analysis and delivery, so there may be a problem affecting your e-mail flow. To see the validation error report go to the "Reports > Server Status" page and look at all of the validation results. There will be lines for each DNS server saying "Querying DNS server" with the results.

Try the following:
1) Reboot your local DNS Server
2) Restart your MTA using the PerfectMail Dashboard

After restarting these services go to the web administrator interface "Tools > DNS Lookup" page. Enter the IP address of the questionable DNS server and lookup names for domains that you would not normally see. The idea is to try and find domain names that would nor normally be cached on your DNS server.

Sometimes we see DNS servers misbehave when performing new lookups. When this happens DNS lookups for cached entries appear to work fine, but new lookups appear to fail. Restarting DNS services appears to fix this problem in the short term.

Try the following:
1) Reboot your local DNS Server
2) Restart your MTA using the PerfectMail Dashboard

After restarting these services go to the web administrator interface "Tools > DNS Lookup" page. Enter the IP address of the questionable DNS server and lookup names for domains that you would not normally see. The idea is to try and find domain names that would nor normally be cached on your DNS server.

Sometimes we see DNS servers misbehave when performing new lookups. When this happens DNS lookups for cached entries appear to work fine, but new lookups appear to fail. Restarting DNS services appears to fix this problem in the short term.

Further, this process can result in downtime if there are problems with the mail server migration. Consider a situation where you are forced to fall back to the old mail server and the new MX records have already propagated through DNS. Servers may be unable to reach your old mail server.

The following procedure allows you to perform a discreet, clean cut over with no loss of e-mail and allows for falling back to the old server if there is an issue with the migration.

Clean Mail Server Cutover Procedure:

1) Ensure both mail servers are operational.
2) Turn off SMTP for the new mail server and add the new MX record in DNS.
2) Wait 48 hours.
3) Turn on SMTP for the new mail server and turn off SMTP for the old mail server.
4) Test. If there are migration issues simply reverse step 3.
5) Remove the old MX record in DNS.

To block a whole domain or subdomain, simply add that domain to the black list:

1. Log into your PerfectMail web interface using an administrator account;
2. Navigate to the Black/White List page (Filtering >Black White List) and select the Black List tab;
3. Add the Top Level Domain Country Code to the Black List. For example, to block the Soviet Union you would add an entry for "SU" to the list (not ".su" nor "*.su"; simply use "su"). Any e-mail coming from any domain ending ".su" or from any hostname ending ".su" will be black listed.

Internet domain country codes are listed by IANA in ISO 3166-1.

You can find a list of country codes at this link: http://perfectmail.com/kb/top_domain_country_codes

The content of each message is checked for the listed words and phrases. The word list is case-insensitive. Your words will be automatically converted to the simplest version our filter can handle, including character case conversion and stripping/converting of any characters that cannot be understood by the filter.

Two lists are implemented on your server: a system word list maintained by our staff and a local word list that can be maintained by your local e-mail support staff.

Scoring for specific phrases is generally different for the e-mail subject and other headers than it is for the e-mail body. Words and phrases that may be high indicators of spam when contained in the subject may be used frequently in legitimate e-mail bodies. It is important to use caution when managing content filtering.

Try to avoid very simple words that may appear in messages or in HTML constructs contained in e-mail; for example a word such as "aaaa" would be a very bad word choice.

Bonus Scoring

You can give negative values to words and phrases to drive down the score of known good content. If your business uses terms and phrases that are unlikely to appear in spam messages, add them here with negative scores to mark known good content.

Anti-Obfuscation

Anti-Obfuscation is a technique that identifies attempts to disguise words. For example:
Anti-Obfuscation maps \/ 1 @ g r @ to Viagra, ><@n@x to Xanax, etc. The word score is scaled to match the measure of obfuscation. This technique is very successful, but it can sometimes give erroneous results if the listed word is similar to other non-offensive words; so use this with care.

Suffix Matching

Suffix Matching is a technique that attempts to match a root word to variations of that word by suffix. For example, applying Suffix Matching to the word "run" will match variations "runs", "runned", "running", etc.

If the Suffix Matching option is applied to a phrase, then Suffix Matching will only apply to the last word in the phrase.

A Warning on Anti-Obfuscation

Understand the impact of Anti-Obfuscation and Suffix Matching when matching phrases in the content filters. These techniques try and match words and phrases by matching possible variations that may be used to try and avoid detection.

This may become a problem when you are trying catch a specific phrase. For example, if you try and match the word "C A S I N O" when looking for spam and have Anti-Obfuscation turned on it will also match "casino", which may result in inappropriate scoring. This may become more problematic when both Anti-Obfuscation and Suffix Matching are used.

Anti-Obfuscation and Suffix Matching are powerful tools that also require some consideration.

Updating the Content Filters

The fields for each word/phrase are in two groups for the Subject and other headers and the message body.

• Enable - Enable scoring for this word.
  
  
• Score - For each instance of this word score this amount.
  
  
• Rjct - If this word is found reject the message. (Score=99)
  
  
• Suf - Enable the Variable Suffix Engine. This engine matches against variations of word suffixes. For example, if you wanted to score the word jump the Variable Suffix engine would also catch: jumps, jumping, jumped, jumpy, jumper, etc.
  
  
• Obf - Enable the Anti-Obfuscation Engine for matching structural word variations. Spammers will attempt to change the structure of words so they are still readable by people, but difficult to recognize by machines. Depending on the amount of obfuscation found, the score of the found word will increase by the obfuscation factor. Our Anti-Obfuscation Engine is very good at catching and scoring for such attempts. However, this feature should be used with caution.

Anti-Obfuscation

Anti-Obfuscation is a technique that identifies attempts to disguise words. For example:
Anti-Obfuscation maps \/ 1 @ g r @ to Viagra, ><@n@x to Xanax, etc. The word score is scaled to match the measure of obfuscation. This technique is very successful, but it can sometimes give erroneous results if the listed word is similar to other non-offensive words; so use this with care.

Suffix Matching

Suffix Matching is a technique that attempts to match a root word to variations of that word by suffix. For example, applying Suffix Matching to the word "run" will match variations "runs", "runned", "running", etc.

If the Suffix Matching option is applied to a phrase, then Suffix Matching will only apply to the last word in the phrase.

A Warning on Anti-Obfuscation

Understand the impact of Anti-Obfuscation and Suffix Matching when matching phrases in the content filters. These techniques try and match words and phrases by matching possible variations that may be used to try and avoid detection.

This may become a problem when you are trying catch a specific phrase. For example, if you try and match the word "C A S I N O" when looking for spam and have Anti-Obfuscation turned on it will also match "casino", which may result in inappropriate scoring. This may become more problematic when both Anti-Obfuscation and Suffix Matching are used.

Anti-Obfuscation and Suffix Matching are powerful tools that also require some consideration.

Updating the Content Filters

The fields for each word/phrase are in two groups for the Subject and other headers and the message body.

• Enable - Enable scoring for this word.
  
  
• Score - For each instance of this word score this amount.
  
  
• Rjct - If this word is found reject the message. (Score=99)
  
  
• Suf - Enable the Variable Suffix Engine. This engine matches against variations of word suffixes. For example, if you wanted to score the word jump the Variable Suffix engine would also catch: jumps, jumping, jumped, jumpy, jumper, etc.
  
  
• Obf - Enable the Anti-Obfuscation Engine for matching structural word variations. Spammers will attempt to change the structure of words so they are still readable by people, but difficult to recognize by machines. Depending on the amount of obfuscation found, the score of the found word will increase by the obfuscation factor. Our Anti-Obfuscation Engine is very good at catching and scoring for such attempts. However, this feature should be used with caution.

Updates: Updates to PerfectMail occur on a regular and ongoing basis. Your server will check for updates to its spam and virus settings every 10 to 15 minutes to quickly adjust how it reacts to spam threats.

Upgrades: Periodic code releases are made to add more tools or make improvements to our anti-spam engine.

Notes on Upgrades

It takes approximately 30 seconds to apply a PerfectMail upgrade; no e-mail will be lost. The upgrade process consists of: a download phase, where the new release is transferred to your server; and an upgrade phrase, where the new release is installed. We have structured the upgrade process to minimize downtime and take advantage of existing e-mail practices to make the upgrade process invisible to your users and e-mail peers.

1. PerfectMail support staff will be available for 72 business hours after an upgrade.
2. Normally, PerfectMail upgrades will be made between Monday morning and Wednesday evening; ensuring the availability of PerfectMail support staff, customer support staff and a user population to identify any issues that may arise. However, if a significant bug is found we may opt to publish a maintenance update outside of this window. In any case, support staff will be available for 72 hours after the upgrade.
3. Your PerfectMail server will send you an upgrade notification e-mail after the upgrade.

The Upgrade Process

We provide a 72 hour post install support availability window, where staff must be available to deal with any upgrade issues.

The upgrades themselves occur seamlessly on your PerfectMail™ server. The latest upgrade is downloaded to your server; after which mail services are suspended and the upgrade is applied. The total downtime is usually about 30 seconds, with no loss of e-mail.

After the upgrade is finished your PerfectMail™ server will send you an e-mail notification.

Staggered Upgrade Scheme

We have a staggered upgrade release schedule to minimize any disruption to your Mail Server. Prior to general release PerfectMail is tested on our Development, Alpha and Beta sites. After successful deployments through these three server groups it becomes available for general release, being pushed to upgrade groups: 'A', 'B' and 'C' in a progressive release schedule.

'A' sites receive their updates on the Monday of the general release; 'B' and 'C' sites receive their upgrades later in the week, or even in the following week.

At any time, if there are any reported issues they are assessed and appropriate actions are taken.

We perform regular peer-level code reviews. Code reviews give an opportunity to search for potential bugs; facilitate the exchange of ideas pertaining to programming style; and help identify potential system wide improvements.

All code is passed through code analysis software. We use the Coverity® Quality Advisor (www.coverity.com) to identify code quality defects while in development.

Prior to coding, design decisions are discussed and debated. Functionality, stress points, boundary conditions, best/worst case scenarios, etc. are established for design changes.

Metrics are established to measure the effectiveness of a module and performance goals are set. At this point the module is re-evaluated for feasibility and impact.

On completion a module must go through development and Alpha testing. During development testing the module must demonstrate programmatic and functional stability and scalability. During Alpha testing the module is placed in a production environment. We maintain two alpha servers servicing approximately 80 domains; including our own domains.

For new modules or significant changes to modules, the modules are initially delivered impotent; they log what they would have done instead of actually making decisions. After a test has proven itself and the metrics have met our goals we turn it on in the next maintenance release.

We currently have 11 beta test sites servicing approximately 600 domains. They consist of various sizes and business types. Site traffic ranges from a few hundred to 1.5 million connections per day.

After Beta release we actively monitor these sites for any issues that may occur. After a period of clean behavior we make a determination of whether to release our software. Software release typically occurs on the following Monday.

Major releases should occur every two years. PM-4.0 should be available next summer.

Minor releases should occur every 2-4 months, depending on our development cycle.

Minor improvements are included in our Maintenance releases. Maintenance releases occur as needed. Spam is constantly evolving. Our maintenance releases generally occur every 2-4 weeks, depending on need.

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Evolution™ Filters

Ximian Evolution™ is an email client for Linux similar to Microsoft Outlook™. It is installed by many Linux™ distributions including Red Hat™, Fedora™, and SuSE Linux™. Evolution™ has the ability to filter on an arbitrary header as well as on the send and receive addresses.

1. Click "Inbox" to display the Inbox.
2. Click "Edit" and select "Message Filters". (Sometimes "Filters is located under "Tools".)
3. In the Filters window, click "Add".
4. Enter a name for the filter under "Rule name".
5. Under "Find items that meet the following conditions", choose "Specific header" in the leftmost button menu; in the field to the right of "Specific header", enter "X-Spam-Flag"; change the button beside this to read "is"; and enter "YES" in the last field.
6. Under "Then", choose "Move to Folder".
7. Click "click here to select a folder".
8. Click "New", enter SPAM as the folder name, select "Local Folders", and then click "OK" for each window until you get back to the main window..

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Macintosh OS X™ Filters

Macintosh OS X™'s built-in Mail program can create filters based on custom headers.

1. In the menu bar, click 'Mailbox' then 'New Mailbox' and create the mailbox you want the Spam to end up in.
2. In the menu bar, click 'Mail' then 'Preferences...'
3. Click 'Rules' then 'Create Rule'.
4. Add a description of the rule, then click the 'From' Criteria, then click 'Expert...'
5. In the Header: field enter 'X-Spam-Flag', click 'Add Header' and 'OK'
6. Now click 'From' and select 'X-Spam-Flag'. Select 'Contains' in the next box and enter 'Yes' in the third Criteria box.
7. In the Action section, check 'Transfer to mailbox' and select the desired mailbox. Click 'OK'.
8. Adjust the rule priorities if you want, and dismiss the Mail Preferences dialog box.
9. The next time you check your mail, check to see if any messages were automatically filtered into your Spam mailbox!

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Outlook Express™ for Macintosh™ Filters

The instructions are the same as for Outlook Express 4.5 and 5.x for Mac, but the menu item under Tools is called "Mail Rules" in version 4.5 and "Rules" in version 5.x. Also, there's no choice between POP/IMAP. Note: if you are sending messages found by this rule to a special mail folder, you must already have created the destination folder before you create the rule.

1. From the menu bar, choose Tools; then "Rules" or "Mail Rules" depending on your Outlook Express Version (5.x and 4.5 respectively.
2. Select POP, and then hit "new" for a new rule.
3. Under the section marked "If", choose "specific header" and then type or paste in the name of the header, which is "X-Spam-Flag".
4. Under "Contains:" type in Yes.
5. In the section marked "Then", specify an action -- move to a new folder, change its status or color, as you see fit. Note that we do not recommend simply deleting messages found by this rule.
6. The Enabled box needs to be checked in order for this rule to be active - it will be checked by default.

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Netscape™ Filtering

Netscape 6.2.1 does not allow you to create custom filters, so users of this version are unable to take advantage of the special headers used in their mail client software at this time.

Netscape 4.7.8 allows you to create a custom filter. You can supply the special x-header information to Netscape 4.7.8 by doing the following:

1. In the pull-down bar at the top of your Netscape 4.78 window, go to "Edit: Message Filters". A new window will open.
2. Click "New". Click "Advanced". A new window will open.
3. Enter "X-Spam-Flag", click "Add", and click "OK". The latest new window will close.
4. In the pull-down list, select "X-Spam-Flag".
5. In the "contains" box, enter "X-Spam-Flag: Yes".
6. In the "Perform this action" pull-down list, select "move to folder".
7. Click "new folder" and create a Spam folder. It should then be selected in the pulldown list of your folders.
8. Click OK.
9. The next time you check your mail, check to see if any messages were automatically filtered into your Spam folder!

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Microsoft Outlook 2002™ Filters

Microsoft Outlook 2002™ does not have the ability to filter spam itself, but it has filtering "rules" that we can use. The Rules Wizard will only appear in the Tools menu when the Inbox is selected, so choose the Inbox before you try to add a filter.

1. Select "Inbox" in the Folder List.
2. Click "Tools" and select "Rules Wizard".
3. Click "New" to create a new rule.
4. Check "Start from a blank rule" and select "Check messages when they arrive". Click "Next".
5. Check "with specific words in the message header".
6. In the rule description, click "specific words".
7. Under Specify a word or phrase to search for in the message header, enter "X-Spam-Flag: YES" to put spam into your "Spam" folder". Click "Add", then "OK", and finally "Next".
8. Under "What do you want to do with the message?", check "move it to the specified folder".
9. In the rule description, click "specified".
10. Under Choose a folder, click "New".
11. Enter "Spam" as the name and click "OK"
12. Select "Spam" under Personal Folders (click the plus sign to open Personal Folders if necessary) and click "OK", then click "Next" twice.
13. Click "Finish".

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Microsoft Outlook 2003™ Filters

Microsoft Outlook 2003™ includes spam filtering. Outlook will filter messages based on its own concept of spam, but you can also have it put spam messages identified by PerfectMail in your "Junk" folder.

1. Select "Inbox" in the Folder List.
2. Select "Tools" and then "Rules and Alerts".
3. View the E-mail Rules tab.
4. Click "New Rule..."
5. Check "Start from a blank rule" and select "Check messages when they arrive". Click "Next".
6. Check "with specific words in the message header".
7. In the rule description, click "specific words".
8. Under Specify a word or phrase to search for in the message header, enter X-Spam-Flag: YES to put spam in your "Junk" folder. Click "Add", then "OK", and finally "Next".
9. Under "What do you want to do with the message?", check "move it to the specified folder".
10. In the rule description, click "specified".
11. Under Choose a folder, select "Junk E-mail" and click "OK".
12. Click "Finish".

To filter e-mail flagged as spam you need to create Filter Rules. Filter rules can automatically file messages in your "Spam" or "Junk" folder. For sites that are particularly concerned about loosing e-mail, or even for specific users, you can have PerfectMail not reject any e-mail and use these filtering rules to filter messages on your local e-mail client.

The steps for creating filter rules are specific to your e-mail client. We have instructions for creating filter rules for several popular e-mail clients. The steps for other e-mail clients are likely very similar to those presented here.

How to Configure Microsoft Outlook Express™ Filters

1. Go to Tools->Message Rules->Mail...
2. Check 'Where the Message Body contains specific words'
3. Select 'Where the Message Body contains specific words '.
4. Click on 'contains specific words'.
5. Type in: X-Spam-Flag: Yes (one space between the : and the Yes)
6. Click 'Add'.
7. Click 'Ok'.
8. Select 'Move it to the specified folder'.
9. Click on 'specified'.
10. Highlight an existing folder, or create a new one.
11. Click 'Ok'.
12. Give the rule a name. (The default is New Mail Rule #1.)
13. Click 'Apply Now'. (You may or may not want to Apply Rule Now)
14. Click 'OK'.

• X-Spam-Flag: YES
• X-Spam-Level: *****

To use Distributed Filtering you must enable specific mail headers in PerfectMail. Using your web browser, log into the PerfectMail administrative interface and go to the Filter Settings page on the Actions tab (Filtering > Filter Settings :: Actions tab). Enable distributed filtering by checking/unchecking the following options:

• Reject spam: Uncheck (optional)
• Spam flag header: Check
• Spam level header: Check

Unchecking the Reject spam option is optional. With this option unchecked all spam will flow to all e-mail recipients. Another option is to leave this option checked but to disable filtering for specific users in the Domain Configuration (Domain Admin > Domains). On the Domain Configuration page click on a domain name, then click the Edit Addresses button at the bottom right of the screen. You can then disable filtering for specified users using the Address Maintenance screen.

With these settings each message will contain the e-mail headers, mentioned above, which you can use for filtering using your mail client.

E-mail Structure

E-mail is actually composed of two main elements: the envelope and the data sections. The data section is further divided into the e-mail header and e-mail body or message; which may be comprised of different alternative formats and contain embedded images and other elements; as well as e-mail attachments.

If we focus on the two main elements, the envelope and the data sections you can think of an e-mail like a conventional written letter.

The envelope contains addressing and delivery information. Your e-mail server uses the envelope to decide how an e-mail should be forwarded or delivered. It ignores the actual message.

When you view an e-mail using your mail App (e.g. Microsoft Outlook™), you are seeing the data section comprising the header and actual message; the envelope has been stripped away. Liken this action to a receptionist who has taken the letters from their envelopes, put those letters on your desk and discarded the envelopes.

Envelope Abuse

Spammers make use of the inconsistency between the envelope and the header to try and side-step spam filters. They do many things to push the boundaries of what is acceptable in e-mail. This is why you can receive emails that look like they were addressed to someone else, or no-one at all. In fact, you can put any e-mail address in the header!

So why don't we just block this sort of e-mail? Unfortunately, many legitimate e-mail clients also push the boundaries of what is acceptable in e-mail and the spammers take advantage of these issues. Also, this technique is commonly used by distribution lists and newsletters. You may often see text such as "undisclosed-recipients". This technique is so widely used that we cannot block these sorts of messages.

(PerfectMail™ adds a score for mismatches between the e-mail envelope and message headers, but this alone is not enough to reject a message.)

E-Mail Addresses and Delivery

The envelope is used, and only used, for message delivery, just like a written letter.

The e-mail header is made up of what we like to think of as the delivery information: the From, To, Subject, Date, etc. But this simply is not the case. The delivery information is contained in the envelope, which has been discarded. The header information is simply information displayed as a courtesy to the recipient.

The information in the envelope and the header are completely unrelated! For legitimate messages the header will contain the original delivery information, but this is simply not something that is enforced.

When an e-mail message is sent between two mail servers, the sending server contacts the receiving server to begin a negotiation. Part of that negotiation is how the message will be sent by the sender to the receiver. The two domains start by trying to negotiate an encrypted connection using TLS/SSL. If the two servers fail to negotiate an encrypted connection, they will negotiate a plain text connection. The e-mail is sent once an encrypted or plain text connection has been negotiated.

The behavior between PerfectMail™ and domains listed in the Force Encrypt table begin in the same manner as normal e-mail exchange. However, if the mail server hosting the external domain fails to negotiate an encrypted connection, PerfectMail will not allow the unencrypted message to be sent. The sender will receive an SMTP response message indicating that the message could not be sent.

It is possible for third parties to "listen in" on traffic between e-mail servers (domains). An e-mail that is sent in plain text provides no privacy for the sender or the receiver. If you have particularly sensitive data (e.g. financial or personal) that is regularly exchanged with a particular domain, you should have PerfectMail™ enforce an encrypted connection for all e-mail transmissions concerning that domain.

To force encrypt e-mail traffic with an external domain; enter the domain, one entry per line, in the Force Encrypt Table of the PerfectMail user interface (Domain Admin => Force Encrypt). You may use domain names, IP addresses and IP address ranges.

For example:

their_domain.com
204.10.243.26
207.219.44.0/24

Resolvable Hostname Issues

A server's hostname is the name that it knows itself as. This is different than naming in DNS or any other mechanism. It is the locally defined name.

Your PerfectMail product must have a resolvable, fully qualified hostname; e.g. perfectmail.mydomain.com. There must be a domain portion to the hostname of your PerfectMail server.

This hostname must be resolvable in DNS. Mail servers will look-up server names in DNS as a validation mechanism. Not having a resolvable hostname can cause problems.

If this is not possible to use resolvable DNS names you can use the .localdomain domain; e.g. perfectmail.localdomain.

The PerfectMail configuration scripts try to mitigate the creation of partial hostnames by appending all single word hostnames (e.g. "myhost") with the ".localdomain" top-level-domain (e.g. "myhost.localdomain"). The ".localdomain" top-level-domain is "known" and will not be validated against DNS.

Unique Hostname Issue

Your PerfectMail hostname must be unique. Often, mail servers will refuse to relay e-mail through mail servers with the same hostname. This is done to prevent endless e-mail delivery loops.

DNS Issues

PerfectMail absolutely needs to be able to perform DNS resolution. PerfectMail will refuse to accept e-mail from domain names that do not exist in the DNS space. If DNS is not resolvable then e-mail will not flow.

DNS is also used for a number of validation tests including look-ups on many RBL sites. Not having the ability to perform DNS look-ups severely impairs PerfectMail's ability to filter e-mail.

Server Resources

Memory constraints are the most likely cause of server problems. PerfectMail must have sufficient resources (i.e. memory, CPU and disk) to run. If the server uses all memory and swaps to disk the system performance will slow down significantly. If your server appears to be running slow, check the memory usage and add memory as appropriate.

If the hard disk becomes full PerfectMail will stop accepting e-mail. A nightly script prunes old data to ensure a safe amount of free disk to prevent this from happening.

When the "load average" of the server is greater than 12 (i.e. 12 processes waiting for the CPU) our Mail Tranpsort Agent (MTA) will stop accepting new e-mail connections. This behavior prevents the PerfectMail server from crashing. With a high server load your server is not realistically able to process mail in any case as pushing the load average past 12 can put the server in an unresponsive state.

In any case, if your server is performing sub-optimally, you will likely need to review your resource usage and increase resources as appropriate. PerfectMail provides reports on its web interface to assist you with this assessment. Please refer to the following reports:

• Reports => E-mail Activity
• Reports => Resource Usage
• Server Admin => Archive

It is best to create a one-to-one NAT mapping port 25 on the Internet facing IP address and your PerfectMail product. Problems can arise when the incoming SMTP IP address and the outgoing SMTP IP address do not match. In this situation incoming SMTP traffic is properly configured, however the outgoing SMTP traffic is sent on an unexpected port (usually the default outgoing IP address is used).

When sending e-mail to the Internet remote anti-spam servers will verify the domain name, hostname and reverse address of the sending IP address against your DNS records. Often the DNS records are not configured to support the default outbound IP address.

Anti-spam servers will compare the name reported by the server itself (i.e. the hostname), the address record (A record) from DNS and the reverse DNS record (PTR record). Anti-spam servers will score and possibly even reject messages for discrepencies between these records. This is further complicated by firewall port forwarding issues. The best way is if you have a 1-1 NAT for your e-mail so both incoming and outgoing mail use the same IP number. Failing that the names should all match up on the outgoing side of things.

We strongly recommend updating your firewall to restrict all outgoing SMTP (port 25) traffic. Only PerfectMail and other mail servers should be able to send e-mail directly to the Internet. PC's compromised by viruses, Trojans, etc. may send e-mail directly to the Internet which may result in your entire organization being blacklisted by RBL sites such as Spamhaus. (Especially if you have only one Internet facing IP address.)

Following are two examples of how to configure PerfectMail within your firewalled infrastructure.

Firewall Configuration: Green Zone + Internet

If you have a simple firewall configuration, with your internal network (Green Zone) being protected from the Internet, place your PerfectMail product in the internal network (Green Zone) and configure your firewall to allow the following network traffic.

Incoming Ports:

Port	Type	Protocol	Description
25	TCP	SMTP	Port forward to Perfectmail for incoming e-mail
443	TCP	HTTPS	Port forward to Perfectmail for remote secure web access (optional)
22	TCP	SSH	Port forward to Perfectmail for technical support (optional)

[Note: Using non-standard ports for support access (i.e. SSH and HTTPS) is acceptable as long as these are port forwarded to the appropriate ports on the PerfectMail server.]

Outgoing Ports:

Port	Type	Protocol	Description
25	TCP	SMTP	For outgoing e-mail
53	TCP/UDP	DNS/BIND	For DNS look-ups and testing
80	TCP	HTTP	For website probing
123	UDP	NTP	For remote Network Time Protocol look-ups
443	TCP	HTTPS	For website probing
43, 4321	TCP	whois, rwhois	For WhoIs queries

Firewall Configuration: Green Zone + DMZ + Internet

If you have a firewall configuration that includes a DMZ, with your internal network (Green Zone) being protected from the Internet, place your PerfectMail product in the DMZ network and configure your firewall to allow the following network traffic.

Between Internet and the DMZ - Incoming Ports:

Port	Type	Protocol	Description
25	TCP	SMTP	Port forward to Perfectmail for incoming e-mail
443	TCP	HTTPS	Port forward to Perfectmail for remote secure web access (optional)
22	TCP	SSH	Port forward to Perfectmail for technical support (optional)

[Note: Using non-standard ports for support access (i.e. SSH and HTTPS) is acceptable as long as these are port forwarded to the appropriate ports on the PerfectMail server.]

Between Internet and the DMZ - Outgoing Ports:

Port	Type	Protocol	Description
25	TCP	SMTP	For outgoing e-mail
53	TCP/UDP	DNS/BIND	For DNS look-ups and testing
80	TCP	HTTP	For website probing
123	UDP	NTP	For remote Network Time Protocol look-ups
443	TCP	HTTPS	For website probing
43, 4321	TCP	whois, rwhois	For WhoIs queries

Between the DMZ and the Green Zone - Incoming Ports, to Green Zone:

Port	Type	Protocol	Description
25	TCP	SMTP	Port forward to mail server for incoming e-mail
53	TCP/UDP	DNS/BIND	For DNS look-ups and testing (unless DNS server is in DMZ)
123	UDP	NTP	For Network Time Protocol (unless time server is in DMZ)

Between the DMZ and the Green Zone - Outgoing Ports, from Green Zone:

Port	Type	Protocol	Description
25	TCP	SMTP	For outgoing e-mail
443	TCP	HTTPS	For PerfectMail Web-UI secure access
80	TCP	HTTP	For PerfectMail Web-UI access (optional)

In Exchange 2003, it's possible to configure a smart host on the Default SMTP Virtual Server, but if you do it this way you can only set a single smart host. The preferred method, therefore, is to use an SMTP Connector for your outgoing emails which does allow multiple smart hosts to be specified.

Following are the steps to have Microsoft Exchange 2003™ System deliver outbound mail via a Smart Host:

1. Open up the Microsoft Exchange System Manager (Start > Programs > Microsoft Exchange > System Manager);
2. Expand "Administrative Group", <Your Groupname>, you may have more than one, "Servers", <SERVER NAME>, "Protocols", "SMTP", "Default SMTP Virtual Server";
3. Right-click on "Default SMTP Virtual Server" and select Properties;
4. Click on "Delivery" tab and select the "Advanced" button;
5. Enter the Address of the hosting PM for the "Smart Host" field. You can specify the IP Address e.g.. [192.168.3.44] (using the square brackets) or use a FQDN "yourhost.yourdomain.com" (without the quotes);
6. Click on "Apply", then "OK" for all cascading windows.

These changes should take place on the fly, there is no need to restart the Exchange services.

Note that the above procedures assumes that you have a straight-forward Exchange system in place with pre-defined Exchange Routing Groups in place and that there is only one Exchange system within your organization. If you have an Exchange environment consisting of a Front-End system and a Back-End system, then the above needs to be applied on the Back-End system only.

Alternatively, you may decide to use a connector which routes email, rather than an SMTP virtual server:

1. Open up the Microsoft Exchange System Manager (Start > Programs > Microsoft Exchange > System Manager);
2. Right-click on {Your Exchange Server} and select Properties;
3. Make sure the checkbox Display routing groups is checked;
4. Right Click "First Organization";
5. Locate the folder: Administrative Groups/{Your_Administrative_Group}/Routing Groups/{Your_Routing_Group}/Connectors;
6. Right-click Connectors, select New, and then click SMTP Connector;
7. Fill in the Name field;
8. In the Smart host box, type the hostname or IP address (wrapped in square brackets [ ]) of the smart host server and select the local bridgehead (usually your mail server);
9. Select the Address Space tab, typical settings are "SMTP" and select (*).

If the above procedures do not work for you and you have restarted the Exchange services (or rebooted the Exchange Server) then there is a possibility that you may have a custom Routing group defined with a custom SMTP connector for all SMTP Address Spaces and SMTP connector configurations within the Routing Group section take precedence over the default virtual SMTP protocol configurations within the Protocols section.

Microsoft Exchange™ 2007/2010

For Exchange 2007/2010 configure a default relay host (smarhost) by creating a Send Connector. With Exchange 2007/2010, Microsoft has separated the mail server roles. The Hub Transport role is responsible for sending and receiving external email. In a single Exchange server environment, the same server will perform all roles.

1. Open the Exchange Management Console;
2. Expand the Organization Configuration (click on the "+" next to Organization Configuration);
3. Select Hub Transport, then the Send Connectors tab;
4. Right-click on the existing Send Connector;
5. Select Properties, then the Network tab;
6. Select "Route mail through the following smart hosts:" and click Add;
7. Enter the IP address of your smarthost relay server.
8. Click OK.

Once you click OK the changes will take effect immediately.

The envelope contains the addressing/delivery information. Your mail server looks at the envelope to decide where the e-mail should go, but will ignore the actual e-mail content. The actual e-mail content contains the e-mail headers (including From: To: Subject:, etc), message body and any attachments.

Your e-mail client displays only the actual e-mail content; the envelope has been stripped away. Liken this to a receptionist taking your letters from their envelopes, putting those letters on your desk and throwing away the envelopes.

This is why you can receive emails that look like they were addressed to someone else or no-one at all. If you received the e-mail, then be assured your e-mail address appeared on the envelope.

Why don't we just block all of this type of e-mail? Well, this technique is commonly used by distribution lists and newsletters. You may often see text such as "undisclosed-recipients". This technique is so widely used that we cannot block these sorts of messages.

In this situation, your mail server has refused the e-mail because it cannot identify the sender's domain (e.g. example.com) as a valid registered domain name. This is a common practice across most mail servers.

There may be a problem with the senders domain. More likely, there may be a DNS issue at your site.

Sometimes this sort of thing occurs when domains are moved from one ISP to another. You can get an inconsistent view of DNS where the Internet as a whole has one view of DNS, while a particular ISP (and all it's clients) get another view.

I recommend speaking with your technical support team. Get them to see what happens if they try DNS resolution for the senders domain on their e-mail server.

Also, this may have been a temporary issue that has since been resolved. If that's the case the technical support team won't see anything wrong. Try sending the message again to see if the issue has been resolved.

PerfectMail has anti-spoof settings to help prevent this sort of abuse. On the user interface, go to the Filter Settings page  Filters > Filter Settings > Sender  tab. There are three options available:

• Verify e-mail address - Verify the existence of e-mail addresses from hosted domain, but coming from the outside.
• Block self sent e-mail - Block all e-mail from the outside that is reportedly from a hosted domain.
• Block all - Block all e-mail from the outside that is reportedly from a hosted domain.

The best way to block this sort of thing is using Sender Policy Framework (SPF). SPF is implemented as a DNS entry for your domain. It specifies what hosts are valid for sending mail for your domain. Any other host should be considered a hoax.

You can get more information on crafting an SPF Record by going to http://www.openspf.org/. On this page there is a section called "Deploying SPF", with a web form for crafting an SPF record (currently set to example.com). Use this to craft an SPF record for your domain.

Many e-mail hosts and even anti-spam filters are not making use of SPF records, so there will always be a number of false messages being delivered; but this is the best method available to us at this time.

The best way to block this sort of thing is using Sender Policy Framework (SPF). SPF is implemented as a DNS entry for your domain. It specifies what hosts are valid for sending mail for your domain. Any other host should be considered a hoax.

You can get more information on crafting an SPF Record by going to http://www.openspf.org/. On this page there is a section called "Deploying SPF", with a web form for crafting an SPF record (currently set to example.com). Use this to craft an SPF record for your domain.

Many e-mail hosts and even anti-spam filters are not making use of SPF records, so there will always be a number of false messages being delivered; but this is the best method available to us at this time.

There are numerous schemes for performing mailhost verification checks and none of them have a high acceptance rate. So this continues to be an ongoing problem.

Here are the most common reasons along with suggestions on how to fix the problem:

• You may be receiving e-mail from unprotected mail accounts. It is quite common for people to have multiple e-mail accounts. Modern mail clients (e.g.: Outlook) can poll for mail from many sources and consolidate it into a single in-basket. PerfectMail will block Spam from your protected accounts but not from unprotected accounts. If all of your e-mail accounts are on local servers, then you can solve the problem in one of 2 ways:
  
  1. Be sure that PerfectMail filtering is configured for all of your domains. To do this, create domain records in PerfectMail for all local mail servers and all of their respective domains. Be sure to indicate that each domain has filtering enabled (Domains > Your Domain > Filtering Enabled is checked).
     
  2. Ensure that all mail is directed to your PerfectMail server. This may involve updating DNS mail exchanger (MX) records so that they direct mail to your new PerfectMail server or changing the SMTP port forwarding rules at your firewall to direct all traffic to your PerfectMail appliance.
     
• You may be receiving e-mail from remote mail servers. PerfectMail can only protect e-mail traffic directed to local mail servers. Often people use a mix of e-mail accounts on both local and remote mail servers. PerfectMail cannot protect remote mail servers or popular Web based mail services like HotMail, MSN or Yahoo Mail.
• You may have insecure mail relays. PerfectMail can be told to accept all e-mail from a trusted source. If this trusted mail server also accepts mail from the Internet, then you are providing a back door through which Spam may arrive. To solve this problem, ensure that your internal trusted mail relays do not accept e-mail directly from the Internet. Stated another way, all internal relays must be outbound only mail relays, not inbound mail relays.
• Spammers may continue to use your old IP address. A common implementation strategy is to provide PerfectMail with a new IP address and then redirect e-mail to the new address via DNS MX record updates. This strategy works well for legitimate senders but may result in no immediate decrease in Spam.
  
  Our research has shown that Spam engines do not do DNS queries for each message they send. Instead, they query DNS once and then remember (cache) the answer - sometimes for months. Since DNS queries take time and mail servers rarely change IP addresses, caching IP addresses helps Spammers send out much higher volumes of junk mail.
  
  Often the old IP address is still a legitimate pathway to your mail server. If true, and spammers have cached your mail servers' IP address, then Spam will continue to show up in your inbox.
  
  You can solve this problem by migrating all of your domains to PerfectMail as quickly as possible. Once this is done, configure your firewall to shut down mail handling on the old IP address.
  
  Another solution is to configure your local mail server so that protected domains may only communicate with the mail server from the IP address assigned to PerfectMail (as that is their only legitimate pathway). The local mail server should not accept SMTP traffic for protected domains directly from the firewall.

The "may be forged" mail tag is an artifact of the sendmail MTA.

Example/Explanation:

Spammers can spoof DNS domains via PTR records. In DNS validation of data is implicit in the lookup process. When you do a DNS lookup of "example.com" (A record) you are directed to the Name Servers for "example.com"; they are inherently valid servers. No validation is performed or implied on the responses the Names Servers provide. 

Similarly, when you do a Reverse DNS lookup of an IP address (e.g. 204.10.243.99), you are directed to the Name Servers for "204.10.243", and no validation/verification is performed on the responses.

The Name Server easily can say 204.10.243.99 is secure.yourbank.com. The only way to validate this result is to perform a DNS lookup of the PTR result (e.g. secure.yourbank.com) and confirm that the IP address is listed. If it is not listed you may be in a situation where the PTR record is a spoof/forged!

It is best practice to maintain the referential integrity of your DNS A and PTR records. Unfortunately it is quite common for these records to not be fully matched.

Sometimes spam and delivery notification messages will get stuck in the queue as well. Spammers send a lot of e-mail, but rarely accept return e-mail, including bounce messages. These messages can get stuck in the queue. PerfectMail™ has automated processes that clean out such messages on an hourly basis.

Unsolicited means that the Recipient has not granted verifiable permission for the message to be sent. Examples include: first contact inquiries, job inquiries, sales inquiries, etc.

Bulk means that the message is sent as part of a larger collection of messages, all having substantively identical content. Examples include: subscriber newsletters, customer communications, discussion lists, etc.

The technical definition states a message is spam only if it is both unsolicited and bulk.

Spam is an issue about consent, not content. Whether the UBE message is an advert, a scam, porn, a begging letter or an offer of a free lunch, the content is irrelevant; if the message was sent unsolicited and in bulk then the message is spam.

Spam is not a subset of UBE. It is not "UBE that is also a scam or that does not contain an unsubscribe link". All email sent unsolicited and in bulk is spam.

This distinction is important because legislators spend inordinate amounts of time attempting to regulate the content of spam messages, and in doing so come up against free speech issues.

Important facts relating to this definition:

1. The sending of Unsolicited Bulk Email ("UBE") is banned by all legitimate Internet service providers worldwide.
2. Real-time Block Lists are used by hundreds of millions of Internet users to reject emails identified as spam. These lists are based on the internationally accepted definition of spam as unsolicited bulk email. Therefore anyone sending UBE on the Internet, regardless of whether the content is commercial or not, illegal or not, needs to be fully aware that they will lose their Internet access if they send UBE and they will be placed on the Real-time Block Lists.
3. All a spammer has to do is GET YOUR PERMISSION and they can spam you with impunity.

The last point above is currently a huge issue. All the spammers have to do is to get your e-mail address and permission, then they can spam you with impunity. At PerfectMail™ we call these spammers "industrial spammers" or "spamvertizers". They are by far the biggest problem we are now encountering.

While they technically gain impunity by skirting the law, at PerfectMail™ we expand our definition of spam to include messages where the sender attempts to hide who they are or where they are coming from.

Spammers are so effective at harvesting e-mail addresses from websites that some people report receiving spam on their website published e-mail address in as little as 8 hours from the time the e-mail address is first posted to the site. It is because of aggressive website e-mail harvesting that many people believe that it is no longer practical to publish your e-mail address on your company or personal website.

PerfectMail™ is so effective, you can safely publish your e-mail address on your web site.

Surprisingly, an effective way to defend against spam is to give Spammers exactly what they want! PerfectMail includes a feature aptly called Spam Traps. Spam Trap accounts are e-mail addresses that are used to trick Spammers into identifying themselves.

The Spam Trap strategy is simple; create a bogus e-mail account, hide that account on your website, let Spammers harvest the bogus address from your website and then block all e-mail traffic that includes the Spam Trap e-mail addresses in a message's recipient list.

PerfectMail's spam trap feature looks for pre-defined Spam Trap e-mail addresses in the recipient list of every in-bound message. If a Spam Trap e-mail address is found in the recipient list, PerfectMail will:

1. Quietly removes all legitimate e-mail addresses from the recipient list (so legitimate users don't receive spam).
2. Adds or updates its reputation system to mark the sender as a Spam Trap spammer.
3. All the real recipient e-mail addresses are rejected to encourage them to "prune" your valid e-mail addresses from their lists.
4. All the spam trap e-mail addresses are accepted to encourage the spammers to keep using them.
5. Silently discards the message.

This strategy is effective because it gives PerfectMail notice when a spammer is targeting your server.

PerfectMail™ performs recipient filtering on incoming e-mail based on it's list of known e-mail addresses. Under normal operation, PerfectMail uses a progressive scheme that selectively queries your mail server to build a local database of known e-mail addresses.

To support this functionality, it is important that recipient filtering is enabled on your mail server. There are notes in the reference section for enabling this in Microsoft Exchange™ (which has this feature disabled by default.) If recipient filtering is disabled PerfectMail will receive responses that make it look like all e-mail addresses are valid on your mail server.

If recipient filtering cannot be enabled on your mail server, you need to disable this feature in PerfectMail's Domain Admin pages.

PerfectMail uses a US DoD compliant process for scrubbing and removing e-mail messages.

DoD 5220.22-M(ECE) is a seven pass overwriting wipe standard: first and second passes - with certain bytes and with its compliment, then two passes with random character, then two passes with character and its complement and the last pass - with random character.

Enable File Scrubbing by the following steps:

1. Enable the feature on: Server Admin => Server Settings, Other tab; enable e-mail shredding and deletion.
2. Give permission to a user to Shred/Delete a message on: Server Admin => Users; select a user; Permissions tab; enable Shred/Delete messages.
3. Now you can Shred/Delete messages in the E-mail Activity pages.
4. A log entry of the deletion is made on: Server Admin => Audit Log and a record of the message remains in the activity log; but all content is scrubbed and removed.