Skip to main content
Sign in
Deutsch Español Français Italiano

Relay Configuration

From this page you can configure all relay options for your system.

There are 8 sections that allow you to customize LibraCyber ESG relay options:

  • Domain Relay
  • Trusted Networks
  • SMTP Auth
  • SPF Filtering
  • RBL Filtering
  • SMTP Restrictions
  • SMTP Checks Override
  • Smarthost Relay

Domain Relay

In this section you can configure on what domain LibraCyber ESG will be used as relay. LibraCyber ESG is capable of managing mail for multiple domains, in addition to the one specified during the installation procedure.

Table entries

For each relay entry configured are displayed these information:

  • Domain (the domain for which ESG acts as a relay)
  • Mail Server (the mailserver ESG will use to deliver the incoming emails for the domain)
  • Port (the port used to access to the mailserver)
  • Recipient Verification (the Recipient Verification method set for the domain)
  • Antispoofing (the antispoofing mechanism used for the domain)
  • RBL Check (RBL rejection for mail sent to this domain)
  • Tag (a generic label in order to make big appliances relay management easier for the administrator)

Relay Entry Test

For each relay entry configured you can perform a test, in order to check if the configuration you created works correctly. In order to begin the test you can click on the Test play button at the end of the table line related to the relay entry you want to test. You will be redirected to the Relay Configuration Test Tool page. Here you can perform the relay entry configuration test by typing an email address and choose if enable the TLS for this test.

Note: the SMTP authorization and restrictions are not tested by this tool.

Add a record

To add a domain press the New button and fill in all required information:

  • Domain: this is the domain name you want to add. You can specify also a single email to achieve a special route or include all subdomains by inserting a trailing dot before the domain name: domain.com. The subdomain must be declared (i.e. subdomain.example.com). You can also add a mail address as a domain to obtain more granular options.
  • Mail Server: indicates the final destination mail server where LibraCyber ESG will forward the scanned email to
  • Port: the Mail Server port (default 25)
  • Use MX: use DNS MX resolution of what indicated as Mail Server above to find out the final destination
  • Recipient Verification: select recipient verification policy. (Disabled/Valid Recipient List/Dynamic Verification)
  • Dynamic Verification Server: the dynamic verification server address (available only if Dynamic Verification is selected as the Recipient Verification method)
  • Dynamic Verification Port: the dynamic verification server port number (available only if Dynamic Verification is selected as the Recipient Verification method)
  • Domain Antispoofing: select antispoofing verification policy (Standard SPF/Trusted Only)
  • Tag: label used for massive searches/modifications

Table toolbar

In the table toolbar are available several actions in order to let the appliance administrator managing relay entries:

  • New (adds a new relay entry)
  • Search (filters out the displayed entries)
  • Export (exports the relay table in CSV, XML or print the rendered table)
  • Delete (deletes a relay table entry)
  • Text Import (allows you to import a relay table previously exported from an other LibraCyber ESG appliance)
  • Recipient Verification (allows you to bulk set a Recipient Verification algorithm for the selected entries)
  • Set Antispoofing (allows you to bulk set an Antispoofing mechanism for the selected entries)
  • Set RBL (allows you to bulk enable or disable the RBL Checks for the selected entries)
  • Set Server (allows you to bulk edit the mailserver settings, like the address and port, for the selected entries)

Trusted Networks

LibraCyber ESG allows relay from all Trusted Networks defined here. Typically you will add your internal mail server, or any host you want to authorize to send email through LibraCyber ESG. This function allows you only to make LibraCyber ESG to act as relay from a trusted source. This is not a whitelist function, so emails received from these hosts will be analyzed.

Table entries

For each trusted networks entry configured are displayed these information:

  • Network (the network from LibraCyber ESG will allow relay)
  • Mail service type (Public or shared service can relay only email with envelope sender domain listed in local relay and are subject to SMTP checks )
  • Comment (a generic text field commonly used to better filter out the table entries during searches)

Table toolbar

In the table toolbar are available several actions in order to let the appliance administrator managing trusted networks:

  • New (adds a new trusted networks entry)
  • Search (filters out the displayed entries)
  • Export (exports the table in CSV, XML or print the rendered table)
  • Delete (deletes a table entry)
  • Text Import (import a CSV file with the following presets)

Manage Hosted Services

When these options are enabled LibraCyber ESG will automatically manage the IP ranges for Microsoft 365 and/or Google Workspace trusting them. Updates are performed daily.

Note: in order to trust these services your ESG license must have the Microsoft 365 and/or Google Workspace support.

SMTP Auth

SMTP Auth allows the configuration of credentials for authenticated SMTP sessions, which will be relayed by LibraCyber ESG.

From the first section you can configure the authentication mechanism used by ESG to authenticate the SMTP session. You can login your SMTP session via LDAP or via Local Users (local authentication).

Local Users

By selecting "Local Users" as authentication mechanism you can create SMTP authentication users in the local database of LibraCyber ESG. A local SMTP Auth user is identified by an username and a password combination.

LDAP

By selecting "LDAP" as authentication mechanism you can configure an LDAP set used for SMTP authentication.

In order to configure an LDAP set you need to configure the following parameters:

  • LDAP server (the hostname or IP of the LDAP server)
  • LDAP Port (the port of the LDAP server)
  • LDAPS (decide to enable LDAP over TLS)
  • LDAP Search Base (the starting point for the search)
  • LDAP Bind DN (the DN to bind to the LDAP directory)
  • LDAP Password (the password of the bind)
  • LDAP Filter (the filter to select the users)
  • LDAP Default Realm (the realm to assign to the %r token when the realm is not available)

SPF Filtering

LibraCyber ESG can do SPF (Sender Policy Framework) checks at the SMTP level on both HELO and MAIL-FROM commands.

SPF

In this section you can configure when LibraCyber ESG will reject the email during the HELO and MAIL FROM commands.

  • SPF Not Pass (reject when the result is not 'Pass/None/Tempfail')
  • Softfail (reject when the result is 'Softfail' or 'Fail')
  • Fail (reject when the result is 'Fail')
  • Null (only reject when the result is 'Fail' for null sender)
  • False (never reject/defer, append header only)
  • Externally Verified (reject if the SPF is not externally verified: the SPF must be validated by an external gateway)

 SPF sender domain exceptions

In this section you can configure a list of sender domains that will override SPF checks. All SPF check will be ignored at SMTP level so failing email won't be rejected.

Note: other policies like DMARC and antispam check will continue to work regardless of this exceptions.

RBL Filtering

Any antispam filter uses public RBL’s to originate spam. LibraCyber ESG makes no exception and, from this page, you can define which RBL’s you want to use.

To add and enable an RBL entry press the New button and set below parameters:

  • RBL address (the address of the RBL like rbl.myrbldomain.tld)
  • Matches (the IP address that matches in the RBL)
  • Comment (an useful text field used to sort or search RBL entries when they are a lot)
  • Enabled (decide to keep the RBL enabled or disabled after creation)

Note: remember to click on the "Apply Settings" button in order to make the changes effective.

SMTP Restrictions

From this panel, you can configure rejects based on SMTP protocol restrictions.

You can enable/disable these SMTP restrictions:

  • RevDNS Filtering
  • Require Fully Qualified Hostname
  • Require Resolvable Hostname
  • Require Fully Qualified Domain Names
  • Reject Unknown Sender Domain

SMTP Checks Override

From this section, you can configure a list of networks that will override SMTP checks. This is very handy when a particular sender is blocked by an SMTP check (i.e. RBL Listed, Antispoofing check, SPF, etc.) and you need a permissive rule to allow relay from its IP as a workaround.

To add a new exception press the New button and specify the sender network in CIDR format and a comment if needed.

Note: remember to press the "Apply Settings" button after the record creation or the record creation will be not effective.

Sender dependent Smart-host relay

Outgoing email can be sent to a configurable next-hop relay host, instead of using the public MX records to identify the email destination directly.

The next-hop is determined with the following priority:

  1. Recipient-based relay transport
  2. Sender-based smart hosts
  3. Default smart-host
  4. Standard public DNS lookups

From this page you can configure enable or disable this feature and you can set a list of hosts that LibraCyber ESG will use as next hop relays according to the Source address or domain. SMTP authentication is fully supported by this feature, so you can set an username and a password to use to perform the login on the next hop relay.

Related articles