Security (* administrator only)
The options on this page allow you to enable spam filters, antivirus scan, black and white list, content scan and authentication in order to protect your system and Synology Mail Server users.
Spam
Enable the options below to manage and avoid receiving junk mail.
To enable SpamAssassin spam filter:
- Check the box Enable SpamAssassin filter engine to filter out spam based on content-matching rules.
- Enter a number of days in the Delete spam interval field to specify when spam messages will be deleted.
- Click the SpamAssassin Settings button to see more options.
- Adjust the score which messages must exceed to be marked as spam (Low, 5; Medium, 7.5; High, 10).
- Specify custom text which can be added to the subjects of spam.
- Choose to report spam as an attachment encapsulated in a new message, or convert it into plain text to avoid unwanted web bugs and scripts.
- Enable Auto learning or Auto white list to further improve spam filtering. If Auto learning is enabled, choose the spam score which messages must exceed to be added to the "learn as spam" database. Auto white list will assign a corresponding score to messages automatically.
- Click the Custom Spam Filter button to create and manage rules to automatically mark certain messages as spam or non-spam. Rules that mark messages as non-spam take priority over rules that mark messages as spam. You can also import your rules to better detect spam.
- Click OK to save settings.
Note:
- Spam will be moved to junk automatically and deleted after the specified time elapses.
- To achive accuracy in spam detection, enable Auto white list after Auto learning has been enabled for a while.
- To create customized rules, please refer to this website.
- The rules to be imported into Custom Spam Filter must be in CF format.
To enable DNS-based Blackhole List spam filter:
Enable DNS-based Blackhole List filter based on a list of IP addresses of computers or networks to filter out spam published through the Internet Domain Name Service.
- Tick Enable DNS-based Blackhole List filter.
- Click the DNSBL Servers button to manage the list of DNSBL servers.
- Click Create and specify the Server and Server type. Click OK.
- Click Edit to edit the DNSBL server.
- Click Delete to delete the DNSBL server.
To reduce spam mails:
- Click the Advanced Anti-Spam Settings button.
- Tick the boxes to reject emails that match the selected conditions.
Antivirus
Enable antivirus to scan all incoming and outgoing messages for viruses. If an infected message is detected, the system will delete the message and notify the sender.
Note:
- This is only available on models with 512MB or more RAM.
Black and White List
The Black and White List feature allows you to reject, discard, or allow certain messages based on various criteria, such as the sender, domain, or the mail client IP address. For example, you can create a rule to always reject messages sent from a certain email address (e.g. "menelaus@argos.com"), a domain (e.g. "argos.com"), or mail clients from a certain IP address ("192.168.123.456").
To create black and white list rules:
- Click the Black and White List button.
- Click Create.
- Specify the criteria for the rule, for example:
- If you specify the IP address as "192", the messages from "192.*.*.*" will be targeted.
- If you specify the email address as "admin@", the messages from "admin@domain" will be targeted.
- Choose what to do with messages that fit the criteria:
- Reject it: The message will not be sent from or received by Synology Mail Server.
- Accept it: The message will be accepted whether or not it was blocked by the DNSBL list.
- Discard it: The message will be discarded. Synology Mail Server will not inform the sender.
- Click OK to save the settings.
Rule Priority:
- Messages that match multiple types of rules are handled in the following order: IP address of mail client > Sender rules > Recipient rules.
- For example, there are the following two rules:
- IP address of mail client: 192.168.48.15 --> Reject it
- 'From:' address contains: username@mail.com --> Accept it
In this case, if a message is sent from "username@mail.com," but the IP address of the client that sent the message is "192.168.48.15," then the message will be rejected, because IP address of mail client rules have greater priority.
- Rules with matching content but different actions are handled in the following order: Reject it > Discard it > Accept it.
Note:
- The user rules to be imported must be in the Postflix format.
To set daily sending quota:
- Tick Enable daily sending quota.
- Enter a quota to limit the number of emails users are allowed to send daily. You can also enter 0 if you do not want to impose any quota limits.
- Click the Advanced Settings button if you want to set an individual daily quota for specific users.
To filter emails by attachment file types:
- Click the Attachment Filter button.
- Click Create to enter file types. Emails that contain attachments of the listed file types will be rejected.
Note:
- Please enter the file types using simple regular expressions. For example, if you enter vb[es], both the vbe and vbs file types will be rejected.
Content Scan
You can allow the system to scan messages for potentially dangerous content.
To scan emails for dangerous content:
- Tick Enable dangerous content scan.
- Tick the desired boxes:
- Reject partial messages: Since these messages cannot be scanned properly for viruses and inappropriate content, they will be rejected to avoid potential virus infection.
- Reject external message bodies: Messages whose bodies are stored elsewhere on the Internet will be rejected to avoid fetching viruses from other Internet sites when downloading the message bodies.
- Highlight phishing fraud: The sections containing potential phishing fraud will be highlighted in the messages.
- Convert HTML into plain text: If HTML messages contain dangerous tags, they will be converted to plain text to make the HTML harmless, while still allowing you to read the text content.
- Reject: Reject messages containing corresponding tags.
- Allow: Allow corresponding tags in messages.
- Make tags ineffective: Allow corresponding tags in messages but make them ineffective so that users are still able to see the text content.
- Click OK to save settings.
Authentication
You can enable authentication mechanism to validate inbound emails and reduce spams.
To enable SPF verification:
- Tick Enable SPF verification to verify sender identity and detect forged sender addresses.
- Tick Reject SPF softfail if necessary. Emails whose verification result is softfail will be rejected.
To enable DKIM:
- Tick Enable DKIM to sign your outbound emails and to validate inbound emails and the senders' signatures.
- Enter a DKIM selector prefix of your own choice, and click the Generate Public Key button to generate a public key.
- Add and update the public key to your DNS records using a TXT record, so that other mail servers will be able to authenticate your DKIM signature. The TXT record should be added as follows:
- TXT record name: [DKIM selector prefix]._domainkey.[your domain]
([DKIM selector prefix] should be replaced with the prefix you entered above, and [your domain] should be replaced with your actual domain name. For example: 123._domainkey.example.com)
- TXT record value: v=DKIM1; k=rsa; p=[DKIM public key]
([DKIM public key] should be replaced with the key you generated above. For example: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQE)
To enable DMARC:
- Tick Enable DMARC to validate the senders' email domains.
- Update your DNS records using a TXT record, so that your outbound emails will be able to pass DMARC authentication of other mail servers. The TXT record should be added as follows:
- TXT record name: _dmarc.[your domain]
([your domain] should be replaced with your domain name. For example: _dmarc.example.com)
- TXT record value: v=DMARC1; p=[Policy for domain]; pct=[% of messages subjected to filtering]; rua=[Reporting URI of aggregate reports]
(For example: v=DMARC1; p=quarantine; pct=20; rua=mailto:aggrep@example.com)