About this Help

This document provides help on configuring and using the web interface of Kaspersky Secure Mail Gateway.

This Help document is designed for administrators of local area networks and for specialists who are responsible for anti-virus protection of enterprise computers.

This Help document is intended to:

• Provide a readily searchable source of information for questions related to use of the application.
• Describe additional sources of information about the application and ways of receiving technical support.

   

In this Help

Help includes the following sections:

Sources of information about the application

This section lists the sources of information about the application.

Kaspersky Secure Mail Gateway

This section contains a brief overview and description of the functionality of the Kaspersky Secure Mail Gateway solution. This section describes the modes of operation of Kaspersky Secure Mail Gateway, hardware and software requirements.

Application licensing

This section covers the main aspects of application licensing.

Mail server protection status

This section contains information about how to check the level of protection of the mail server and related problems.

Participating in Kaspersky Security Network

This section provides information about participation in Kaspersky Security Network.

Deploying the Kaspersky Secure Mail Gateway virtual machine image

This section provides step-by-step instructions for deploying the image of the Kaspersky Secure Mail Gateway virtual machine on a VMware ESXi host.

Initial configuration of Kaspersky Secure Mail Gateway

This section contains step-by-step instructions on initial configuration of Kaspersky Secure Mail Gateway, which you have to perform after deploying the image of a Kaspersky Secure Mail Gateway virtual machine.

Starting the Kaspersky Secure Mail Gateway virtual machine

This section describes how you can start the Kaspersky Secure Mail Gateway virtual machine.

Connecting to the Kaspersky Secure Mail Gateway web interface

This section provides instructions on connecting to the web interface of Kaspersky Secure Mail Gateway.

Integrating Kaspersky Secure Mail Gateway into the corporate mail infrastructure

This section provides instructions on how to integrate Kaspersky Secure Mail Gateway into the corporate mail infrastructure.

Configuring MTA settings

This section describes how you can configure the basic settings of the MTA.

Kaspersky Secure Mail Gateway Monitoring

This section provides information on mail traffic monitoring, the latest threats detected, and system resources.

Kaspersky Secure Mail Gateway database update

This section contains information about updating Anti-Virus, Anti-Spam, and Anti-Phishing databases.

Upgrading Kaspersky Secure Mail Gateway via the web interface

This section describes how you can upgrade Kaspersky Secure Mail Gateway via the web interface.

Anti-Virus protection

This section contains information about Anti-Virus protection of messages and how to configure it.

Anti-Spam protection

This section contains information about Anti-Spam protection of messages and how to configure it.

Anti-Phishing protection

This section contains information about Anti-Phishing protection of messages and how to configure it.

Content filtering of messages

This section contains information about content filtering of messages and how to configure it.

Using message processing rules

This section contains information about message processing rules, information on how to configure rule settings and configure Kaspersky Secure Mail Gateway settings for each message processing rule.

Connecting to an LDAP server

This section describes how you can connect Kaspersky Secure Mail Gateway to an LDAP server and configure the LDAP server connection settings and filters.

Kaspersky Secure Mail Gateway email notifications

This section contains information about Kaspersky Secure Mail Gateway email notifications and how to configure them.

Kaspersky Secure Mail Gateway disclaimers and warnings

This section contains information about Kaspersky Secure Mail Gateway disclaimers and warnings and instructions on how to configure them.

Backup

This section contains information about Backup and how to use it.

Message authentication

This section describes the message authentication technologies used by Kaspersky Secure Mail Gateway and provides instructions on how to configure message authentication.

SMTP verification of recipient email addresses

This section contains information about SMTP authentication of message recipients and how to configure it.

DKIM signature for outgoing messages

This section provides instructions on adding a DKIM signature to outgoing messages.

Using the application via the SNMP protocol

This section provides instructions on using the application via the SNMP protocol and configuring traps for events that occur during operation of Kaspersky Secure Mail Gateway.

Kaspersky Secure Mail Gateway event log

This section contains information about the event log and how to configure it.

Kaspersky Secure Mail Gateway operation reports

This section provides instructions on creating and viewing Kaspersky Secure Mail Gateway operation reports.

Black and white lists of addresses

This section contains information about black and white lists of email addresses that you can create and edit in Kaspersky Secure Mail Gateway.

Using the TLS protocol in the operation of Kaspersky Secure Mail Gateway

This section contains information about using the TLS protocol in the operation Kaspersky Secure Mail Gateway and instructions on how to configure the protocol usage settings.

Kaspersky Secure Mail Gateway message queue

This section contains information about Kaspersky Secure Mail Gateway message queues.

Kaspersky Secure Mail Gateway trace log

This section contains information about the Kaspersky Secure Mail Gateway trace log.

Contacting the Technical Support Service

This section describes the ways to get technical support and the terms on which it is available.

Glossary

This section contains a list of terms mentioned in the document and their definitions.

AO Kaspersky Lab

This section provides information about AO Kaspersky Lab.

Information about third-party code

This section provides information about the third-party code used in the application.

Trademark notices

This section lists trademarks of third-party manufacturers that are used in the document.

Index

This section allows you to quickly find the required information within the document.

Document conventions

This document uses the following conventions (see table below).

Document conventions

Page top

Sources of information about the application

This section lists the sources of information about the application.

You can select the most suitable information source, depending on the issue's level of importance and urgency.

Sources of information for independent research

You can use the following sources to find information about the application:

• Application page on the Kaspersky Lab website.
• Application page on the Technical Support website (Knowledge Base).
• Kaspersky Secure Mail Gateway web interface help. The web interface lets you manage Kaspersky Secure Mail Gateway through a browser.
• Documentation.

If you cannot find the solution to an issue on your own, we recommend that you contact Technical Support at Kaspersky Lab.

An Internet connection is required to use information sources on the Kaspersky Lab website.

Application page on the Kaspersky Lab website.

The Kaspersky Lab website features an individual page for each application.

On the application page, you can view general information about an application, its functions and features.

The application's Knowledge Base page at the Technical Support Service website.

Knowledge Base is a section on the Technical Support website that provides advice on using Kaspersky Lab applications. The Knowledge Base comprises reference articles grouped by topics.

On the page of the application in the Knowledge Base, you can read articles that provide useful information, recommendations, and answers to frequently asked questions on how to purchase, install, and use the application.

Articles may provide answers to questions that are out of scope of Kaspersky Secure Mail Gateway, being related to other Kaspersky Lab applications. They also may contain news from the Technical Support Service.

Web interface help

Help provides information on managing protection, configuring the application, and performing common user tasks using the web-interface of Kaspersky Secure Mail Gateway (hereinafter the "web interface").

Documentation

The distribution kit includes the Kaspersky Secure Mail Gateway Deployment Guide that will help you install the application and perform initial configuration of the application settings.

Discussing Kaspersky Lab applications on the forum

If your question does not require an immediate answer, you can discuss it with the Kaspersky Lab experts and other users in our forum.

In this forum you can view existing topics, leave your comments, create new topics.

Kaspersky Secure Mail Gateway

This section contains information about the Kaspersky Secure Mail Gateway.

About Kaspersky Secure Mail Gateway

Kaspersky Secure Mail Gateway lets you deploy a virtual mail gateway and integrate it into the existing corporate mail infrastructure. An operating system, mail server, and Kaspersky Lab anti-virus application are preinstalled on the virtual mail gateway.

Kaspersky Secure Mail Gateway protects incoming and outgoing email against malware and spam and performs content filtering of messages.

Kaspersky Secure Mail Gateway:

• Scans incoming and outgoing email for spam, phishing, and malware. To respond to new threats promptly, Kaspersky Secure Mail Gateway protection components can use information from Kaspersky Security Network.
• Detects infected messages and disinfects attachments.
• Filters messages with links to malicious objects.
• Detects and blocks mass mailing (including marketing mail-outs).
• Saves backup copies of messages in Backup based on the verdicts of Anti-Virus, Anti-Spam, Anti-Phishing modules and Content filtering.
• Saves messages from Backup to file and delivers messages to recipients.
• Processes mail in accordance with the rules defined for groups of senders and recipients.
• Performs content filtering of messages by the name, type and size of attachment (Kaspersky Secure Mail Gateway can determine the actual format and type of attachment regardless of its extension).
• Lets you use mail filtering rules to specify users and user groups from Microsoft Active Directory and generic LDAP to enable message routing for certain email accounts and user groups.
• Notifies the sender, recipients, and administrator about messages containing objects that are infected, suspicious, password-protected, or cannot be scanned.
• Updates Anti-Virus, Anti-Spam, and Anti-Phishing databases from Kaspersky Lab update servers or custom resources (http and ftp servers) according to schedule or on demand.
• Receives application runtime statistics via the SNMP protocol and lets you configure the application to send SNMP traps when certain events occur.
• Lets you configure the settings and manage the application via a web interface.
• Sends and receives messages via a secure TLS/SSL link.
• Lets you verify the authenticity of senders using SPF, DKIM, and DMARC technologies.
• Lets you sign outgoing email messages with DKIM signatures.
• Lets you add notes to incoming and outgoing messages.
• Adds dangerous attachment warnings to incoming messages.
• Retrieves user information from various domains and grants users access to a personal Backup storage.
• Lets you add, edit or delete information about domains (including local domains) and email addresses, configure Kaspersky Secure Mail Gateway settings for these domains and email addresses and configure email routing.
• Lets you configure TLS security modes for situations when Kaspersky Secure Mail Gateway receives messages from another server (acts in the Server role) or sends messages to another server (acts in the Client role), as well as configure TLS settings for individual domains.
• Lets you monitor the status of email traffic and usage of system resources and view lists of the latest detected threats in the web interface of the application.
• Lets you monitor the program operating capacity via Kaspersky Security Center.
• Lets you view the application event Log and download it to the hard drive.
• Lets you upgrade the system via the web interface of Kaspersky Secure Mail Gateway.
• Lets you quickly configure the MTA using the Quick MTA Setup Wizard.
• Lets you add, change and delete TLS and DKIM encryption keys.
• Lets you generate and view reports on the email message processing rules.

Kaspersky Secure Mail Gateway is distributed in the virtual machine template format OVA (Open Virtual Appliance).

Deployment of the template creates a virtual machine with a preinstalled CentOS 6.7 operating system, a mail server, and Kaspersky Security for Linux Mail Server application (hereinafter also referred to as "Kaspersky Security"). After deploying the virtual machine, you can configure it using the Initial Configuration Wizard.

Kaspersky Secure Mail Gateway interface

Kaspersky Secure Mail Gateway is managed using a web interface.

The web interface window contains the following items:

• The management console tree in the left part of the application web interface window
• The workspace in the right part of the application web interface window

Kaspersky Secure Mail Gateway management console tree

The management console tree displays the sections of Kaspersky Secure Mail Gateway and subsections of functional components of Kaspersky Secure Mail Gateway.

Kaspersky Secure Mail Gateway management console tree displays the following sections:

• Monitoring – a section containing Kaspersky Secure Mail Gateway monitoring data.
• Rules – a section containing message processing rules.
• Domains – a section in which you can add, edit or delete information about domains and email addresses, configure Kaspersky Secure Mail Gateway settings for these domains and email addresses.
• Encryption Keys – a section in which you can add, edit or delete DKIM and TLS encryption keys.
• Backup – a section containing information about message Backup and a filter for finding messages in Backup.
• Message Queue – a section containing information about the message queue of the MTA mail agent and a filter for finding messages in the queue.
• Reports – a section containing reports on the operation of the mail server.
• Settings – a section that lets you configure Kaspersky Secure Mail Gateway settings.
• Quick MTA Setup is a setup wizard that configures the main MTA settings. You can use it to quickly integrate Kaspersky Secure Mail Gateway into your corporate mail infrastructure at the first startup of the Kaspersky Secure Mail Gateway web interface as well as redefine the MTA settings during subsequent startups of the Kaspersky Secure Mail Gateway web interface.

  After you complete all steps of the Quick MTA Setup, Kaspersky Secure Mail Gateway resets all values of MTA setting and replaces them with values that you specified in the Quick MTA Setup Wizard.

Workspace of the Kaspersky Secure Mail Gateway web interface window

The workspace contains information about the sections that you select in the management console and control elements for editing the application settings.

Settings in the workspace of the main window are grouped into settings groups for sections that let you manage Kaspersky Secure Mail Gateway settings.

Hardware and software requirements

Software requirements for deploying the Kaspersky Secure Mail Gateway virtual machine image

An image of the Kaspersky Secure Mail Gateway virtual machine can be deployed on the following hypervisors:

• VMware ESXi 5.5 Update 2.
• VMware ESXi 6.0.

Hardware requirements for deploying the Kaspersky Secure Mail Gateway virtual machine image

To support deployment of the Kaspersky Secure Mail Gateway image, the resources allocated for the virtual machine must meet the following requirements:

• E1000 network adapter
• Available disk space: at least 100 GB
• At least 4 GB of RAM
• One quad-core processor

Software requirements for managing Kaspersky Secure Mail Gateway via the web interface

To run the web interface, one of the following web browsers must be installed on the computer:

• Mozilla Firefox version 38.0.5 (39) or later
• Internet Explorer version 11 or later
• Google Chrome version 43 or later

Distribution kit

The application is available from online stores of Kaspersky Lab (for example, http://www.kaspersky.com, in the eStore section) and from partner companies.

The content of the distribution kit may differ depending on the region in which the application is distributed.

If Kaspersky Secure Mail Gateway is purchased through an online store, the application is copied from the store's website. Information that is required for activating the application will be sent to you by email after your payment has been received.

Modes of operation of Kaspersky Secure Mail Gateway

Kaspersky Secure Mail Gateway can run in normal mode, limited traffic mode, or certified mode.

In normal mode, Kaspersky Secure Mail Gateway is allowed to access the Internet and connect to the following servers outside the IT infrastructure of your organization:

• KSN database update servers
• DNS servers
• Kaspersky Secure Mail Gateway database update servers.

In limited traffic mode, Kaspersky Secure Mail Gateway is not allowed to access the Internet and connect to servers outside the IT infrastructure of your organization.

In limited traffic mode, the settings of Kaspersky Secure Mail Gateway components that require Internet access take the following values by default:

• KSN usage is disabled.
• SPF, DKIM, and DMARC message authentication is disabled. Connection to DNS servers is prohibited.
• The Enforced Anti-Spam Updates service is disabled in the settings of the Anti-Spam component.
• Kaspersky Secure Mail Gateway receives database updates from Kaspersky Security Center or a local source of Kaspersky Secure Mail Gateway database updates.

In certified mode, Kaspersky Secure Mail Gateway is not allowed to access the Internet and connect to servers outside the IT infrastructure of your organization. Besides, when Kaspersky Secure Mail Gateway operates in certified mode, the administrator is not allowed to view the event Log from the administrator's menu of Kaspersky Secure Mail Gateway Administration Console.

You can select the certified mode of operation of Kaspersky Secure Mail Gateway when deploying the image of a Kaspersky Secure Mail Gateway virtual machine.

Kaspersky Secure Mail Gateway traffic limit

To switch Kaspersky Secure Mail Gateway to limited traffic mode:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the External services section, click the KSN Statement link to open the KSN Statement window.
3. Select Do not accept.
4. Click the Apply button.

   The KSN Statement window closes.

5. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
6. In the External services section, click the Allow connection to DNS server link to open the External services window.
7. In the list to the right of the name of the Allow connection to DNS server setting, select No.
8. Click the Apply button.

   The External Services window closes.

9. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
10. In the Application database update settings section, click the Update source link to open the Application database update settings window.
11. In the Update source section, select Kaspersky Security Center.
12. Clear the If inaccessible, use Kaspersky Lab servers check box.
13. Click OK.

    The Application Database Update Settings window closes.

14. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
15. In the Anti-Spam section, click any of the following links: Use KSN, Use enforced Anti-Spam Updates Service, Use reputation filtering, or Maximum scanning time to open the Anti-Spam settings window.
16. In the External Services section, select No in the Use enforced Anti-Spam Updates Service drop-down list.
17. Click the Apply button.

    The Anti-Spam settings window closes.

Kaspersky Secure Mail Gateway starts running in limited traffic mode.

Application licensing

This section covers the main aspects of application licensing.

About the End User License Agreement

The End User License Agreement is a binding agreement between you and AO Kaspersky Lab, stipulating the terms on which you may use the application.

Read through the terms of the End User License Agreement carefully before you start using the application.

You can view the terms of the License Agreement in the following ways:

• During installation of Kaspersky Secure Mail Gateway.
• By reading the license.txt file. This file is included in the application's distribution kit.

By confirming that you agree with the End User License Agreement when installing the application, you signify your acceptance of the terms of the End User License Agreement. If you do not accept the terms of the End User License Agreement, you must abort application installation and must not use the application.

About the license

A license is a time-limited right to use the application, granted under the End User License Agreement.

A current license entitles you to the following kinds of services:

• Use of the application in accordance with the terms of the End User License Agreement
• Getting technical support

The scope of services and application usage term depend on the type of license under which the application is activated.

The following license types are provided:

• Trial – a free license intended for trying out the application.

  A trial license is usually of limited duration. As soon as the license expires, all Kaspersky Secure Mail Gateway features are disabled. To continue using the application, you need to purchase a commercial license.

  You can activate the application under a trial license only once.

• Commercial – a pay-for license that is provided when you buy the application.

  When the commercial license expires, the application continues running with limited functionality (for example, Kaspersky Secure Mail Gateway database updates are not available). To continue using Kaspersky Secure Mail Gateway in fully functional mode, you must renew your commercial license.

We recommend renewing the license before its expiration to ensure maximum protection of your computer against security threats.

About the license certificate

The License Certificate is a document provided with the key file.

The License Certificate contains the following license information:

• License number
• Details of the license holder
• Information about the application that can be activated using the license
• Limitation on the number of licensing units (devices on which the application can be used under the license)
• License start date
• License expiration date or license validity period
• License type

About the key

A key is a sequence of bits with which you can activate and subsequently use the application in accordance with the terms of the End User License Agreement (license type, license term, and licensing restrictions).

A key is generated by Kaspersky Lab. After you add a key to the application, the key is displayed in the application interface as a unique alphanumeric sequence. You can add a key to the application by using a key file.

Kaspersky Lab can black-list a key over violations of the End User License Agreement. If the key has been black-listed, you have to add a different key to continue using the application.

There are two types of keys: active and additional.

An active key is the key that is currently used by the application. A trial or commercial license key can be added as the active key. The application cannot have more than one active key.

An additional key  is a key that entitles the user to use the application, but is not currently in use. An additional key automatically becomes active when the license associated with the current active key expires. An additional key can be added only if the active key is available.

A key for a trial license can be added only as the active key. A key for a trial license cannot be added as an additional key.

An additional key can be added only if the active key is available.

Kaspersky Secure Mail Gateway uses keys of the following types:

• Fully-functional key. When a key is added, the application works in full-functionality mode, performing scans for spam, phishing, viruses and other types of malware.
• Key for Anti-Virus protection. When this key is added, the application scans messages for viruses and other threats but does not scan messages for spam. The status label assigned by the application to a message following a spam scan contains information about limited functionality.
• Key for Anti-Spam and Anti-Phishing protection. When this key is added, the application scans messages for spam and phishing but does not scan messages for viruses and other threats. The status label assigned by the application to a message following a scan for viruses and other threats contains information about limited functionality.

The type of additional key should match the type of the previously added active key. If the type of the additional key does not match the type of a previously added active key, the available application functionality changes in accordance with the type of the additional key when the additional key becomes active.

Anti-Spam and Anti-Virus databases are updated regardless of key type.

About the key file

A key file is a file with the .key extension that you receive from Kaspersky Lab. Key files are designed to activate the application by adding a key.

You receive a key file at the email address that you provided when you bought Kaspersky Secure Mail Gateway or ordered the trial version of Kaspersky Security.

You do not need to connect to Kaspersky Lab activation servers in order to activate the application with a key file.

You can recover a key file if it is accidentally deleted. You may need a key file to register with Kaspersky CompanyAccount.

To recover a key file, do one of the following:

• Contact your license distributor
• Obtain a key file on the Kaspersky Lab website based on your existing activation code.

About data provision

Kaspersky Secure Mail Gateway operates with the use of data whose transmission and processing requires the consent of the Kaspersky Secure Mail Gateway administrator.

You can view the list of data and the terms on which it is used as well as give consent to data processing in the following agreements between your organization and Kaspersky Lab:

• In the End User License Agreement (for example, when installing Kaspersky Secure Mail Gateway or upgrading the system in the Settings section, System Upgrade subsection of the main window of the Kaspersky Secure Mail Gateway web interface).

  According to the terms of the End User License Agreement that you have accepted, you consent to the automatic transmission to Kaspersky Lab of the information enumerated in the License Agreement under Data Submission. This information is needed to improve the level of mail server security.

• In the KSN Statement.

  When you participate in Kaspersky Security Network, information obtained as a result of Kaspersky Secure Mail Gateway operation is automatically sent from the computer to Kaspersky Lab. The KSN Statement specifies the list of data that is transmitted.

Kaspersky Lab protects any information received in this way as prescribed by law and applicable rules of Kaspersky Lab.

Kaspersky Lab uses any retrieved information in anonymized form and as general statistics only. General statistics are automatically generated using original collected information and do not contain any private data or other confidential information. The original information received is destroyed as new information is accumulated (once a year). General statistics are stored indefinitely.

User data may be present in the following Kaspersky Secure Mail Gateway components:

• Message queue (file names, email addresses of message senders and recipients, message texts).
• Backup (file names, email addresses of message senders and recipients, message texts).
• Kaspersky Secure Mail Gateway operation reports (file names, email addresses of message senders and recipients).
• Kaspersky Secure Mail Gateway event log (email addresses of message senders and recipients, names of attachment files, IP addresses of computers of message senders).
• Trace files (files names, paths to files, proxy server names, user account data, IP addresses of computers that connect to Kaspersky Secure Mail Gateway database update sources, names and IP addresses of update sources, information about files downloaded and the download speed).
• Files storing settings of the connection to the LDAP server and proxy server (data of LDAP server and proxy server user accounts).

When Kaspersky Secure Mail Gateway connects to DNS, SURBL, and DNSBL servers, Kaspersky Secure Mail Gateway uses IP addresses and FQDN names of domains that contact these servers.

Managing Kaspersky Secure Mail Gateway via the administration console of Kaspersky Secure Mail Gateway in Technical Support Mode with super-user account privileges lets you manage dump settings. A dump is generated during application crashes and may be needed to analyze the causes of the crash. The dump may include any data, including fragments of messages and files analyzed.

The corporate LAN administrator is responsible for access to this information.

By default, dump generation in Kaspersky Secure Mail Gateway is disabled.

Data of the email message queue currently being processed by Kaspersky Secure Mail Gateway as well as data of LDAP server and proxy server user accounts are stored in Kaspersky Secure Mail Gateway in unencrypted form.

Such data can be accessed from the Kaspersky Secure Mail Gateway Administration Console in Technical Support Mode with super-user account privileges.

The administrator of Kaspersky Secure Mail Gateway must personally ensure the security of such data.

The administrator of Kaspersky Secure Mail Gateway is responsible for access to this information.

Data about events and processes of Kaspersky Secure Mail Gateway is logged and stored in the following Kaspersky Secure Mail Gateway logs:

• Event log
• Trace log

Viewing information about the license and added keys

To viewing information about the license and added keys,

in the main window of the application web interface, open the management console tree and select the Settings section and Licensing subsection.

The following key details appear in the Active key section of the workspace:

• Alphanumeric sequence of the key
• Key status
• License type
• Number of users
• Application activation date
• Key expiration date
• Number of days until key expiration

Adding a key

To add a key:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Licensing subsection.
2. Click the Add button.

   The Add a key window opens.

3. Click the Browse button.

   The file selection window opens.

4. Select the key file that you want to add.
5. Click OK.

Once added, a key can have active or additional status. The first key to be added automatically becomes active. You can use the application as soon as you add an active key.

After adding an active key, you can add an additional key. The additional key automatically becomes active on expiration of the license. This ensures that protection is maintained in the period between expiration and renewal of the license.

Removing a key

To remove a key:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Licensing subsection.
2. In the workspace of the window, select the check box next to the key that you want to delete.
3. Click the Delete button.

   The Remove key window opens.

4. Click Yes.

The selected key is removed.

If you remove the active key and an additional key has been added for Kaspersky Secure Mail Gateway, the additional key automatically becomes active.

If you remove the active and additional keys, you cannot use the application functionality available under your license.

Modes of Kaspersky Secure Mail Gateway operation under license

Kaspersky Secure Mail Gateway can operate in various modes depending on the license.

Unlicensed

Kaspersky Secure Mail Gateway runs in this mode from the time when you install the application and start its web interface and until you add an active key.

Kaspersky Secure Mail Gateway does not scan email messages in Unlicensed mode.

Trial license

In this mode, Kaspersky Secure Mail Gateway scans email messages and updates databases.

When the trial license key expires, Kaspersky Secure Mail Gateway stops scanning email messages and updating databases.

In order for Kaspersky Secure Mail Gateway to resume operation, you have to install a commercial license key.

Commercial license

In this mode, Kaspersky Secure Mail Gateway scans email messages and updates databases.

When the commercial license key expires, Kaspersky Secure Mail Gateway continues scanning email messages but stops updating databases.

To resume database updates, add a new commercial license key or renew the existing commercial license key.

Kaspersky Secure Mail Gateway supports the following types of commercial license keys:

• Fully-functional key. When a key is added, the application works in full-functionality mode, performing scans for spam, phishing, viruses and other types of malware.
• Key for Anti-Virus protection. When this key is added, the application scans messages for viruses and other threats but does not scan messages for spam. The status label assigned by the application to a message following a spam scan contains information about limited functionality.
• Key for Anti-Spam and Anti-Phishing protection. When this key is added, the application scans messages for spam and phishing but does not scan messages for viruses and other threats. The status label assigned by the application to a message following a scan for viruses and other threats contains information about limited functionality.

Black list of keys

A key can be added to the black list of keys in a number of cases. If this has happened, Kaspersky Secure Mail Gateway stops scanning email messages but continues attempts to update databases in case the key is removed from the black list of keys.

As soon as the key has been removed from the black list of keys, Kaspersky Secure Mail Gateway resumes scanning of email messages in accordance with the valid license.

After scanning of email messages in Kaspersky Secure Mail Gateway is disabled, the following functionality remains available: the mail transfer agent (MTA), the connection to the LDAP server, the event log, and Kaspersky Secure Mail Gateway operation reports. You also have access to all Kaspersky Secure Mail Gateway settings (except the protection settings) via the web interface.

Notification about license expiration

The application checks the license validity period after each update. When the number of days specified in the Send notification setting remains until license expiration, the application starts sending notifications to the email addresses of Kaspersky Secure Mail Gateway administrator.

By default, the application starts sending license expiration notifications 30 days before license expiration.

License expiration notifications are sent once a day.

The application stops sending license expiration notifications in the following cases:

• You have added a key whose validity period exceeds the validity period of the previous key and the value of the Send notification setting.
• License has expired. In this case, the application sends a notification that the license has expired.

To configure the start date for sending notifications, edit the header or text of the notification about an expiring license:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Notifications subsection.
2. In the License expires soon section, click any link to open the Notification settings window.
3. In the Subject field, type the header of the expiring license notification.
4. In the Message field, type the text of the expiring license notification.
5. In the Send notification list, specify the number of days until license expiry that you want to start receiving the notification.
6. Click the Save button.

   The Notification settings window closes.

To enable or disable delivery of license expiration notifications:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Notifications subsection.
2. In the License expires soon section, do one of the following:
   • Flip on the toggle switch next to the name of the License expires soon group of settings if you want to enable delivery of license expiration notifications.
   • Flip off the toggle switch next to the name of the License expires soon group of settings if you want to disable delivery of license expiration notifications.

If an additional key is installed in the application, the notification is not sent. After the expiry of the active key, the additional key automatically becomes active.

If the additional key validity period expires before the application is configured to start sending notifications, the first notification is sent at the time when the active key is replaced with the additional key.

Mail server protection status

In the Monitoring section of the Kaspersky Secure Mail Gateway web interface, the following information on the status of mail server protection is displayed in the right part of the workspace:

• Status of operation of the Anti-Spam, Anti-Virus, and Anti-Phishing engines
• Information about the last update of Anti-Virus databases and Anti-Spam databases as well as information on whether or not the databases of the Anti-Spam, Anti-Virus, and Anti-Phishing modules are current
• Status of the connection to LDAP servers
• License validity period and a license expiration notification if the license is about to expire
• Information about the status of transmission and reception of messages by the MTA.

If you have activated the application, the Anti-Spam, Anti-Virus, and Anti-Phishing modules are enabled by default, and message transmission and receipt is enabled for the MTA mail agent.

Participating in Kaspersky Security Network

This section provides information about participation in Kaspersky Security Network.

About participation in Kaspersky Security Network

To protect your computer more effectively, Kaspersky Secure Mail Gateway uses data that is collected from users around the globe. Kaspersky Security Network is designed for gathering this data.

Kaspersky Security Network (KSN) is an infrastructure of cloud services providing access to Kaspersky Lab's online knowledge base with information about the reputation of files, web resources, and software. Data from Kaspersky Security Network ensures faster response by Kaspersky Secure Mail Gateway to new threats, improves the performance of some protection components, and reduces the risk of false positives.

Thanks to users who participate in Kaspersky Security Network, Kaspersky Lab is able to promptly gather information about types and sources of new threats, develop solutions for neutralizing them, and minimize the number of false positives.

When you participate in Kaspersky Security Network, certain statistics collected while Kaspersky Secure Mail Gateway is running are sent to Kaspersky Lab automatically. Files or their parts which may be exploited by intruders to harm the computer or data can be also sent to Kaspersky Lab to be examined additionally.

No personal data is collected, processed, or stored. The types of data that Kaspersky Secure Mail Gateway sends to Kaspersky Security Network are described in the KSN Statement.

Participation in Kaspersky Security Network is voluntary. The decision to participate in Kaspersky Security Network is taken during installation of Kaspersky Secure Mail Gateway, and can be changed at any time.

Configuring participation in Kaspersky Security Network

To accept or reject participation in Kaspersky Security Network:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the External services section, click the KSN Statement link to open the KSN Statement window.
3. Read the Kaspersky Security Network Statement and select one of the following options:
   • Accept if you want to participate in Kaspersky Security Network.
   • Do not accept if you do not want to participate in Kaspersky Security Network.
4. Click the Apply button.

   The KSN Statement window closes.

5. In the External services section, click the KSN timeout link to open the External services window.
6. In the External services settings group, in the KSN timeout field specify the maximum KSN timeout in seconds. You can specify a value in the range from 1 to 300 seconds.

   The default value is 10 seconds.

7. Click the Apply button.

Deploying the Kaspersky Secure Mail Gateway virtual machine image

This section provides step-by-step instructions for deploying the image of the Kaspersky Secure Mail Gateway virtual machine on a VMware ESXi host.

Preparing to deploy

Before deploying the image of the Kaspersky Secure Mail Gateway virtual machine, verify that the VMware ESXi version and hardware resources allocated for the virtual machine meet the software and hardware requirements.

Step 1. Selecting a virtual machine image

The Kaspersky Secure Mail Gateway virtual machine image is distributed in an OVF package.

To deploy the virtual machine image from the OVF package:

1. Start VMware vSphere Client.
2. In the File menu, select Deploy OVF Template (see figure below).

   

   Deploying a virtual machine out of an OVF template

   The Deploy OVF Template window opens (see figure below).

   

   Selecting a template to deploy

3. In the Deploy OVF Template window, select a file with the OVA extension, which contains the image of the Kaspersky Secure Mail Gateway virtual machine.
4. Click Next.

The Wizard proceeds to the next step.

Step 2. Viewing details of the virtual machine image

To view the details of the Kaspersky Secure Mail Gateway virtual machine image:

1. View the details of the virtual machine image selected at the previous step (see figure below).

   

   Viewing details of the virtual machine image

2. Click Next.

The Wizard proceeds to the next step.

Step 3. Reviewing the License Agreement

To continue the deployment process, you have to accept the terms of the End User License Agreement. Deployment will not continue if the terms of the End User License Agreement are not accepted.

To accept the terms of the End User License Agreement:

1. In the Deploy OVF Template window (see figure below), click Accept.

   

   Reviewing the License Agreement

2. Click Next.

The Wizard proceeds to the next step.

Step 4. Naming the virtual machine

To name the Kaspersky Secure Mail Gateway virtual machine image:

1. Type the name of the virtual machine in the Name field (see figure below).

   The name must be unique among the names of all existing virtual machines.

   

   Naming the virtual machine

2. Click Next.

The Wizard proceeds to the next step.

Step 5. Selecting a destination storage for the virtual machine

To select a destination storage of the VMware ESXi host to store files of the Kaspersky Secure Mail Gateway virtual machine:

1. Select a destination storage in the list (see figure below).

   

   Selecting a destination storage for the Kaspersky Secure Mail Gateway virtual machine

2. Click Next.

The Wizard proceeds to the next step.

Step 6. Selecting a storage option for virtual machine files

To select a storage option for files of the Kaspersky Secure Mail Gateway virtual machine in the destination storage of the VMware ESXi host:

1. Select one of the following list options (see figure below):
   • Thick Provision Lazy Zeroed. The specified disk space is immediately reserved for virtual machine files. Data blocks inside the allocated space are overwritten with virtual machine data as they are accessed.
   • Thick Provision Eager Zeroed. The specified disk space is immediately reserved for virtual machine files. Data blocks of the disk space are cleared immediately.
   • Thin Provision. The minimum required disk space is reserved for virtual machine files. This disk space can be increased if necessary.

     We recommend using one of the Thick Provision options.

   

   Selecting a storage option for files

2. Click Next.

The Wizard proceeds to the next step.

Step 7. Starting and finishing deployment of the virtual machine image

To start deploying a virtual machine image and verify that deployment has finished correctly:

1. Verify that the virtual machine settings configured at previous steps are correct (see figure below).

   

   Viewing deployment settings

2. Select the Power on after deployment check box if you want the virtual machine to start automatically after deployment.
3. If all settings are configured correctly, click the Finish button.

   The virtual machine image deployment process starts (see figure below):

   

   Progress of virtual machine deployment

4. Select the Close this dialog when completed check box if you want the virtual machine image deployment progress window to close automatically as soon as deployment finishes.
5. Click Close(see figure below) when deployment finishes.

   

   Finishing virtual machine deployment

   After deploying the virtual machine image, perform initial configuration of the virtual machine.

Initial configuration of Kaspersky Secure Mail Gateway

Perform initial configuration of the Kaspersky Secure Mail Gateway virtual machine image after deploying it.

Initial configuration of the virtual machine is a sequence of steps. The Initial Configuration Wizard of Kaspersky Secure Mail Gateway is started automatically when the virtual machine is powered on for the first time.

Preparing for initial configuration

To begin initial configuration of the Kaspersky Secure Mail Gateway virtual machine:

1. Start VMware vSphere Client.
2. Select a Kaspersky Secure Mail Gateway virtual machine in the list of virtual machines in the left part of the main application window.
3. Power on the virtual machine by clicking the button on the control panel of the main application window.
4. Open the VMware vSphere Client console by selecting the Console tab in the right part of the main application window (see figure below) and follow the steps of the wizard.

   

   Opening the VMware vSphere Client console

Step 1. Selecting the End User License Agreement language

To set the language in which the texts of the End User License Agreement for Kaspersky Secure Mail Gateway and the Kaspersky Security Network Statement will be displayed:

1. Select a language in the list (see figure below).

   

   Selecting the language for viewing the End User License Agreement of Kaspersky Secure Mail Gateway and the KSN Statement

   The available languages depend on the localization packages included in your Kaspersky Secure Mail Gateway distribution kit.

2. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 2. Reviewing the License Agreement

At this step, you have to accept or reject the terms of the Kaspersky Secure Mail Gateway End User License Agreement (see figure below). Use the arrow buttons to navigate the text.

Reviewing the License Agreement

To accept or reject the terms of the End User License Agreement:

1. Select one of the following options:
   • I do not accept the agreement if you want to reject the terms of the End User License Agreement.
   • I accept the agreement if you want to accept the terms of the End User License Agreement.
2. Press Enter.

   If you rejected the terms of the End User License Agreement, initial configuration of Kaspersky Secure Mail Gateway is aborted. The Initial Configuration Wizard prompts you to power down the virtual machine (see figure below):

   

   Powering down the virtual machine if the End User License Agreement has been rejected

   The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step if you accept the terms of the End User License Agreement.

Step 3. Selecting the mode of operation of Kaspersky Secure Mail Gateway

At this step you have to select the mode of operation of Kaspersky Secure Mail Gateway within the IT infrastructure of your organization.

Kaspersky Secure Mail Gateway can run in normal mode or in certified mode.

In normal mode, Kaspersky Secure Mail Gateway is allowed to access the Internet and connect to the following servers outside the IT infrastructure of your organization:

• KSN database update servers
• DNS servers
• Kaspersky Secure Mail Gateway database update servers.

In certified mode, Kaspersky Secure Mail Gateway is not allowed to access the Internet and connect to servers outside the IT infrastructure of your organization. Besides, when Kaspersky Secure Mail Gateway operates in certified mode, the administrator is not allowed to view the event Log from the Kaspersky Secure Mail Gateway administrator's menu.

In certified mode, the settings of Kaspersky Secure Mail Gateway components that require Internet access take the following values by default:

• KSN usage is disabled.
• SPF, DKIM, and DMARC message authentication is disabled. Connection to DNS servers is prohibited.
• The Enforced Anti-Spam Updates service is disabled in the settings of the Anti-Spam component.
• Kaspersky Secure Mail Gateway receives database updates from Kaspersky Security Center or a local source of Kaspersky Secure Mail Gateway database updates.

To select the operation mode of Kaspersky Secure Mail Gateway:

1. Select one of the following options for switching Kaspersky Secure Mail Gateway to certified mode of operation (see figure below):
   • No, if you do not want to switch Kaspersky Secure Mail Gateway to certified mode of operation and want Kaspersky Secure Mail Gateway to run in normal mode.
   • Yes, if you want to switch Kaspersky Secure Mail Gateway to certified mode of operation.

   

   Switching Kaspersky Secure Mail Gateway to certified mode of operation

2. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 4. Configuring participation in Kaspersky Security Network

If you have selected the regular mode of operation of Kaspersky Secure Mail Gateway, the initial configuration wizard of Kaspersky Secure Mail Gateway prompts you to accept or reject the terms of participation in Kaspersky Security Network (KSN).

Kaspersky Security Network (KSN) is an infrastructure of cloud services providing access to Kaspersky Lab's online knowledge base with information about the reputation of files, web resources, and software. Data from Kaspersky Security Network ensures faster response by Kaspersky Secure Mail Gateway to new threats that have not been added to the antivirus databases yet, improves the performance of some protection components, and reduces the risk of false alarms.

Thanks to users who participate in Kaspersky Security Network, Kaspersky Lab is able to promptly gather information about types and sources of threats, develop solutions for neutralizing them, and minimize the number of false positives. In addition, participation in Kaspersky Security Network provides you with access to information about the reputation of various applications and websites.

If you participate in Kaspersky Security Network, Kaspersky Secure Mail Gateway performance statistics are submitted to Kaspersky Lab. These statistics are sent automatically.

No personal data is collected, processed, or stored.

Participation in Kaspersky Security Network is voluntary. The decision on whether or not to participate in Kaspersky Security Network is made during initial configuration of Kaspersky Secure Mail Gateway. However, you can change your decision later at any time.

The text of the Kaspersky Security Network Statement is displayed on the screen of the virtual machine console (see figure below). Use the arrow buttons to navigate the text. The text of the Kaspersky Security Network Statement is displayed in the language selected at Step 1.

Viewing the Kaspersky Security Network Statement

To accept or decline participation in Kaspersky Security Network:

1. Select one of the following options:
   • I do not agree to participate in Kaspersky Security Network if you want to decline participation in Kaspersky Security Network.
   • I agree to participate in Kaspersky Security Network if you want to accept participation in Kaspersky Security Network.
2. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 5. Selecting the input language for Kaspersky Secure Mail Gateway

To configure the input language to be used when managing Kaspersky Secure Mail Gateway:

1. Select the input language in the list (see figure below).

   

   Selecting the input language

2. Click OK.

The virtual machine Initial Configuration Wizard proceeds to the next step.

Step 6. Setting the time zone

To set a time zone for Kaspersky Secure Mail Gateway:

1. Select a country from the list displayed on the screen of the VMware vSphere Client console (see figure below).

   

   Selecting a country when setting the time zone

2. Press Enter.

   A list of time zones available for the selected country is displayed (see figure below).

   

   Selecting the time zone

3. Select a time zone.
4. Press Enter.

   A time zone selection confirmation window opens (see figure below).

   

   Confirming time zone selection

5. If the time zone has been selected correctly, click Yes.

The Initial Configuration Wizard of Kaspersky Secure Mail Gateway proceeds to the next step.

Step 7. Assigning the host name (myhostname)

To specify the name of the Kaspersky Secure Mail Gateway host to be used by DNS servers (myhostname):

1. In the hostname field, enter the full domain name of the Kaspersky Secure Mail Gateway server (see figure below).

   Specify the server name in FQDN format (for example: host.domain.com or host.domain.subdomain.com).

   

   Assigning the host name

2. Click OK.

   After you have assigned the Kaspersky Secure Mail Gateway host name, the virtual machine attempts to acquire the network settings automatically using the DHCP server and download Kaspersky Secure Mail Gateway databases.

The Initial Configuration Wizard of Kaspersky Secure Mail Gateway proceeds to the next step.

Step 8. Configuring the network interface

At this step, configure the settings of the Kaspersky Secure Mail Gateway network interface: enable or disable the network interface, assign the IP address and network mask.

Enabling and disabling the network interface

At least one network interface has to be enabled to make configuration of Kaspersky Secure Mail Gateway possible. You may have to disable a network interface if you are using several network interfaces and want to disable one of them temporarily.

To disable a network interface:

1. Select the Enabled setting (see figure below).

   

   Enabling and disabling the network interface

2. Press Enter.

   The value of the Enabled setting changes to no.

3. Proceed to assign the IP address and network mask (Assigning the IP address and network mask using the DHCP server, Assigning a static IP address and network mask) to finish configuring the network interface.

To enable a network interface:

1. Make sure that value of the Enabled setting is set to yes.

   The network interface is enabled by default.

2. Proceed to assign the IP address and network mask (Assigning the IP address and network mask using the DHCP server, Assigning a static IP address and network mask) to finish configuring the network interface.

Assigning the IP address and network mask using the DHCP server

To assign the IP address and network mask using the DHCP server:

1. Make sure that the value of the Use DHCP setting is set to yes (see figure below).

   You may need to use the DHCP server for assigning the IP address and network mask if you are configuring Kaspersky Secure Mail Gateway in test mode.

   The use of the DHCP server for assigning the IP address and network mask is enabled by default.

   

   Assigning the IP address and network mask using the DHCP server

2. Select Continue.
3. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Assigning a static IP address and network mask

To assign a static IP address and network mask:

1. Select the Use DHCP setting (see figure below).

   Assigning a static IP address and network mask is recommended if you are configuring Kaspersky Secure Mail Gateway in production mode.

   

   Assigning a static IP address and network mask

2. Press Enter.

   A window opens prompting you to confirm assignment of static settings for the network interface (see figure below).

   

   Confirming assignment of static settings for the network interface

3. Click Yes.

   A window for entering the static IP address and network mask opens (see figure below).

   

   Specifying a static IP address and network mask

4. In the Address field, type the IP address that you want to assign for Kaspersky Secure Mail Gateway.
5. In the Netmask field, type the mask of the network on which you are using Kaspersky Secure Mail Gateway.
6. Click OK.

   The Initial Configuration Wizard of Kaspersky Secure Mail Gateway returns to the network interface configuration window (see figure below).

   

   Finishing configuration of the network interface

7. Verify that the network settings are correct.
8. Select Continue.
9. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 9. Configuring network routes

At this step, assign the gateway address for configuring the network route. You can also add, delete, or modify additional static network routes at this step.

Assigning a gateway address using the DHCP server

To assign the gateway address using the DHCP server:

1. Make sure that the value of the Gateway setting is set to dhcp (see figure below).

   You may need to use the DHCP server for assigning the gateway address if you are configuring Kaspersky Secure Mail Gateway in test mode.

   The use of the DHCP server for assigning the gateway address is enabled by default.

   

   Assigning a gateway address using the DHCP server

2. Select Continue.
3. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Assigning a static gateway address

To assign a static gateway address:

1. Select the Gateway setting (see figure below).

   

   Assigning a static gateway address

2. Press Enter.
3. If at the previous step of initial configuration of Kaspersky Secure Mail Gateway you chose to use the DHCP server for configuring the network interface, click Yes in the window prompting you to confirm assignment of the static gateway address (see figure below).

   

   Confirming assignment of a static gateway address

   A window for entering the static gateway address opens (see figure below).

   

   Specifying a static gateway address

4. Type the gateway address in the Gateway field.
5. Click OK.

   The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine returns to the network routes configuration window (see figure below).

   

   Finishing the configuration of network routes

6. Make sure that the network route settings have been configured correctly.

   To modify, delete, or add additional static routes, proceed to configuring additional static network routes.

7. Select Continue.
8. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Adding an additional static route

To add an additional static network route:

1. Select the Edit static routes setting (see figure below).

   

   Configuring additional static network routes

2. Press Enter.

   A window for select additional static route configuration options opens (see figure below).

   

   Adding a new static route

3. Select New route.
4. Press Enter.

   A window for entering the static route settings opens (see figure below).

   

   Specifying static route settings

5. In the Address field, enter the IP address of the static route.
6. In the Netmask field, enter the mask of the static route network.
7. Type the gateway address in the Gateway field.
8. Click OK.

   A window opens, letting you select the network interface for which you want to configure the static route (see figure below).

   

   Selecting the network interface of the static route

9. Select a network interface.
10. Press Enter.

    A window with a list of additional static routes opens (see figure below).

    

    List of additional static network routes

11. Select Go back.
12. Press Enter.

    The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine returns to the network routes configuration window (see figure below).

    

    Finishing the configuration of network routes

13. Make sure that the network route settings have been configured correctly.
14. Select Continue.
15. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Modifying an additional static route

To modify an additional static route:

1. Select the Edit static routes setting (see figure below).

   

   Configuring additional static network routes

2. Press Enter.

   A window with a list of additional static routes opens (see figure below).

   

   List of additional static network routes to modify

3. Select an additional static network route that you want to modify.
4. Press Enter.
5. A window for entering the static route settings opens (see figure below).

   

   Specifying static route settings

6. Make changes in the Address field to modify the IP address of the static route.
7. Make changes in the Netmask field to modify the mask of the static route network.
8. Make changes in the Gateway field to modify the gateway address.
9. Click OK.

   A window opens, letting you select the network interface for which you want to configure the static route (see figure below).

   

   Selecting the network interface of the static route

10. Select a network interface.
11. Press Enter.

    A window with a list of additional static routes opens (see figure below).

    

    List of additional static network routes

12. Select Go back.
13. Press Enter.

    The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine returns to the network routes configuration window (see figure below).

    

    Finishing the configuration of network routes

14. Make sure that the network route settings have been configured correctly.
15. Select Continue.
16. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Deleting an additional static route

To delete an additional static route:

1. Select the Edit static routes setting (see figure below).

   

   Configuring additional static network routes

2. Press Enter.

   A window with a list of additional static routes opens (see figure below).

   

   Removing additional static network routes

3. Select Delete routes.
4. Press Enter.
5. A window for selecting the static route to delete opens (see figure below).

   

   Selecting a static route to delete

6. Select the route that you want to delete.
7. Click the Delete button.

   The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine returns to the window with a list of additional static routes that remain after deletion or, if you have deleted all additional routes, displays a window where you can select the action to take on the routes (see figure below).

   

   Selecting the action to perform after all static routes have been removed

8. Select Go back.
9. Press Enter.

   The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine returns to the network routes configuration window (see figure below).

   

   Finishing the configuration of network routes

10. Make sure that the network route settings have been configured correctly.
11. Select Continue.
12. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 10. Configuring DNS settings

At this step, configure the DNS settings of the Kaspersky Secure Mail Gateway virtual machine.

Assigning DNS addresses using the DHCP server

To assign the DNS address using the DHCP server:

1. Select the name of your network interface (for example: eth0) in the list of settings for using the DHCP server for assigning DNS addresses (see figure below) .

   You may need to use the DHCP server for assigning DNS addressed if you are configuring Kaspersky Secure Mail Gateway in test mode.

   

   Enabling the use of the DHCP server for assigning DNS addresses

2. Press Enter.

   A window for configuring DNS settings with the use of the DHCP server opens (see figure below).

   

   Finishing configuration of DNS settings with the use of the DHCP server

3. Make sure that the values of the Search list, Primary DNS, Secondary DNS settings are set to dhcp.
4. Select Continue.
5. Press Enter.

   A window with the settings of the Kaspersky Secure Mail Gateway network opens (see figure below).

   

   Kaspersky Secure Mail Gateway network settings

6. Select Continue.
7. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine restarts the virtual machine with the new values of settings and proceeds to the next step.

Assigning static DNS addresses

To assign static DNS addresses:

1. Select no in the list of settings for using the DHCP server for assigning DNS addresses (see figure below) .

   Assigning static DNS addresses is recommended if you are configuring Kaspersky Secure Mail Gateway in production mode.

   

   Disabling the use of the DHCP server for assigning DNS addresses

2. Press Enter.

   A window for entering static DNS addresses opens (see figure below).

   

   Specifying static DNS addresses

3. In the Search list field, type the DNS suffix that you want to use with Kaspersky Secure Mail Gateway.
4. In the Primary field, type the IP address of the primary DNS server in IPv4 format.
5. In the Secondary field, type the IP address of the secondary DNS server in IPv4 format.
6. Click OK.

   A window for configuring static DNS settings opens (see figure below).

   

   Finishing configuration of static DNS settings

7. Verify that the DNS settings are correct.
8. Select Continue.
9. Press Enter.

   A window with the settings of the Kaspersky Secure Mail Gateway network opens (see figure below).

   

   Kaspersky Secure Mail Gateway network settings

10. Select Continue.
11. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine restarts the virtual machine with the new values of settings and proceeds to the next step.

Step 11. Setting the web interface administrator password

To set an administrator's password for accessing the web interface (Administrator account):

1. Type any characters in the Test input field to check the keyboard layout.
2. In the Password field, type the administrator's password for accessing the web interface of Kaspersky Secure Mail Gateway (see figure below).

   

   Setting the administrator's password for the web interface of Kaspersky Secure Mail Gateway

   The password must contain:

   • At least eight characters
   • Only characters in ASCII encoding
   • At least one upper-case character
   • At least one lower-case character
   • At least one numeral
3. Type the password again in the Confirm password field.
4. Click OK.

The Initial Configuration Wizard of Kaspersky Secure Mail Gateway proceeds to the next step.

Step 12. Setting the administrator password for using the console

The administrator of Kaspersky Secure Mail Gateway has the rights to manage the virtual machine. The administrator can power down or restart the virtual machine or edit its network settings in the WMware console. The admin account with a separate administrator password is used for administering Kaspersky Secure Mail Gateway.

To set the administrator's password for managing Kaspersky Secure Mail Gateway in the VMware console (under the admin account):

1. Type any characters in the Test input field to check the keyboard layout.
2. In the Password field, type the administrator's password for managing the settings of Kaspersky Secure Mail Gateway (see figure below).

   

   Setting the administrator password for using the VMware console

   The password must contain:

   • At least eight characters
   • Only characters in ASCII encoding
   • At least one upper-case character
   • At least one lower-case character
   • At least one numeral
3. Type the password again in the Confirm password field.
4. Click OK.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 13. Specifying email addresses of the mail server administrator

To specify email addresses of the Kaspersky Secure Mail Gateway mail server administrator:

1. In the admins' emails field, enter the email addresses of the Kaspersky Secure Mail Gateway administrator (see figure below). You can specify several addresses, separating them with commas.

   

   Specifying email addresses of the administrator

2. Click OK.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 14. Configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center

At this step, configure the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center using the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center (see figure below).

Wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center

Kaspersky Security Center is designed for centrally managing and monitoring Kaspersky Secure Mail Gateway by performing the primary administrative tasks.

Kaspersky Security Center acts as the Administration Server.

Kaspersky Secure Mail Gateway includes Network Agent (nagent).

Kaspersky Security Center lets the administrator perform the following Kaspersky Secure Mail Gateway management tasks:

• Add the active and additional keys
• Start the Kaspersky Secure Mail Gateway database update task
• Display information about the status of protection of Kaspersky Secure Mail Gateway
• Start and stop Kaspersky Secure Mail Gateway

Enabling Network Agent

Configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center requires enabling Network Agent.

Network Agent is disabled by default.

To enable Network Agent, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Enabled setting.
2. Make sure that value of the Enabled setting is set to yes.
3. If the value of the Enabled setting is set to no, press Enter.

Continue performing steps in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center.

Entering the Administration Server address

To enter the address of the Kaspersky Security Center Administration Server, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Address setting.
2. Press Enter.

   A window for entering the Administration Server address opens (see figure below).

   

   Entering the Administration Server address

3. Specify the DNS name or IP address of the Administration Server of Kaspersky Security Center.
4. Click OK.

Continue performing the steps of configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center.

Specifying the number of the port for connecting to the Administration Server

To specify the number of the port for connecting to the Kaspersky Security Center Administration Server, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Port setting.
2. Press Enter.

   A window opens where you can enter the number of the port for connecting to the Administration Server (see figure below).

   

   Specifying the port for connecting to the Administration Server

3. Specify the number of the port for connecting to the Administration Server or use the default port number (13000).
4. Click OK.

Continue performing steps in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center.

Using the SSL connection for data transfer

You can enable the SSL connection for transferring data to the Administration Server of Kaspersky Security Center.

By default, the SSL connection for transferring data to the Administration Server of Kaspersky Security Center is enabled.

To enable SSL connection, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Use SSL setting.
2. Make sure that value of the Use SSL setting is set to yes.
3. If the value of the Use SSL setting is set to no, press Enter.

Continue performing steps in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center.

Using a gateway for connecting to the Administration Server

You can choose one of the options for using the gateway when connecting Kaspersky Secure Mail Gateway to the Administration Server of Kaspersky Security Center:

• Disable the use of the gateway
• Enable the use of the gateway
• Enable the use of Network Agent as a gateway

By default, the use of a gateway is disabled when connecting to the Administration Server, and the connection to Kaspersky Security Center is established directly.

To disable the use of the gateway for connecting Kaspersky Secure Mail Gateway to the Administration Server, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Gw mode setting.
2. Make sure that the value of the Gw mode setting is set to don't use.
3. If the Gw mode setting has any other value, keep pressing the Enter key until the value of the Gw mode setting changes to don't use.

To enable the use of the gateway for connecting Kaspersky Secure Mail Gateway to the Administration Server, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Gw mode setting.
2. Keep pressing the Enter key until the value of the Gw mode setting changes to use gateway.
3. Select the Gateway setting.
4. Press Enter.

   A window for entering the gateway address opens (see figure below).

   

   Entering the address of a gateway for connecting to the Administration Server

5. Enter the DNS name or IP address of the gateway that you want to use for connecting to the Administration Server of Kaspersky Security Center.
6. Click OK.

To enable the use of Network Agent as a gateway for connecting Kaspersky Secure Mail Gateway to the Administration Server, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Gw mode setting.
2. Keep pressing the Enter key until the value of the Gw mode setting changes to act as gateway.

Proceed to check the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center.

Step 15. Checking the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center

To check the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center, do the following in the window of the wizard for configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center:

1. Select the Check Status setting.
2. Press Enter.
3. If you have modified the settings of Kaspersky Secure Mail Gateway connection to Kaspersky Security Center when configuring the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center, click Yes in the window prompting you to confirm changes (see figure below).

   

   Confirming changes to Kaspersky Security Center connection settings

   The window prompting you to confirm saving changes to Kaspersky Security Center connection settings closes.

   The Check Status setting takes the value corresponding to the status of Kaspersky Secure Mail Gateway connection to Kaspersky Security Center.

   For example, if the connection of Kaspersky Secure Mail Gateway to Kaspersky Security Center has been established successfully, the value of the Check Status setting changes to OK.

4. Select Continue.
5. Press Enter.

The Initial Configuration Wizard of the Kaspersky Secure Mail Gateway virtual machine proceeds to the next step.

Step 16. Displaying the settings of the connection to the web interface

If the network connection has been configured successfully, initial configuration of Kaspersky Secure Mail Gateway finishes at this step, and a window with the web interface connection settings opens (see figure below).

Finishing initial configuration of Kaspersky Secure Mail Gateway

Remember or write down the IP address specified in the IP address information window and click OK.

Initial configuration of Kaspersky Secure Mail Gateway has finished.

If your network does not use a DHCP server, Kaspersky Secure Mail Gateway is unable to retrieve the Kaspersky Secure Mail Gateway web interface connection settings automatically, and the IP address of the connection to the web interface is not displayed in the IP address information window. In this case, you can configure the settings of the connection to the Kaspersky Secure Mail Gateway web interface manually using the administrator's menu of Kaspersky Secure Mail Gateway.

Starting the Kaspersky Secure Mail Gateway virtual machine

After initial configuration, the virtual machine of Kaspersky Secure Mail Gateway starts automatically. To ensure interaction with the existing mail infrastructure, the mail server preinstalled on the Kaspersky Secure Mail Gateway virtual machine needs to be configured additionally.

You can view information about the operation of Kaspersky Secure Mail Gateway and configure message processing rules and protection settings via the web interface.

You can also configure settings and manage the operation of the virtual machine from the administrator's menu in the WMware console.

Connecting to the Kaspersky Secure Mail Gateway web interface

After completing initial configuration, you can connect to the web interface of Kaspersky Secure Mail Gateway.

To connect to the web interface of Kaspersky Secure Mail Gateway:

1. Type the following address in the address line of the web browser:

   https://<IP-address-of-deployed-appliance>/ksmg, using the IP address received at Step 16 of the Initial Configuration Wizard of Kaspersky Secure Mail Gateway.

   A web interface login page opens, prompting you to enter the user name and password of the web address administrator.

2. In the User name field, type Administrator.
3. In the Password field, type the password specified at Step 11 of the Initial Configuration Wizard of Kaspersky Secure Mail Gateway.
4. Click the Log in button.

The main page of the Kaspersky Secure Mail Gateway web interface opens.

Integrating Kaspersky Secure Mail Gateway into the corporate mail infrastructure

Kaspersky Secure Mail Gateway is integrated into the existing corporate mail infrastructure and is not a standalone mail system. For example, Kaspersky Secure Mail Gateway does not deliver email messages to recipients and does not manage user accounts.

You can integrate Kaspersky Secure Mail Gateway into the corporate mail infrastructure in one of the following ways:

• Directly.
• Through an edge gateway on which SMTP verification of recipient email addresses is enabled.

  Before configuring integration of Kaspersky Secure Mail Gateway via an edge gateway, specify whether or not SMTP verification of recipient email addresses is enabled on the edge gateway to which Kaspersky Secure Mail Gateway will be relaying messages from internal domains.

• Through an edge gateway on which SMTP verification of recipient email addresses is disabled.

You can configure the basic settings of Kaspersky Secure Mail Gateway integration into the corporate mail infrastructure using the Quick MTA Setup Wizard as well as integrate Kaspersky Secure Mail Gateway into the corporate mail infrastructure through the web interface of the application.

After you complete all steps of the Quick MTA Setup, Kaspersky Secure Mail Gateway resets all values of MTA setting and replaces them with values that you specified in the Quick MTA Setup Wizard.

Direct integration using a Quick Setup Wizard

Direct integration is the type of integration where Kaspersky Secure Mail Gateway receives email messages directly from the Internet and redirects them to internal mail servers, and also receives messages from internal mail servers and redirects them to the Internet.

To configure direct integration of Kaspersky Secure Mail Gateway into the corporate mail infrastructure:

1. In the main window of the application web interface, open the administration console tree and select the Quick MTA Setup section.
2. In the Integrating Kaspersky Secure Mail Gateway into mail infrastructure section, select Integrate directly.
3. Click the Start integration link to begin performing the steps of the wizard.

Step 1. Adding local domains (relay_domains)

At this step, add local domains of your organization for which Kaspersky Secure Mail Gateway will be receiving email messages from the outside. Kaspersky Secure Mail Gateway will receive messages only for the domains you specified. Messages intended for other domains are rejected.

If local domains are not specified, Kaspersky Secure Mail Gateway will not be receiving messages for your internal mail servers.

To add local domains of your organization:

1. Click the Add a domain link to open the Adding a domain window.
2. In the Enter domain name field, type the name of the domain for which Kaspersky Secure Mail Gateway will be receiving messages.

   Type the domain names in FQDN format.

3. Click the Add button.
4. The Adding a domain window closes.

The domain names have to be entered one at a time. Repeat the process of adding domain names to the list for all domain names that you are adding.

Proceed to the next step of the wizard.

Step 2. Configuring email routing (transport_map)

Configure email routing at this step.

By default, Kaspersky Secure Mail Gateway uses the settings of your DNS server for email routing. To configure email routing manually, create a transport map: enter the names of the domains for which email messages are intended and then type the IP addresses or FQDN names of the domains to which Kaspersky Secure Mail Gateway will be redirecting messages intended for the domains.

For example, if you want messages intended for the example.com domain to be redirected to the address 1.1.1.0:25, add the example.com domain to the transport map and then specify the IP address 1.1.1.0 and port number 25 for routing messages intended for the example.com domain.

To configure email routing:

1. Click the Add a record to the transport map link to open the Email routing window.
2. In the Enter domain name field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address or domain name of the server the routing of email to which you want to configure.

   You can enter an IPv4 address (for example: 192.0.0.1 or 192.0.0.0/16), an IPv6 address (for example: 2607:f0d0:1002:51::4), subnet mask in CIDR format (for example: fc00::/7), domain name or FQDN.

4. In the Enter the port number to connect with the email destination address, select the port number.

   The default value is 25.

5. Select one of the following options:
   • Do not enable MX lookup.
   • Enable MX lookup (for domain names or FQDNs).
6. Click OK.
7. The Email routing window closes.

Transport map records are added one at a time. Repeat the process of adding records to the transport map for all records that you are adding.

Proceed to the next step of the wizard.

Step 3. Adding trusted networks and network hosts (mynetworks)

At this step, create a list of trusted networks and network hosts that are allowed to send email messages via Kaspersky Secure Mail Gateway.

As a rule, these are internal networks and network hosts of your organization.

For example, you can specify the IP addresses of Microsoft Exchange servers used at your organization.

If trusted networks are not specified, Kaspersky Secure Mail Gateway will not be receiving messages from internal mail servers and redirect them outside the network of your organization.

To add a list of trusted networks and network hosts:

1. Click the Add a trusted network or network host link to open the Adding a trusted network window.
2. In the Enter network address or network host address field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address of the network or a subnet address.

   Type IP addresses in IPv4 format or subnet addresses in CIDR format.

4. Click OK.
5. The Adding a trusted network window closes.

Addresses are added one at a time. Repeat the process of adding addresses to the list for all addresses that you are adding.

Proceed to the next step of the wizard.

Step 4. Finishing integration of Kaspersky Secure Mail Gateway directly

At this step, check the settings you have specified for integrating Kaspersky Secure Mail Gateway into the corporate mail infrastructure and confirm your choice.

When integration into the corporate mail infrastructure is completed, the following settings of Kaspersky Secure Mail Gateway are configured automatically:

• SPF authentication of message senders is enabled.
• SMTP verification of recipient email addresses is enabled.

After you complete all steps of the Quick MTA Setup, Kaspersky Secure Mail Gateway resets all values of MTA setting and replaces them with values that you specified in the Quick MTA Setup Wizard.

Integration through an edge gateway (SMTP verification of recipient email addresses is enabled) with the help of a wizard

Integration through an edge gateway on which SMTP verification of recipient email addresses is enabled is a type of integration where Kaspersky Secure Mail Gateway receives messages from an intermediate gateway and relays them to internal mail servers, and also receives messages from internal mail servers and relays them to the edge gateway. In this case, SMTP verification of recipient email addresses is enabled on the edge gateway.

SMTP verification of recipient email addresses is used by mail systems to prevent reception of messages for nonexistent addresses.

To configure integration of Kaspersky Secure Mail Gateway into the corporate mail infrastructure through an edge gateway on which SMTP verification of recipient email addresses is enabled:

1. In the main window of the application web interface, open the administration console tree and select the Quick MTA Setup section.
2. In the Integrating Kaspersky Secure Mail Gateway into mail infrastructure section, select Integrate through Edge Gateway.
3. Click the Start integration link to go to the SMTP verification of recipient email addresses on the Edge Gateway. section.
4. Select SMTP verification of recipient email addresses is enabled on the Edge Gateway.
5. Click the Go to adding local domains link to start performing the steps of the wizard.

Step 1. Adding local domains (relay_domains)

At this step, add local domains of your organization for which Kaspersky Secure Mail Gateway will be receiving email messages from the outside. Kaspersky Secure Mail Gateway will receive messages only for the domains you specified. Messages intended for other domains are rejected.

If local domains are not specified, Kaspersky Secure Mail Gateway will not be receiving messages for your internal mail servers.

To add local domains of your organization:

1. Click the Add a domain link to open the Adding a domain window.
2. In the Enter domain name field, type the name of the domain for which Kaspersky Secure Mail Gateway will be receiving messages.

   Type the domain names in FQDN format.

3. Click the Add button.
4. The Adding a domain window closes.

The domain names have to be entered one at a time. Repeat the process of adding domain names to the list for all domain names that you are adding.

Proceed to the next step of the wizard.

Step 2. Configuring email routing (transport_map)

Configure email routing at this step.

By default, Kaspersky Secure Mail Gateway uses the settings of your DNS server for email routing. To configure email routing manually, create a transport map: enter the names of the domains for which email messages are intended and then type the IP addresses or FQDN names of the domains to which Kaspersky Secure Mail Gateway will be redirecting messages intended for the domains.

For example, if you want messages intended for the example.com domain to be redirected to the address 1.1.1.0:25, add the example.com domain to the transport map and then specify the IP address 1.1.1.0 and port number 25 for routing messages intended for the example.com domain.

To configure email routing:

1. Click the Add a record to the transport map link to open the Email routing window.
2. In the Enter domain name field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address or domain name of the server the routing of email to which you want to configure.

   You can enter an IPv4 address (for example: 192.0.0.1 or 192.0.0.0/16), an IPv6 address (for example: 2607:f0d0:1002:51::4), subnet mask in CIDR format (for example: fc00::/7), domain name or FQDN.

4. In the Enter the port number to connect with the email destination address, select the port number.

   The default value is 25.

5. Select one of the following options:
   • Do not enable MX lookup.
   • Enable MX lookup (for domain names or FQDNs).
6. Click OK.

   The Email routing window closes.

Transport map records are added one at a time. Repeat the process of adding records to the transport map for all records that you are adding.

Proceed to the next step of the wizard.

Step 3. Entering address of your Edge Gateway (relayhost)

At this step, enter the address of your edge gateway. Kaspersky Secure Mail Gateway will be redirecting all messages to this address.

For example: 192.0.2.1 or domain.com.

If you have configured email routing for individual domains, Kaspersky Secure Mail Gateway will be redirecting email messages to the addresses specified for each domain.

To enter the address of an edge gateway:

1. In the Entering address of your Edge Gateway field, type the IP address of the edge gateway.

   Type the address in IPv4 format, domain name or FQDN format.

2. Select one of the following options:
   • Do not enable MX lookup.
   • Enable MX lookup (for domain names or FQDNs).

Proceed to the next step of the wizard.

Step 4. Adding trusted networks and network hosts (mynetworks)

At this step, create a list of trusted networks and network hosts that are allowed to send email messages via Kaspersky Secure Mail Gateway.

As a rule, these are internal networks and network hosts of your organization.

For example, you can specify the IP addresses of Microsoft Exchange servers used at your organization.

If trusted networks are not specified, Kaspersky Secure Mail Gateway will not be receiving messages from internal mail servers and redirect them outside the network of your organization.

To add a list of trusted networks and network hosts:

1. Click the Add a trusted network or network host link to open the Adding a trusted network window.
2. In the Enter network address or network host address field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address of the network or a subnet address.

   Type IP addresses in IPv4 format or subnet addresses in CIDR format.

4. Click OK.
5. The Adding a trusted network window closes.

Addresses are added one at a time. Repeat the process of adding addresses to the list for all addresses that you are adding.

Proceed to the next step of the wizard.

Step 5. Finishing integration of Kaspersky Secure Mail Gateway through an edge gateway (SMTP verification of recipient email addresses is enabled)

At this step, check the settings you have specified for integrating Kaspersky Secure Mail Gateway into the corporate mail infrastructure and confirm your choice.

When integration into the corporate mail infrastructure is completed, the following settings of Kaspersky Secure Mail Gateway are configured automatically:

• SPF authentication of message senders is disabled.

  Do not enable SPF authentication of message recipients because the message sender is the edge gateway from which Kaspersky Secure Mail Gateway receives messages.

• DMARC authentication of domains from which Kaspersky Secure Mail Gateway receives messages is disabled.

  Do not enable DMARC authentication of domains because Kaspersky Secure Mail Gateway receives messages from an intermediate gateway.

• SMTP verification of recipient email addresses is enabled.

  Do not disable SMTP verification of recipient email addresses because SMTP verification of recipient email addresses is enabled on the edge gateway.

After you complete all steps of the Quick MTA Setup, Kaspersky Secure Mail Gateway resets all values of MTA setting and replaces them with values that you specified in the Quick MTA Setup Wizard.

Integration through an edge gateway (SMTP verification of recipient email addresses is disabled) with the help of a wizard

Integration through an edge gateway on which SMTP verification of recipient email addresses is disabled is a type of integration where Kaspersky Secure Mail Gateway receives messages from an edge gateway and relays them to internal mail servers, and also receives messages from internal mail servers and relays them to the edge gateway. In this case, SMTP verification of recipient email addresses is disabled on the edge gateway.

SMTP verification of recipient email addresses is used by mail systems to prevent reception of messages for nonexistent addresses.

To configure integration of Kaspersky Secure Mail Gateway into the corporate mail infrastructure through an edge gateway on which SMTP verification of recipient email addresses is disabled:

1. In the main window of the application web interface, open the administration console tree and select the Quick MTA Setup section.
2. In the Integrating Kaspersky Secure Mail Gateway into mail infrastructure section, select Integrate through Edge Gateway.
3. Click the Start integration link to go to the SMTP verification of recipient email addresses on the Edge Gateway. section.
4. Select SMTP verification of recipient email addresses is disabled on the Edge Gateway.
5. Click the Go to configuring email routing link to start performing the steps of the wizard.

Step 1. Configuring email routing (transport_map)

Configure email routing at this step.

By default, Kaspersky Secure Mail Gateway uses the settings of your DNS server for email routing. To configure email routing manually, create a transport map: enter the names of the domains for which email messages are intended and then type the IP addresses or FQDN names of the domains to which Kaspersky Secure Mail Gateway will be redirecting messages intended for the domains.

For example, if you want messages intended for the example.com domain to be redirected to the address 1.1.1.0:25, add the example.com domain to the transport map and then specify the IP address 1.1.1.0 and port number 25 for routing messages intended for the example.com domain.

To configure email routing:

1. Click the Add a record to the transport map link to open the Email routing window.
2. In the Enter domain name field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address or domain name of the server the routing of email to which you want to configure.

   You can enter an IPv4 address (for example: 192.0.0.1 or 192.0.0.0/16), an IPv6 address (for example: 2607:f0d0:1002:51::4), subnet mask in CIDR format (for example: fc00::/7), domain name or FQDN.

4. In the Enter the port number to connect with the email destination address, select the port number.

   The default value is 25.

5. Select one of the following options:
   • Do not enable MX lookup.
   • Enable MX lookup (for domain names or FQDNs).
6. Click OK.

   The Email routing window closes.

Transport map records are added one at a time. Repeat the process of adding records to the transport map for all records that you are adding.

Proceed to the next step of the wizard.

Step 2. Entering address of your Edge Gateway (relayhost)

At this step, enter the address of your edge gateway. Kaspersky Secure Mail Gateway will be redirecting all messages to this address.

For example: 192.0.2.1 or domain.com.

If you have configured email routing for individual domains, Kaspersky Secure Mail Gateway will be redirecting email messages to the addresses specified for each domain.

To enter the address of an edge gateway:

1. In the Entering address of your Edge Gateway field, type the IP address of the edge gateway.

   Type the address in IPv4 format, domain name or FQDN format.

2. Select one of the following options:
   • Do not enable MX lookup.
   • Enable MX lookup (for domain names or FQDNs).

Proceed to the next step of the wizard.

Step 3. Adding trusted networks and network hosts (mynetworks)

At this step, create a list of trusted networks and network hosts that are allowed to send email messages via Kaspersky Secure Mail Gateway.

As a rule, these are internal networks and network hosts of your organization.

For example, you can specify the IP addresses of Microsoft Exchange servers used at your organization.

If trusted networks are not specified, Kaspersky Secure Mail Gateway will not be receiving messages from internal mail servers and redirect them outside the network of your organization.

To add a list of trusted networks and network hosts:

1. Click the Add a trusted network or network host link to open the Adding a trusted network window.
2. In the Enter network address or network host address field, type the name of the domain for which email messages are intended.

   Type the domain names in FQDN format.

3. In the Enter email destination address (IPv4, domain name or FQDN) field, type the IP address of the network or a subnet address.

   Type IP addresses in IPv4 format or subnet addresses in CIDR format.

4. Click OK.

   The Adding a trusted network window closes.

Addresses are added one at a time. Repeat the process of adding addresses to the list for all addresses that you are adding.

Proceed to the next step of the wizard.

Step 4. Finishing integration of Kaspersky Secure Mail Gateway through an edge gateway (SMTP verification of recipient email addresses is disabled)

At this step, check the settings you have specified for integrating Kaspersky Secure Mail Gateway into the corporate mail infrastructure and confirm your choice.

When integration into the corporate mail infrastructure is completed, the following settings of Kaspersky Secure Mail Gateway are configured automatically:

• SPF authentication of message senders is disabled.

  Do not enable SPF authentication of message recipients because the message sender is the edge gateway from which Kaspersky Secure Mail Gateway receives messages.

• DMARC authentication of domains from which Kaspersky Secure Mail Gateway receives messages is disabled.

  Do not enable DMARC authentication of domains because Kaspersky Secure Mail Gateway receives messages from an intermediate gateway.

• SMTP verification of recipient email addresses is disabled.

  Do not enable SMTP verification of recipient email addresses because SMTP verification of recipient email addresses is disabled on the edge gateway.

After you complete all steps of the Quick MTA Setup, Kaspersky Secure Mail Gateway resets all values of MTA setting and replaces them with values that you specified in the Quick MTA Setup Wizard.

Configuring MTA settings

Kaspersky Secure Mail Gateway is integrated into the existing corporate mail infrastructure and is not a standalone mail system. For example, Kaspersky Secure Mail Gateway does not deliver email messages to recipients and does not manage user accounts.

You can configure the basic MTA settings using the Quick MTA Setup Wizard or manually in the application web interface.

This section describes how you can configure the MTA settings manually.

Configuring transmission and reception of messages by the MTA

To enable or disable transmission or reception of messages by the mail agent of Kaspersky Secure Mail Gateway:

1. In the main window of the application web interface, open the management console tree and select the Message Queue section.
2. In the upper part of the workspace, click any link to open the Messages send and receive control window.
3. In the Sending Mail list, select one of the following values:
   • Yes if you want to allow the mail agent of Kaspersky Secure Mail Gateway to send messages.
   • No if you do not want to allow the mail agent of Kaspersky Secure Mail Gateway to send messages.
4. In the Receiving Mail list, select one of the following values:
   • Yes if you want to allow the mail agent of Kaspersky Secure Mail Gateway to receive messages.
   • No if you do not want to allow the mail agent of Kaspersky Secure Mail Gateway to receive messages.
5. Click OK.

The Messages send and receive control window closes.

Attention! These settings control transmission and reception of messages by the mail agent of Kaspersky Secure Mail Gateway.

Adding local domains (relay_domains)

Local domains are domains of your organization for which Kaspersky Secure Mail Gateway will be receiving email messages from the outside. Kaspersky Secure Mail Gateway will receive messages only for the domains you specified. Messages intended for other domains are rejected.

If local domains are not specified, Kaspersky Secure Mail Gateway will not be receiving messages for your internal mail servers.

To add a local domain of your organization:

1. In the main window of the application web interface, open the management console tree and select the Domains section.
2. Click the Add button.

   The record creation window opens.

3. In the Record type settings group, select Domain as the record type.
4. In the Domain/Email address field, type the name of the domain for which Kaspersky Secure Mail Gateway will be receiving email messages from the outside.

   Type the fully qualified domain name (FQDN).

5. Select the check box next to the name of the Local domain setting.

   Kaspersky Secure Mail Gateway will receive messages only for the domains you specified. Messages intended for other domains are rejected.

6. In the Email routing settings group, flip on the toggle switch next to the name of the Configure email routing setting.
7. In the Protocol settings group, select the email transmission protocol.
8. In the Destination address and port number field, type the IP address of the server to which you want to configure routing of email.

   You can enter an IPv4 address (for example: 192.0.0.1 or 192.0.0.0/16), an IPv6 address (for example: 2607:f0d0:1002:51::4), or subnet address in CIDR format (for example: fc00::/7).

9. In the TLS Encryption mode for all outgoing mail of the mail server settings group, select one of the following options:
   • Use TLS Encryption mode, set for all outgoing mail from the server, if you want to use the TLS encryption mode set for all outgoing mail from the server for this domain.
   • Override TLS Encryption mode for this domain, if you want to configure a different mode of connection TLS encryption for this domain.
10. If you have chosen to configure a different TLS encryption mode for this domain, in the Override TLS Encryption mode for this domain list select the mode of TLS encryption of the connection that you want to set.
11. If you want to configure the DKIM signature for messages from addresses of this domain, in the DKIM signature for messages from domain addresses settings group, do the following:
    1. Click the Add button.

       The Creating DKIM signature for the domain window opens.

    2. In the Selector field, type the name that will help you find the DKIM signature.
    3. In the Key name list, select the DKIM key based on which the DKIM signature will be added to messages.
    4. Click OK.

       The Creating DKIM signature for the domain window closes.

12. Click the Add button in the lower part of the window.

The domain for which Kaspersky Secure Mail Gateway will be receiving messages appears in the list of domains.

Configuring email routing (transport_map)

By default, Kaspersky Secure Mail Gateway uses the settings of your DNS server for email routing. To configure email routing manually, create a transport map: enter the names of the domains for which email messages are intended and then type the IP addresses or FQDN names of the domains to which Kaspersky Secure Mail Gateway will be redirecting messages intended for the domains.

For example, if you want messages intended for the example.com domain to be redirected to the address 1.1.1.0:25, add the example.com domain to the transport map and then specify the IP address 1.1.1.0 and port number 25 for routing messages intended for the example.com domain.

To configure email routing for a domain:

1. In the main window of the application web interface, open the management console tree and select the Domains section.
2. In the list of domains, select the domain for which you want to configure email routing.
3. In the Destination address and port number field, type the IP address of the server to which you want to configure routing of email.

   You can enter an IPv4 address (for example: 192.0.0.1 or 192.0.0.0/16), an IPv6 address (for example: 2607:f0d0:1002:51::4), or subnet address in CIDR format (for example: fc00::/7).

4. Click OK in the lower part of the window.

Email routing is configured for the domain.

Adding trusted networks and network hosts (mynetworks)

Trusted networks and network hosts – networks and network hosts that are allowed to send email messages via Kaspersky Secure Mail Gateway.

As a rule, these are internal networks and network hosts of your organization.

For example, you can specify the IP addresses of Microsoft Exchange servers used at your organization.

If trusted networks are not specified, Kaspersky Secure Mail Gateway will not be receiving messages from internal mail servers and redirect them outside the network of your organization.

To add a list of trusted networks and network hosts:

1. In the main window of the application web interface, open the management console tree and select the Settings section and MTA subsection.
2. In the Basic Settings section, click any link to open the Basic MTA settings window.
3. In the Trusted networks field, type the list of trusted networks and network hosts for which you want to allow transmission of email messages via Kaspersky Secure Mail Gateway.

   Specify the IPv4 addresses in the CIDR notation.

4. Click OK.

   The Basic MTA settings window closes.

The list of trusted networks and network hosts is added.

Configuring advanced MTA settings

To configure advanced MTA settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and MTA subsection.
2. Maximize the Advanced Settings section.
3. Click any link in the upper part of the list of settings to open the Advanced MTA settings window.
4. In the SMTP greeting text field, type the text that will accompany code 220 in the SMTP greeting.
5. In the Maximum connection attempts field, specify the maximum number of connection attempts by one remote SMTP client to the service of the SMTP server per minute.

   Type 0 if restrictions are not required.

   The default value is 0 (unrestricted).

6. In the Maximum simultaneous connection attempts field, specify the maximum number of simultaneous connection attempts by one remote SMTP client to the SMTP server.

   Type 0 if restrictions are not required.

   The default value is 50.

7. In the Maximum mail delivery requests field, specify the maximum number of message delivery requests from one remote SMTP client to the SMTP server per minute, regardless of whether this mail server accepts these messages or not.

   Type 0 if restrictions are not required.

   The default value is 0 (unrestricted).

8. In the SMTP session timeout field, specify the maximum period of time during which a request has to be received from the remote SMTP client and a response sent by the SMTP server.

   The default value is 30 seconds.

9. In the Interval between destination address connection attempts, specify the interval between attempts by the MTA queue manager to connect to the message destination address if the destination address is unavailable.

   The default value is 60 seconds.

10. In the Minimum delivery interval for Deferred queue field, specify the minimum interval between attempts to deliver a message that has been deferred into the Deferred queue.

    The default value is 300 seconds.

11. In the Maximum delivery interval for Deferred queue field, specify the maximum interval between attempts to send a message that has been deferred into the Deferred queue.

    The default value is 4000 seconds.

12. In the Maximum queue lifetime for a message, set a limit on the time during which a message with a permanent error status will be stored in the queue. When this time elapses, the message is considered undelivered.

    The default value is 3 days.

13. In the Deferred queue processing interval field, specify the frequency of scanning of the Deferred queue by the queue manager.

    The default value is 1000 seconds.

14. In the Maximum queue lifetime for a bounce message, set a limit on the time during which a bounce message with a permanent error status will be stored in the queue. When this time elapses, the message is considered undelivered.

    The default value is 3 days.

15. In the BCC address for all messages field, specify an optional email address for receiving blind carbon copies of all messages received by the MTA.
16. In the Check addresses format for RFC 821 compliance list, configure (enable or disable) checking of email addresses in the SMTP MAIL FROM and RCPT TO to verify that such addresses are in angle brackets and do not contain RFC 822 comments and phrases. This check prevents reception of messages from malicious applications.

    To configure checking of addresses, in the Check addresses format for RFC 821 compliance list select one of the following values:

    • Yes if you want to enable checking.
    • No if you want to disable checking.

    The default value is Yes.

17. Configure the Disable recipient verification SMTP VRFY setting, which enables or disables the SMTP VRFY command. The SMTP VRFY command prevents certain services from collecting email addresses.

    To enable or disable the SMTP VRFY command, select one of the following values in the Disable recipient verification SMTP VRFY list:

    • Yes if you want to enable the command.
    • No if you want to disable the command.

    The default value is Yes.

18. In the EHLO keywords not sent by SMTP server in response field, select check boxes next to those non-case-sensitive EHLO commands (for example: pipelining, starttls, auth), which your SMTP server will not announce in the response to the EHLO request from an external SMTP client.

    Default values: silent-discard, dsn, etrn.

19. Click OK.

    The Advanced MTA settings window closes.

Kaspersky Secure Mail Gateway Monitoring

This section provides information on mail traffic monitoring, the latest threats detected, and system resources.

Mail traffic monitoring

To evaluate the current status of Kaspersky Secure Mail Gateway mail traffic:

1. In the main window of the application web interface, open the management console tree and select the Monitoring section.
2. In the workspace, select the Email traffic tab.
3. Select one of the periods for which you want to display information about mail traffic.

   You can view information about mail traffic for the following periods: hour, day, week, or 30 days.

4. Select the option for displaying information in charts.

   You can view the charts with detected message by quantity or by size.

5. Select the status labels of messages (for example, Clean, Threats, Spam or all messages) information about which you want to view.

The workspace displays mail traffic charts for the selected period.

Monitoring of the latest detected threats

To view the list of the latest detected threats:

1. In the main window of the application web interface, open the management console tree and select the Monitoring section.
2. In the workspace, select the Latest Threats Detected tab.

   Two lists are displayed in the workspace:

   • Latest infected objects detected – 5 of the last objects detected.
   • Latest probably infected objects detected – 5 of the last objects detected.

Monitoring of system resources usage

To evaluate current usage of system resources:

1. In the main window of the application web interface, open the management console tree and select the Monitoring section.
2. In the workspace, select the System resources tab.
3. Select check boxes next to the types of data that you want to see in the system load chart (for example, you can select CPU, RAM, Swap or all options at once).
4. Select check boxes next to the types of data that you want to see in the network interfaces load chart (for example, you can select Sending, Receiving or all options at once).

The workspace displays the System and Network interfaces charts with the data you selected.

Kaspersky Secure Mail Gateway database update

This section contains information about updating Anti-Virus, Anti-Spam, and Anti-Phishing databases.

About database updates

Anti-Virus databases, Anti-Spam databases, and Anti-Phishing databases (hereafter also "databases") are files containing records that can be used to detect malicious code in scanned objects. These records contain information about the control sections of malicious code and algorithms used for disinfecting objects that contain such threats.

Virus analysts at Kaspersky Lab detect hundreds of new threats daily, create records to identify them, and include them in database updates packages (or update packages). Update packages consist of one or several files containing records to identify threats that were detected since the previous update package was released. In order to minimize the risk of infecting the protected server, we recommend that you receive database update packages regularly.

As long as the license is in effect, you can receive database update packages from Kaspersky Lab's website automatically on schedule, or download and install them manually.

During installation, Kaspersky Secure Mail Gateway downloads the latest databases from one of Kaspersky Lab's update servers. If you have configured automatic database updates, Kaspersky Secure Mail Gateway runs updates according to schedule (with a frequency of once per 5 minutes).

Kaspersky Secure Mail Gateway periodically and automatically checks for new update packages on Kaspersky Lab's update servers. By default, if the Kaspersky Secure Mail Gateway Anti-Virus databases have not been updated for 24 hours or Anti-Spam databases have not been updated for 1 hour since Kaspersky Lab released the last updates, Kaspersky Secure Mail Gateway logs the event Databases are out of date. If Anti-Virus databases have not been updated for a week or Anti-Spam databases have not been updated for 24 hours, Kaspersky Secure Mail Gateway logs the event Databases are extremely out of date. You can configure administrator notifications about these events.

About update sources

Update source is a resource containing updates for Kaspersky Secure Mail Gateway databases.

The main update source is Kaspersky Lab's update servers. These are special Internet sites which contain updates for databases and application modules for all Kaspersky Lab products. If you connect to the Internet via a proxy server, you have to configure the proxy server connection settings.

To reduce the amount of Internet traffic, you can configure Kaspersky Secure Mail Gateway to update databases from a custom update source. HTTP or FTP servers or local folders on your computer can serve as custom updates sources.

If Kaspersky Secure Mail Gateway is managed using Kaspersky Security Center, you can select Kaspersky Security Center as the update source.

Selecting the update source

To select the update source:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the Application database update settings section, click the Update source link to open the Application database update settings window.
3. In the Update source settings group, select the source from which you want to receive update packages:
   • Kaspersky Lab's update servers.
   • Kaspersky Security Center.
   • Custom update source.
4. If you selected a custom update source, in the field under Kaspersky Security Center enter the web address of the update package on your FTP or HTTP server or the full path to the folder with the update package.

   You can also select the If inaccessible, use Kaspersky Lab servers check box if you want to receive the update package from Kaspersky Lab update servers whenever the custom update source is unavailable.

5. Click OK.

Scheduling database updates

To configure the database update schedule:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the Application database update settings section, click the Schedule link to open the Application database update settings window.
3. In the Schedule settings group, select one of the following options in the drop-down list:
   • Manually.
   • Once.
   • Weekly.
   • Monthly.
   • Run every.
4. In the Schedule settings group, specify the frequency of database updates in the fields on the right of the drop-down list. The following values can be specified depending on the schedule selected:
   • If the database update start mode is set to Once, specify the date and time at which the database update is to start in the corresponding fields.
   • If the database update start mode is set to Weekly, specify the day of the week and the time at which the database update is to start in the corresponding fields.

     For example, if the values are set to Monday and 3:00 PM, the database update runs every Monday at 15:00.

   • If the database update start mode is set to Monthly, in the corresponding fields specify the day of the month and the time at which the database update is to start.

     For example, if the values are set to 20 and 3:00 PM, the database update runs on the 20th day of the month at 15:00.

   • For the Run every update start mode, specify the frequency of the update start in minutes, hours, or days in the corresponding fields:
     • To specify the frequency of updates in minutes, select the min. value in the list in the right part of the window, specify the frequency in minutes, and in the Starting at field specify the time of the first database update.

       For example, if the frequency value is set to 30, the min. frequency option has been selected, and the value of the Starting at field is set to 15:00, the database update starts every 30 minutes beginning at 3 p.m.

     • To specify the frequency of updates in hours, select the hours value in the list in the right part of the window, specify the frequency in hours, and in the Starting at field specify the date and time of the first database update.

       For example, if the frequency value is set to 3, the hr(s). frequency option has been selected, and the values the Starting at field are 25.12.2015 and 15:00, the database update starts every 3 hours beginning at 3 p.m. on December 25, 2015.

     • To specify the frequency of updates in days, select the days value in the list in the right part of the window, specify the frequency in days, and in the Starting at field specify the time of the first database update.

       For example, if the frequency value is set to 2, the days frequency option has been selected, and the value of the Starting at field is set to 15:00, the database update starts once every two days (every other day) at 3 p.m.

5. Click OK.

Configuring database updates

To configure database update settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the Application database update settings section, click the Schedule link to open the Application database update settings window.
3. In the Application database update settings section, in the Randomization interval field specify the deviation from the scheduled time (in minutes) after which the database update is to run on computers so that these computers do not attempt to access the update source simultaneously when the database update starts. This feature is provided to solve the problem of simultaneous access to the update source by a large number of computers when the database update starts.
4. In the Application database update settings section, in the Maximum duration field specify the maximum duration of the update process in minutes, after which the database update must be stopped.
5. In the Application database update settings section, in the Run skipped tasks list select the procedure for starting the task of the update was not performed at the scheduled time for one of the following reasons:
   • The computer was unavailable (turned off or disconnected from the Internet);
   • The application was not running.

   If the option to run missed tasks is enabled, an attempt is made to start the database update task the next time the application starts on the computer. In the Manually and Once update start mode, the database update task starts as soon as the computer goes online on the local area network.

   If the option to run missed tasks is disabled, the database update tasks are started on computers according to schedule only, and Manually and Once database updates are started only on computers connected to the local area network.

6. Click OK.

Setting default values for database update settings

To set default values for database update settings and the default database update schedule:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the Application database update settings section, click the Schedule link to open the Application database update settings window.
3. In the lower part of the Application Database Update Settings window, click the Set default values link.
4. Click OK.

Updating databases manually

To start a database update manually:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the workspace of the Application database update settings section, start the database update by clicking the Start update link.

   The Start update link is replaced with the Updating in progress text and the database update progress is displayed.

Configuring the proxy server connection settings

To enable or disable usage of a proxy server:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the workspace, do one of the following:
   • Flip on the toggle switch next to the name of the Use proxy server settings group if you want to use a proxy server with Kaspersky Secure Mail Gateway.
   • Flip off the toggle switch next to the name of the Use proxy server settings group if you do not want to use a proxy server with Kaspersky Secure Mail Gateway.

To configure the proxy server connection settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Database update subsection.
2. In the Use proxy server section, click any link to open the Connection settings window.
3. In the Proxy server settings section, select one of the following options in the Use proxy server drop-down list:
   • Yes — if you want to use a proxy server with Kaspersky Secure Mail Gateway.
   • No — if you do not want to use a proxy server with Kaspersky Secure Mail Gateway.
4. In the Address field, enter the proxy server address.
5. In the Port field, enter the proxy server port.
6. In the Authentication drop-down list in the Authentication settings group section, select one of the following options:
   • Not required — if you do not want to use authentication when connecting to the proxy server.
   • Plain — if you want to use authentication when connecting to the proxy server.
7. If the Authentication setting is set to Plain, enter the user name and password for connecting to the proxy server in the User name and Password fields.
8. In the Proxy server connection settings section, select one of the following values in the Bypass proxy for local addresses list:
   • Yes — if you do not want to use a proxy server for internal email addresses of your organization.
   • No — if you want to use a proxy server irrespective of whether or not email addresses belong to your organization.
9. Click OK.

Upgrading Kaspersky Secure Mail Gateway via the web interface

This section describes how you can upgrade Kaspersky Secure Mail Gateway via the web interface.

About Kaspersky Secure Mail Gateway upgrade via the web interface

Kaspersky Lab may release upgrade packages for Kaspersky Secure Mail Gateway. For example, Kaspersky Lab can release critical fixes for vulnerabilities or bugs, scheduled upgrades that add new or improve existing features of Kaspersky Secure Mail Gateway, and packages with additional localizations for Kaspersky Secure Mail Gateway.

Following the release of Kaspersky Secure Mail Gateway upgrades, you can install them via the web interface of Kaspersky Secure Mail Gateway.

Prior to installing upgrades via the web interface of Kaspersky Secure Mail Gateway, you have to download the upgrade package or the localization package in TGZ format along with instructions on how to install this upgrade from the eStore website to your computer.

Kaspersky Secure Mail Gateway services may be suspended for the duration of upgrade installation. The upgrade process may take several minutes. After starting an upgrade of Kaspersky Secure Mail Gateway, do not interrupt the upgrade process or turn off the virtual machine. You may need to restart Kaspersky Secure Mail Gateway after upgrading.

Preparing to upgrade Kaspersky Secure Mail Gateway via the web interface

Before upgrading Kaspersky Secure Mail Gateway, you are strongly advised to make a copy of your Kaspersky Secure Mail Gateway virtual machine (a snapshot of the virtual machine in the hypervisor) to be able to return to the previous version of Kaspersky Secure Mail Gateway if installation of the new version of Kaspersky Secure Mail Gateway fails.

To take a snapshot of a Kaspersky Secure Mail Gateway virtual machine:

1. Start VMware vSphere Client.
2. Select the virtual machine that you want to take a snapshot of.
3. Open the menu by right-clicking.
4. In the menu, select the Snapshot item and Take Snapshot sub-item (see figure below).

   

   Snapshot of the virtual machine

   The Take Virtual Machine Snapshot window opens (see figure below).

   

   Input of virtual machine snapshot data

5. In the Name field, enter the name of the virtual machine snapshot.
6. In the Description field, enter a description of the virtual machine snapshot.
7. Select the Snapshot the virtual machine's memory check box.

A snapshot of your virtual machine appears in the list of virtual machines in the left part of the main application window.

See VMware vSphere Client manuals for details on managing virtual machines in VMware vSphere Client.

Performing Kaspersky Secure Mail Gateway upgrade via the web interface

To upgrade Kaspersky Secure Mail Gateway via the web interface:

1. In the main window of the application web interface, open the management console tree and select the Settings section and System Upgrade subsection.
2. Click the Start upgrade link to open the System Upgrade window.
3. Click the Browse button to the right of the Uploading Upgrade Package field.

   The file selection window opens in the web browser that you use.

4. Choose the upgrade file that you want to upload and click the Open button in your web browser.

   The file selection window closes.

5. Click the Next button.
6. Follow the steps of the Upgrade Wizard.

   The steps of the Upgrade Wizard may vary depending on the type of upgrade.

More detailed instructions on installing each upgrade are provided in the instruction manual that comes with this upgrade.

Anti-Virus protection

This section contains information about Anti-Virus protection of messages and how to configure it.

About Anti-Virus protection

Kaspersky Secure Mail Gateway performs virus scanning of messages: scans email messages for viruses and other threats and disinfects infected objects using the current (latest) version of Anti-Virus databases.

Messages are scanned for viruses and other threats by Anti-Virus engine. Anti-Virus engine scans the body of the message and all attached files in any format (attachments) using the Anti-Virus databases. The Anti-Virus engine detects and blocks email attachments that are intended for a limited number of recipients and are components of targeted attacks designed to exploit software vulnerabilities.

In addition to virus scanning of messages, you can enable detection of certain legitimate applications by the Anti-Virus component.

Based on the scan results, the Anti-Virus engine assigns the message one of the virus scan status labels and adds a tag with the status at the beginning of the message subject (Subject field).

Depending on the status assigned, the application performs actions in accordance with the message processing rule settings. You can select actions to be performed by the application on messages with a certain status and configure tags to be added to messages based on the Anti-Virus scanning result. Before processing a message, the application saves a copy of it in Backup.

You can specify the maximum size of attachments to be scanned and determine the objects to be skipped during Anti-Virus scanning. Attachments in certain formats and with certain names can be excluded from the scan.

The Anti-Virus engine is enabled by default. If required, you can disable Anti-Virus module or disable Anti-Virus scanning for any rule.

About Anti-Virus protection status

Based on the results of scanning for viruses, the Anti-Virus engine assigns one of the following Anti-Virus scan statuses to messages:

• Clean (Clean message)– the object is not infected.
• Infected (Infected message)– the object is infected; either it cannot be disinfected, or disinfection has not been attempted.
• Disinfected (Disinfected message) – the object is disinfected.
• Probably infected (Probably infected message) – the object is probably infected with an unknown virus or a new modification of a known virus.
• Encrypted (Encrypted message) – the object cannot be scanned because it is encrypted.
• Corrupted (Corrupted message) – the object is corrupted or an error occurred during scanning.

Enabling and disabling Anti-Virus protection of messages

To enable or disable Anti-Virus protection of messages:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Virus settings group to enable Anti-Virus scanning of messages.
   • Flip off the toggle switch next to the name of the Anti-Virus settings group to disable Anti-Virus scanning of messages.

Enabling and disabling Anti-Virus scanning for a rule

You can enable or disable Anti-Virus scanning of messages for one or several rules. Anti-Virus scanning is enabled by default.

Before enabling or disabling Anti-Virus scanning of messages for a rule, make sure that Anti-Virus engine of Kaspersky Secure Mail Gateway is enabled.

To enable or disable Anti-Virus scanning of messages for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the name of the rule to open the rule for which you want to enable or disable Anti-Virus scanning of messages.
3. Select the Authentication of Mail Sender section.
4. Do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Virus settings group to enable Anti-Virus scanning of messages for a rule.
   • Flip off the toggle switch next to the name of the Anti-Virus settings group to disable Anti-Virus scanning of messages for a rule.
5. Click the Apply button in the lower part of the workspace.

Configuring Anti-Virus engine settings

To configure Anti-Virus engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, click any link to open the Anti-Virus protection settings window.
3. In the Protection and heuristic analysis settings group, select one of the following options in the Use KSN drop-down list:
   • Yes — if you want to use KSN.
   • No — if you do not want to use KSN.
4. In the Protection and heuristic analysis settings group, select one of the following options in the Use heuristic analysis drop-down list:
   • Yes — if you want to use Heuristic Analysis.
   • No — if you do not want to use Heuristic Analysis.
5. If you have enabled Heuristic Analyzer, in the Protection and heuristic analysis settings group in the Heuristic analysis level list select the level of heuristic analysis.
6. In the Protection and heuristic analysis settings group, open the drop-down list I consider some legitimate applications that can be exploited by hackers, to be dangerous for the corporate LAN and select one of the following options:
   • Yes if you believe that such applications can be exploited by criminals to harm the computer network of your organization.
   • No if you do not believe that such applications can be exploited by criminals to harm the computer network of your organization.

   Such legitimate applications include, for example, commercial remote administration utilities, IRC clients, dialers, file downloaders, computer system activity monitors, and password management utilities. Messages found to contain such applications are processed according to the rules for infected and probably infected objects.

7. If your selection in the I consider some legitimate applications that can be exploited by hackers, to be dangerous for the corporate LAN list is Yes, select one of the following options in the Protection and heuristic analysis section in the Enable detection of some legitimate applications drop-down list:
   • Yes if you want to enable detection of such applications by Kaspersky Secure Mail Gateway.
   • No if you want to disable detection of such applications by Kaspersky Secure Mail Gateway.
8. In the Performance settings group, in the Maximum scanning time field specify the maximum Anti-Virus scan time in seconds.

   If the virus scan of a message does not finish within the time limit you specified, Kaspersky Secure Mail Gateway:

   • Stops scanning the message (Skip action).
   • Assigns Clean (Clean message) status to the message.
   • Adds the av-status="Clean" label to the message subject.
   • Delivers the message to the recipient.
   • Adds the following entry to the /var/log/maillog event log:

     <scan date and time> <Kaspersky Secure Mail Gateway host name>: not clean: message-id=<message ID>: relay-ip=<IP address of message recipient's computer>: action="Skipped": rules=<rule ID>: size=<message size>: mail-from=<message sender's email address>: rcpt-to=<message recipient's email address>: av-status="Clean", ap-status="Error", as-status="Error", ma-status="NotScanned, disabled by settings", cf-status="NotScanned, disabled by settings">

9. In the Performance settings group, in the Maximum scanning level field specify the maximum scanning level for messages scanned by the Anti-Virus engine.
10. Click the Apply button.

Setting default values for Anti-Virus engine settings

To set default values for Anti-Virus engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, click any link to open the Anti-Virus protection settings window.
3. In the lower part of the Anti-Virus settings window, click the Set default values link.
4. Click the Apply button.

Configuring actions on messages during Anti-Virus scanning

To configure the actions to be performed by Kaspersky Secure Mail Gateway on messages during Anti-Virus scanning:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the link with the name of the rule to open the rule for which you want to configure actions on messages during Anti-Virus scanning.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. In the If an infected or probably infected object is detected drop-down list, select one of the following actions to perform on infected or probably infected messages that pose a threat to the local area network of your organization:
   • Disinfect
   • Delete attachment.
   • Delete message.
   • Reject.
   • Skip.
6. If the value of the If an infected or probably infected object is detected setting is set to Disinfect, in the right part of the workspace in the If disinfection fails drop-down list select one of the following actions to be performed on infected or probably infected messages that could not be disinfected:
   • Delete attachment.
   • Delete message.
   • Reject.
7. If the value of the If an infected or probably infected object is detected is set to Disinfect, Delete attachment, or Delete message, you can configure message copies to be automatically saved in Backup before messages are processed. To do so, select the check box next to the Place copy in Backup setting name.

   By default, the application places a message copy in Backup before performing the Disinfect, Delete attachment, or Delete message action.

8. In the If scan errors detected drop-down list, select one of the following actions to take on messages that returned errors during scanning:
   • Delete attachment.
   • Delete message.
   • Reject.
   • Skip.
9. In the If encrypted object is detected drop-down list, select one of the following actions to take on messages containing encrypted objects:
   • Delete attachment.
   • Delete message.
   • Reject.
   • Skip.
10. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.

Configuring tags added to message subjects after Anti-Virus scanning

To configure tags that Kaspersky Secure Mail Gateway adds to the message subject after Anti-Virus scanning:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the name of the rule to open the rule for which you want to configure tags added to message subjects after Anti-Virus scanning.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. Add a tag to the Subject field of infected messages. To do so, perform the following:
   1. In the If an infected or probably infected object is detected settings group, click the link on the right of the name of the Add the following text to the subject of an infected or probably infected email message setting to open the Tag for messages that contain malicious objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of infected or probably infected messages. For example, you can add the Infected tag.
   3. Click OK.

      The Tag for messages that contain malicious objects window closes.

6. Add a tag to the Subject field of disinfected messages. To do so, perform the following:
   1. In the If an infected or probably infected object is detected settings group, click the link on the right of the name of the Add the following text to the subject of a disinfected email message setting to open the Tag for messages that contain disinfected objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of disinfected messages. For example, you can add the Cured tag.
   3. Click OK.

      The Tag for messages that contain disinfected objects window closes.

7. Add a tag to the Subject field of messages with objects found to contain errors during scanning. To do so, perform the following:
   1. In the If scan errors detected settings group, click the link on the right of the name of the Add the following text to subject of email message setting to open the Tag for messages with objects that cause scan errors window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of messages that returned scan errors. For example, you can add the Corrupted tag.
   3. Click OK.

      The Tag for messages with objects that cause scan errors window closes.

8. Add a tag to the Subject field of messages that contain encrypted objects. To do so, perform the following:
   1. In the If encrypted object is detected settings group, click the link on the right of the name of the Add the following text to subject of email message setting to open the Tag for messages that contain encrypted objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of messages containing encrypted objects. For example, you can add the Encrypted tag.
   3. Click OK.

      The Tag for messages that contain encrypted objects window closes.

9. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.

Configuring Anti-Virus scan restrictions and exclusions

To configure restrictions and exclusions during Anti-Virus scanning for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the link with the name of the rule to open the rule for which you want to configure restrictions and exclusions from Anti-Virus scanning of messages.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. If you want to exclude archives from Anti-Virus scanning, in the Exclusions from scanning settings group select the Do not scan archives check box.
6. To exclude message attachments of a certain size from Anti-Virus scanning, do the following in the Exclusions from scanning settings group:
   1. Click the link on the right of the Do not scan objects larger than: setting to open the Attachment size scan limit window.
   2. In the field under the window name, enter the maximum size of objects to be scanned in the range from 0 KB to 1048576 KB (1 GB).

      If the value is set to 0 KB, no restrictions apply to the size of objects.

   3. Click OK.

      The Attachment size scan limit window closes.

7. To exclude message attachments with certain names from Anti-Virus scanning, do the following in the Exclusions from scanning settings group:
   1. Click the link on the right of the name of the Do not scan attachments by name masks setting to open the Forbidden names window.
   2. In the field under the window name, enter the masks of names of attachments that you want to exclude from Anti-Virus scanning.

      Masks can contain any symbols. Separate masks with the ";" symbol.

   3. Click OK.

      The Forbidden names window closes.

8. To exclude message attachments of a certain format from Anti-Virus scanning, do the following in the Exclusions from scanning settings group:
   1. Click the link on the right of the name of the Do not scan attachments by file types setting to open the Forbidden attachment types window.
   2. Select check boxes next to the formats of attachments that you want to exclude from Anti-Virus scanning.
   3. Click the Close button.

      The Forbidden attachment types window closes.

9. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.

Anti-Spam protection

This section contains information about Anti-Spam protection of messages and how to configure it.

About Anti-Spam protection

Kaspersky Secure Mail Gateway filters messages passing through the mail server to remove unsolicited mail (spam).

Messages are scanned for spam by the Anti-Spam engine. Anti-Spam engine scans each message for signs of spam. First, Anti-Spam engine scans the attributes of the message, such as sender and recipient addresses, size, and headers (including the From and To fields). Second, Anti-Spam engine analyzes the message content (including the Subject header) and attached files. Anti-Spam engine is enabled by default. If required, you can disable the Anti-Spam engine or disable Anti-Spam scanning for any rule. You can also limit the size of messages to be scanned for spam.

Depending on the sensitivity level, the application assigns messages in which spam or probable spam has been detected the specific statuses in accordance with the spam rating calculated by Anti-Spam. Spam rating is a whole number from 0 to 100 that reflects the number of times Anti-Spam engine was actuated in processing the message. The application also takes into account the responses from the DNSBL, SURBL and UDS servers, SPF technology, and results of reputation filtering to assign the spam rating to messages.

Reputation filtering is a cloud service that uses a technology that determines the reputation of messages. Information about new kinds of spam appears in the cloud service sooner than in Anti-Spam module databases, making it possible to improve the speed and accuracy of spam detection.

Depending on the status assigned, the application performs actions in accordance with the message processing rule settings. You can select actions to be performed by the application on messages with a certain status and configure tags to be added to messages based on the Anti-Spam scanning result. The default action performed on messages is Skip.

Anti-Spam functionality can be configured by editing the settings file for the Anti-Spam engine. In the settings file, you can change, for example, statuses of Anti-Spam scanning of messages or the level of detail of email message information recorded in the Kaspersky Secure Mail Gateway event log.

The settings file of the Anti-Spam engine can be accessed from the Kaspersky Secure Mail Gateway Administration Console in Technical Support Mode with super-user account privileges.

About Anti-Spam message scan status labels

Based on the results of scanning for spam, the Anti-Spam engine assigns one of the following Anti-Spam scan statuses to messages:

• Clean (Not Spam) – the message contains no spam.
• Spam – the application unambiguously recognizes the message as spam.
• Probable Spam – the message may contain spam.
• Blacklisted – the sender's email address is on the global or custom black list of addresses, or the host IP address or DNS name are on the DNSBL black list.
• Massmail – the message belongs to a mass mailing campaign.
• Scan Error – message scanning returned an error.

Enabling and disabling Anti-Spam protection of messages

To enable or disable Anti-Spam protection of messages:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Spam settings group to enable Anti-Spam protection of messages.
   • Flip off the toggle switch next to the name of the Anti-Spam settings group to disable Anti-Spam protection of messages.

Enabling and disabling Anti-Spam scanning of messages for a rule

You can enable or disable Anti-Spam scanning of messages for one or several rules. Anti-Spam scanning of messages is enabled by default.

Before enabling or disabling Anti-Spam scanning of messages for a rule, make sure that Anti-Spam engine of Kaspersky Secure Mail Gateway is enabled.

To enable or disable Anti-Spam scanning of messages for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the name of the rule to open the rule for which you want to enable or disable Anti-Spam scanning of messages.
3. Select the Anti-Spam section.
4. Do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Spam settings group to enable Anti-Spam scanning of messages for a rule.
   • Flip off the toggle switch next to the name of the Anti-Spam settings group to disable Anti-Spam scanning of messages for a rule.
5. Click the Apply button in the lower part of the workspace.

Configuring Anti-Spam engine settings

To configure the Anti-Spam engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click any of the following links: Use KSN, Use enforced Anti-Spam Updates Service, Use reputation filtering, or Maximum scanning time to open the Anti-Spam settings window.
3. In the External services settings group, select one of the following options in the Use KSN drop-down list:
   • Yes — if you want to use KSN.
   • No — if you do not want to use KSN.
4. In the External services settings group, select one of the following options in the Use enforced Anti-Spam Updates Service drop-down list:
   • Yes — if you want to use enforced Anti-Spam Updates Service.
   • No — if you do not want to use enforced Anti-Spam Updates Service.
5. In the External services settings group, select one of the following options in the Use reputation filtering drop-down list:
   • Yes — if you want to use the reputation filtering service.
   • No — if you do not want to use the reputation filtering service.
6. In the Performance settings group, in the Maximum scanning time field specify the maximum Anti-Spam scan time in seconds.

   If Anti-Spam scanning of a message does not finish within the time limit you specified, Kaspersky Secure Mail Gateway:

   • Stops scanning the message (Skip action).
   • Assigns Error (Scan error) status to the message.
   • Adds the as-status="Error" label to the message subject.
   • Delivers the message to the recipient.
   • Adds the following entry to the /var/log/maillog event log:

     <scan date and time> <Kaspersky Secure Mail Gateway host name>: not clean: message-id=<message ID>: relay-ip=<IP address of message recipient's computer>: action="Skipped": rules=<rule ID>: size=<message size>: mail-from=<message sender's email address>: rcpt-to=<message recipient's email address>: av-status="Clean", ap-status="Error", as-status="Error", ma-status="NotScanned, disabled by settings", cf-status="NotScanned, disabled by settings">

7. Click the Apply button.

Setting default values for Anti-Spam engine settings

To set default values for Anti-Spam engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click any of the following links: Use KSN, Use enforced Anti-Spam Updates Service, Use reputation filtering, or Maximum scanning time to open the Anti-Spam settings window.
3. In the lower part of the Anti-Spam settings window, click the Set default values link.
4. Click the Apply button.

Configuring the custom DNSBL list for the Anti-Spam engine

You can create a custom list of DNSBL servers to improve the accuracy of spam detection. DNSBL servers stores lists of IP addresses that were previously detected as sources of spam and to which the Anti-Spam engine assigns a spam rating and one of the Anti-Spam message scan status labels.

To create the custom DNSBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom DNSBL list link to open the Custom DNSBL list window.
3. In the field under the window name, type DNS names or IP addresses into the DNSBL list.

   You can use only these symbols: a–z, A–Z, 0–9, "-" and ".", and the "-" symbol must not come last. For example, you can add the sender's DNS name dns-bl.example.com or the sender's IP address 10.0.0.1 to the list.

   Separate the addresses with the ";" symbol.

4. Click the Apply button.

To view the custom DNSBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom DNSBL list link to open the Custom DNSBL list window.
3. Click the Apply or Cancel button after you finish managing the list.

   The Custom DNSBL list window closes.

To remove an entry from the custom DNSBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom DNSBL list link to open the Custom DNSBL list window.
3. In the field under the window name, select one or several accounts that you want to delete.
4. Press the Delete key.
5. Click the Apply button.

Configuring the custom SURBL list for the Anti-Spam engine

You can create a custom list of SURBL servers to improve the accuracy of spam detection. SURBL servers store lists of web addresses that were previously detected in the subject or body of messages recognized as spam and to which the Anti-Spam engine assigns a spam rating and one of the Anti-Spam message scan status labels.

To create the custom SURBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom SURBL list link to open the Custom SURBL list window.
3. In the field under the window name, type DNS names or IP addresses into the SURBL list.

   You can use only these symbols: a–z, A–Z, 0–9, "-" and ".", and the "-" symbol must not come last. For example, you can add the DNS name dns-bl.example.com or the IP address 10.0.0.1 to the list.

   Separate the addresses with the ";" symbol.

4. Click the Apply button.

To view the custom SURBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom SURBL list link to open the Custom SURBL list window.
3. Click the Apply or Cancel button after you finish managing the list.

   The Custom SURBL list window closes.

To remove an entry from the custom SURBL list of the Anti-Spam engine:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Spam section, click the Custom SURBL list link to open the Custom SURBL list window.
3. In the field under the window name, select one or several accounts that you want to delete.
4. Press the Delete key.
5. Click the Apply button.

Configuring Anti-Spam scan settings for a rule

You can configure the settings of the Anti-Spam engine for one or several rules.

To configure the settings of the Anti-Spam engine for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the link with the name of the rule to open the rule for which you want to configure the Anti-Spam engine settings.
3. Select the Anti-Spam section.
4. Flip on the toggle switch next to the name of the Anti-Spam settings group if it is off.
5. In the General settings section, select check boxes next to the names of the general settings that you want to enable:
   1. Use graphical image processing technologies — if you want to use GSG technology that identifies images containing text in order to determine whether such text is spam. The text is recognized regardless of whether it has been modified, rotated in the image, hidden behind "noise" or otherwise modified to conceal the purpose of the image.
   2. Scan RTF attachments — if you want the Anti-Spam engine to scan all message attachments in RTF format.
6. In the Scan using external services settings group, select check boxes next to the names of settings that control usage of external services you want to enable:
   1. Use provided DNSBL list if you want the Anti-Spam engine to check senders' addresses against the Kaspersky Lab-provided list of addresses previously detected as spam sources.
   2. Use custom DNSBL list, if you want the Anti-Spam module to check if the senders' addresses are listed on DNSBL servers specified in the custom DNSBL list.

      You can view the custom DNSBL list by clicking the custom link in the name of the Use custom DNSBL list setting.

   • Use provided SURBL list if you want the Anti-Spam engine to scan the message subject and body for web addresses appearing in the Kaspersky Lab-provided list of addresses that were previously detected in the subject or body of messages categorized as spam.
   1. Use custom SURBL list, if you want the Anti-Spam module to check if web addresses present in the message subject and body are listed on SURBL servers specified in the custom SURBL list.

      You can view the custom SURBL list by clicking the custom link in the name of the Use custom SURBL list setting.

7. In the Raise spam rating if settings group, select check boxes next to the names of languages and fonts that, when used in the message, increase the spam rating of the message:
   1. Message written in Chinese — if you want the Anti-Spam engine to increase the spam rating of messages written in Chinese.
   2. Message written in Japanese — if you want the Anti-Spam engine to increase the spam rating of messages written in Japanese.
   3. Message written in Korean — if you want the Anti-Spam engine to increase the spam rating of messages written in Korean.
   4. Message written in Thai — if you want the Anti-Spam engine to increase the spam rating of messages written in Thai.
   5. Message uses Cyrillic script — if you want the Anti-Spam engine to increase the spam rating of messages written using the Cyrillic script.
8. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Spam scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.