Symantec 10765539 - Mail Security For SMTP Technical manual

Symantec Mail Security
for SMTP
Planning Guide

Symantec Mail Security for SMTP
Planning Guide
The software described in this book is furnished under a license agreement and
may be used only in accordance with the terms of the agreement.
April 17, 2006
Copyright notice
Copyright © 2006 Symantec Corporation. All rights reserved. Symantec, the Symantec
logo, Symantec TurnTide, and SESA are U.S. registered trademarks of Symantec
Corporation. LiveUpdate, LiveUpdate Administration Utility, Symantec AntiVirus, and
Symantec Security Response are trademarks of Symantec Corporation. Other names may
be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED
CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED
WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-
INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL
NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION
WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE
INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE
WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be “commercial computer
software” and “commercial computer software documentation” as defined in FAR
Sections 12.212 and DFARS Section 227.7202.
Symantec Corporation
20330 Stevens Creek Blvd.
Cupertino, CA 95014
http://www.symantec.com
Printed in the United States of America.
10987654321

Technical support
As part of Symantec Security Response, the Symantec global Technical Support
group maintains support centers throughout the world. The Technical Support
group’s primary role is to respond to specific questions on product feature/
function, installation, and configuration, as well as to author content for our
Web-accessible Knowledge Base. The Technical Support group works
collaboratively with the other functional areas within Symantec to answer your
questions in a timely fashion. For example, the Technical Support group works
with Product Engineering as well as Symantec Security Response to provide
Alerting Services and Virus Definition Updates for virus outbreaks and security
alerts.
Symantec technical support offerings include:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and Web support components that provide rapid response and
up-to-the-minute information
■Upgrade insurance that delivers automatic software upgrade protection
■Content Updates for spam and virus definitions, and security signatures
that ensure the highest level of protection
■Global support from Symantec Security Response experts, which is
available 24 hours a day, 7 days a week worldwide in a variety of languages
for those customers enrolled in the Platinum Support Program
■Advanced features, such as the Symantec Alerting Service and Technical
Account Manager role, offer enhanced response and proactive security
support
Please visit our Web site for current information on Support Programs. The
specific features available may vary based on the level of support purchased and
the specific product that you are using.
Licensing and registration
If the product that you are implementing requires registration and/or a license
key, the fastest and easiest way to register your service is to access the
Symantec licensing and registration site at www.symantec.com/certificate.
Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,
select the product that you wish to register, and from the Product Home Page,
select the Licensing and Registration link.

Contacting Technical Support
Customers with a current support agreement may contact the Technical
Support group via phone or online at http://www.symantec.com/enterprise/
Customers with Platinum support agreements may contact Platinum Technical
Support via the Platinum Web site at https://www-secure.symantec.com/
platinum/
When contacting the Technical Support group, please have the following:
■Product release level
■Hardware information
■Available memory, disk space, NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description
■Error messages/log files
■Troubleshooting performed prior to contacting Symantec
■Recent software configuration changes and/or network changes
Customer Service
To contact Enterprise Customer Service online, go to http://www.symantec.com,
select the appropriate Global Site for your country, then choose Service and
Support. Customer Service is available to assist with the following types of
issues:
■Questions regarding product licensing or serialization
■Product registration updates such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information on product updates and upgrades
■Information on upgrade insurance and maintenance contracts
■Information on Symantec Value License Program
■Advice on Symantec's technical support options
■Nontechnical presales questions
■Missing or defective CD-ROMs or manuals

Contents
Chapter 1 Introducing Symantec Mail Security for SMTP
Key features ............................................................................................................ 7
Functional overview .............................................................................................. 8
Architecture ............................................................................................................ 9
New features for all users ...................................................................................10
Changes for Symantec Mail Security for SMTP users ................................... 11
New feature names ...................................................................................... 13
Discontinued features ................................................................................. 13
Changes for Symantec Brightmail Antispam users ....................................... 13
Where to get more information ......................................................................... 15
Chapter 2 Planning your deployment
General deployment considerations ................................................................. 17
MTA usage .................................................................................................... 17
Configuring Scanners .................................................................................. 17
Positioning with other filtering products ................................................ 18
Filtering internal deliveries ....................................................................... 18
LDAP compatibility ..................................................................................... 18
Load balancing ............................................................................................. 19
Adjusting MX records .................................................................................. 19
Adjusting RAM and MySQL threads ......................................................... 19
Deployment models ............................................................................................. 20
Basic gateway deployment ......................................................................... 20
Multi-tier gateway deployment ................................................................. 21
Post-gateway deployment .......................................................................... 23
Chapter 3 Configuring message filtering
Understanding email filtering ........................................................................... 25
Notes on filtering actions ........................................................................... 25
Deployment considerations ............................................................................... 26

6Contents
Chapter 4 Understanding system requirements
Hardware and software requirements ............................................................. 27
Minimum hardware requirements ............................................................ 27
Minimum software requirements ............................................................. 28
Reserved ports .............................................................................................. 31
Factors that affect performance ....................................................................... 32
Hardware components that affect performance .................................... 32
Environmental factors that affect performance .................................... 33
Settings that affect performance .............................................................. 33
Index

Chapter 1
Introducing Symantec Mail
Security for SMTP
This chapter includes the following topics:
■Key features
■Functional overview
■Architecture
■New features for all users
■Changes for Symantec Mail Security for SMTP users
■Changes for Symantec Brightmail Antispam users
■Where to get more information
Key features
Symantec Mail Security for SMTP offers enterprises an easy-to-deploy,
comprehensive gateway-based email security solution through the following:
■Antispam technology – Symantec’s state-of-the-art spam filters assess and
classify email as it enters your site.
■Antivirus technology – Virus definitions and engines protect your users
from email-borne viruses.
■Content Compliance – These features help administrators enforce corporate
email policies, reduce legal liability, and ensure compliance with regulatory
requirements.
■Group policies and filter policies – An easy-to-use authoring tool lets
administrators create powerful, flexible ad hoc filters for userss and groups.

8Introducing Symantec Mail Security for SMTP
Functional overview
Functional overview
You can deploy Symantec Mail Security for SMTP in different configurations to
best suit the size of your network and your email processing needs.
A Symantec Mail Security for SMTP host can be deployed in the following ways:
■Scanner – Deployed as a Scanner, a Symantec Mail Security for SMTP host
filters email. Your installation can have one or many Scanners. Symantec
Mail Security for SMTP runs alongside your email or groupware server(s).
■Control Center – Deployed as a Control Center, a Symantec Mail Security for
SMTP host is a Web-based configuration and administration center. Use it to
configure and manage email filtering, SMTP routing, system settings, and
all other functions. Your enterprise-wide deployment of Symantec Mail
Security for SMTP can have multiple Scanners but only one Control Center,
from which you configure and monitor all the Scanner hosts.
The Control Center provides status for all Symantec Mail Security for SMTP
hosts in your system, system logs, and extensive customizable reporting.
Use it to configure both system-wide and host-specific details.
The Control Center provides the Setup Wizard, for initial configuration of
all Symantec Mail Security for SMTP instances at your site, and also the
Add Scanner Wizard, for adding new Scanners.
It also hosts the Spam and Suspect Virus Quarantines, for storage of spam
and virus messages respectively. End users can access the Control Center to
view their quarantined spam messages and set their preferences for
language filtering and blocked and allowed senders. Alternatively, you can
configure the Spam Quarantine for administrator-only access.
■Scanner and Control Center – A single Symantec Mail Security for SMTP
host performs both functions.
Note: Symantec Mail Security for SMTP provides neither mailbox access for end
users nor message storage; it is not intended for use as the only MTA in your
email infrastructure.
Note: Symantec Mail Security for SMTP does not filter messages that don’t flow
through the SMTP gateway. For example, if two mailboxes reside on the same
MS Exchange server, or on different Exchange servers the same organization,
messages will not pass through Symantec Mail Security for SMTP filters.

9Introducing Symantec Mail Security for SMTP
Architecture
Architecture
Your Symantec Mail Security for SMTP installation processes a email message
as follows. For the sake of discussion, our sample message passes through the
Filtering Engine to the Transformation Engine without being rejected.

10 Introducing Symantec Mail Security for SMTP
New features for all users
■The incoming connection arrives at the inbound MTA via TCP/IP.
■The inbound MTA accepts the connection and moves the message to its
inbound queue.
■The Filtering Hub accepts a copy of the message for filtering.
■The Filtering Hub consults the LDAP SyncService directory to expand the
message’s distribution list.
■The Filtering Engine determines each recipient’s filtering policies.
■The message is checked against Blocked/Allowed Senders Lists defined by
administrators.
■Virus and configurable heuristic filters determine whether the message is
infected.
■Content Compliance filters scan the message for restricted attachment types
or keywords, as defined in configurable dictionaries.
■Spam filters compare message elements with current filters published by
Symantec Security Response to determine whether the message is spam. At
this point, the message may also be checked against end-user defined
Language settings.
■The Transformation Engine performs actions per recipient based on
filtering results and configurable Group Policies.
New features for all users
Table 1-1 lists features that are new for both Symantec Mail Security for SMTP
users and Symantec Brightmail Antispam users.
Table 1-1 New features for Symantec Mail Security for SMTP and Symantec Brightmail Antispam
Category Features Description
Threat
protection
features
Improved Email Firewall Protects against directory harvest attacks, denial of service
attacks, spam attacks, and virus attacks.
Sender Authentication Protects against phishing attacks, using the Sender Policy
Framework (SPF), Sender ID, or both.
Improved virus protection Additional virus verdicts protect against suspected viruses,
spyware and adware, and encrypted attachments.
Email messages that may contain viruses can be delayed in the
Suspect VIrus Quarantine, then refiltered, with updated virus
definitions, if available. This feature can be effective in defeating
virus attacks before they are widely known.
View a continuously updated list available of virus definitions.

11Introducing Symantec Mail Security for SMTP
Changes for Symantec Mail Security for SMTP users
Changes for Symantec Mail Security for SMTP users
For users of Symantec Mail Security for SMTP 4.1, Version 5.0 provides a host of
expanded and improved capabilities. In addition to the new features listed in
Inbound and
outbound
content
controls
True file type recognition for
content compliance filtering
Automatically detects file types without relying on file name
extensions or MIME types.
Keywords filtering within
attachments, keyword
frequency filtering
Scan within attachments to find keywords from dictionaries you
create or edit. Specify a number of occurrences to look for.
Regular expression filtering Use regular expressions to further customize filter conditions by
searching within messages and attachments.
Support for third party
archival tools
Specify conditions that result in email being sent to an archival
email address or disk location.
Flexible mail
management
LDAP integration and
synchronization for policies
Dynamic group population via any of several supported LDAP
servers
Expanded variety of actions
and combinations
More than two dozen actions that can be taken on messages, with
many combinations of multiple actions available.
Expanded mail controls SMTP connection management, support for secure email (TLS
encryption), user-based routing, address masquerading, invalid
recipient handling, control over delivery queue processing,
support for static routes
Aliasing Distribution lists automatically expanded, mail filtered and
delivered correctly for each user
Improved
reporting and
monitoring
Extensive set of pre-built
reports, scheduled reporting,
additional alert conditions,
remote syslog support
More than 50 graphical reports that you can generate ad-hoc or
on a scheduled basis. Reports can be exported for offline analysis
and emailed.
Message tracking View a trail of detailed information about a message, including
the filtering processing applied to a message.
Expanded
administration
capabilities
IP-based access control Control which hosts and networks can access your Control Center.
Control over Quarantine size
limits
Specify user-based and total limits, configure automatic message
deletions.
Table 1-1 New features for Symantec Mail Security for SMTP and Symantec Brightmail Antispam
Category Features Description

12 Introducing Symantec Mail Security for SMTP
Changes for Symantec Mail Security for SMTP users
Table 1-1, additional new features for Symantec Mail Security for SMTP users
only are listed in Table 1-2.
Group Policies introduce expanded flexibility in mail filtering and message
handling. Group Policies enable you to specify groups of users, based on email
addresses, domains, or IP addresses, and customize mail filtering for each
group. See the Symantec Mail Security for SMTP Administration Guide for more
information.
In addition, if you were using Version 4.1 without Premium AntiSpam, Version
5.0, with or without Premium AntiSpam provides much more extensive
capabilities for customizing both message filtering and the actions taken on
filtered messages.
Table 1-2 New features for Symantec Mail Security for SMTP users
Category Features Description
Flexible mail
management
Centralized, Web-
based administration
Use the Control Center to manage all aspects of email management and
spam, virus, and content filtering across all servers with one interface.
Group Policies Create separate inbound and outbound policies for an unlimited number
of groups of users. You can specify groups of users based on email
addresses, domains, LDAP groups, or IP addresses. For each category of
email, you can specify custom message handling for each group.
Expanded
notification
capabilities
Automatically send emails notifying specific persons or groups when
certain message conditions are encountered during message filtering.
Create different notifications for different conditions or user groups.
Inbound and
outbound
content controls
Improved
attachment blocking
Strip attachments within container files. Search within attachments
using regular expressions.
Improved
reporting and
monitoring
Aggregated logging
and reporting
Access logs for all messages from all servers via the Control Center.
Manage reports for all servers via the Control Center. Note that many of
the reporting features in SMS for SMTP 4.1 have been replaced in SMS
for SMTP 5.0 by the message tracking feature.
Expanded
administration
capabilities
Delegated
administration
Multiple administrator roles with view only or modify access to different
portions of the management interface.

13Introducing Symantec Mail Security for SMTP
Changes for Symantec Brightmail Antispam users
New feature names
Most features in Version 5.0 have similar names to the corresponding Version 4.1
features. Table 1-3 provides a cross-reference between selected Symantec Mail
Security for SMTP 4.1 features and Symantec Mail Security for SMTP 5.0
features that have different names.
Discontinued features
The following Symantec Mail Security for SMTP 4.1 features are not included in
Symantec Mail Security for SMTP 5.0:
■Auto-generated whitelist
■Logging of SMTP conversations
■Hold Queue, automatic reordering of the Slow Queue
■Return code support for DNS Blacklists
■Configurable administrator timeout for the management interface
Changes for Symantec Brightmail Antispam users
Although the product name has changed, if you were a Symantec Brightmail
Antispam user you will find the user interface for Symantec Mail Security for
SMTP 5.0 quite familiar. Most features are named similarly, and the organization
of the user interface is quite similar. Most of the changes are new features.
For users of Symantec Brightmail Antispam, Symantec Mail Security for SMTP
Version 5.0 provides significant new and expanded capabilities. In addition to
Table 1-3 Version 4.1 to Version 5.0
Symantec Mail Security for SMTP 4.1
Feature Name
Symantec Mail Security for SMTP 5.0
Feature Name
Accounts Administration
Custom disclaimer Annotation
Scan policy Settings > Virus > Exclude Scanning tab
Routing Settings > Hosts > Edit > SMTP tab

14 Introducing Symantec Mail Security for SMTP
Changes for Symantec Brightmail Antispam users
the new features listed in Table 1-1, additional new features for Symantec
Brightmail Antispam users only are listed in Table 1-4.
While the names of features are largely the same, you will find some changes to
the organization of menus. Most importantly, you will now find a Policies menu
at the top level, breaking out Group Policies (under the Settings menu in
Symantec Brightmail Antispam 6.0.3), and including other items as well. See the
Symantec Mail Security for SMTP Administration Guide for an updated
explanation of how settings and policies interact.
Table 1-4 New features for Symantec Brightmail Antispam users
Category Features Description
Threat
protection
features
Improved virus
processing
LiveUpdate support for virus definitions, list of file types to exclude
from virus scanning, expanded container limit controls
Outbound filtering Provides spam, virus, and content compliance filtering on outbound
email messages. Specify different outbound and inbound policies for
each user group.
Flexible mail
management
More flexible Group
Policies
Use LDAP groups to populate groups for Group Policies.
Multiple actions Specify more than one action to take on specific categories of
messages to specific groups of recipients.
Inbound and
outbound
content controls
Expanded content
compliance filtering
capabilities
Expanded set of actions available on filtered messages, support for
multiple actions on the same messages
Attachment blocking Create lists of attachment types to remove. Strip attachments within
container files.
Annotations Automatically append or prepend text, such as legal disclaimers or
marketing tag lines, to messages.
Notifications Automatically send emails notifying specific persons or groups when
certain message conditions are encountered during message filtering.
Create different notifications for different conditions or user groups.
Improved
reporting and
monitoring
Expanded virus
monitoring
Virus outbreak alerts, expanded logging of virus events
Expanded logging Symantec Security Information Manager (SSIM) logging support
Expanded
administration
capabilities
Global reject or pause
of message scanning
During a virus outbreak, you can temporarily pause scanning until
new virus filters are in place.

15Introducing Symantec Mail Security for SMTP
Where to get more information
Where to get more information
In addition to this Planning Guide, your Symantec Mail Security for SMTP
product comes with the following documentation:
■Symantec Mail Security for SMTP Installation Guide
■Symantec Mail Security for SMTP Administration Guide
■Symantec Mail Security for SMTP Getting Started
Symantec Mail Security also includes a comprehensive help system that
contains conceptual and procedural information.
You can visit the Symantec Web site for more information about your product.
The following online resources are available:
Provides access to the technical support Knowledge
Base, newsgroups, contact information, downloads,
and mailing list subscriptions
www.symantec.com/
techsupp/ent/
enterprise.html
Provides information about registration, frequently
asked questions, how to respond to error messages,
and how to contact Symantec License Administration
www.symantec.com
/licensing/els/help/en/
help.html
Provides product news and updates www.enterprisesecurity.
symantec.com
Provides access to the Virus Encyclopedia, which
contains information about all known threats;
information about hoaxes; and access to white papers
about threats
www.symantec.com/
avcenter/global/index.html

16 Introducing Symantec Mail Security for SMTP
Where to get more information

Chapter 2
Planning your deployment
This chapter includes the following topics:
■General deployment considerations
■Deployment models
General deployment considerations
This section provides information about integrating Symantec Mail Security for
SMTP into your network.
MTA usage
Symantec Mail Security for SMTP contains a Message Transfer Agent (MTA),
which processes and relays messages to support filtering activities.
Note: Symantec Mail Security for SMTP provides neither mailbox access for end
users nor message storage; it is not suitable for use as the only MTA in your
email infrastructure.
Configuring Scanners
During installation, you can use a wizard to add a Scanner. Depending on your
filtering requirements and messaging environment, you may want to deploy
multiple Scanners and administer them via a single Control Center. In such
cases, you can dedicate Scanners to specific functions. For example, you might
want one Scanner to filter inbound mail and another to filter outbound mail.

18 Planning your deployment
General deployment considerations
Positioning with other filtering products
In order for Symantec Mail Security for SMTP’s spam and Content Compliance
filters to function properly, you should avoid placing the product behind other
filtering products (such as content filters) or MTAs that alter or remove pre-
existing message headers or modify the message body.
Filtering internal deliveries
You can force internal mail through Symantec Mail Security for SMTP to avoid
propagation of viruses and spam generated by email mass-mailing worms that
may have been picked up by individuals via Web browsing or downloading.
LDAP compatibility
Symantec Mail Security for SMTP supports LDAP for Spam Quarantine
authentication and synchronization.
The system’s LDAP SyncService feature synchronizes user, alias, and group data
from your company’s LDAP accessible directories with its own database.
SyncService lets Symantec Mail Security for SMTP re-normalize and index the
data to fit the needs of Scanner, Control Center, and Spam Quarantine while
minimizing impact on your directory infrastructure.
LDAP SyncService supports the following LDAP servers:
■Windows 2000 Active Directory
■Windows 2003 Active Directory
■Sun Directory Server 5.2, Patch 4 (formerly known as the iPlanet
Directory Server) on Solaris 8 and 9, and Red Hat Linux
■SunOne LDAP Server 5.2 , Patch 4
■Lotus Domino LDAP Server 6.5
■Exchange 5.5
■other (used for authentication only)
Note: Only one LDAP source may be used for authentication. While the same
source may also be used for synchronization purposes, no other LDAP
directories may be used for authentication. This is especially important with
regard to Spam Quarantine. If email is being sent to Spam Quarantine where end
users will then process their quarantined messages, then all end users must
exist in the LDAP source used for authentication.

19Planning your deployment
General deployment considerations
For information on using LDAP SyncService, see the Symantec Mail Security for
SMTP Administration Guide.
Load balancing
Symantec Mail Security for SMTP is not intended to be used for load balancing.
Administrators can associate only one host name or IP address as the MTA to
which email is relayed. You must implement multiple Scanners to perform load
balancing.
Adjusting MX records
When you implement Symantec Mail Security for SMTP in front of a separate
MTA that receives inbound messages, you must to change the DNS mail
exchange (MX) records. The records must point incoming messages to the
system. Symantec Mail Security for SMTP should have a higher priority than
the existing MTA.
However, if you simply list Symantec Mail Security for SMTP as a higher-
weighted MX record in addition to the existing MX record, spammers can look
up the previous MTA’s MX record. This allows them to send spam directly to the
old server, bypassing your spam filtering. To prevent spammers from
circumventing the new spam-filtering servers, you should do one of the
following:
■Remove the previous MTA’s MX record from DNS.
■Block off the MTA from the Internet using a firewall.
■Modify the firewall’s network address translation (NAT) tables to route
external IP addresses to internal non-routable IP addresses. You can then
map from the old server to Symantec Mail Security for SMTP.
■When naming Symantec Mail Security for SMTP, ensure that the name you
choose does not imply its function. For example, antispam.yourdomain.com,
symantec.yourdomain.com, or antivirus.yourdomain.com are not good
choices.
Adjusting RAM and MySQL threads
The Control Center is a combination of Tomcat and MySQL applications. Tomcat
provides the Web-based interface, and MySQL is the database storage. Their
default configuration performs well in installations with a single Scanner and
low volume email traffic. In installations where multiple Scanners or large
amounts of spam are processed, increasing the amount of RAM allocated to

20 Planning your deployment
Deployment models
Tomcat and increasing the number of listener and consumer threads in MySQL
improves performance.
Deployment models
You can deploy Symantec Mail Security for SMTP in the following ways:
■Basic gateway deployment
■Multi-tier gateway deployment
■Post-gateway deployment
Basic gateway deployment
This is the simplest deployment model. Symantec Mail Security for SMTP
resides at the outermost gateway layer, processing inbound and outbound mail,
providing Secure Email Services, and relaying mail to other relay layers or to the
user-facing mail server layer.
On all configured server computers, port 443 must be configured to permit
outbound connections to Symantec to download content updates.
The following figure shows Symantec Mail Security for SMTP deployed at the
gateway, behind a firewall.
Figure 2-1 Basic gateway deployment
Advantages
■Because spam emanates from the outside world, the gateway is the logical
and effective place to deploy Symantec Mail Security for SMTP.
■When you deploy the system closer to the gateway, you can minimize mail
processing and storage requirements as well as network bandwidth via
Email Firewall filtering.