Domain name

Name of the email domain for which emails are to be accepted and processed by the SEPPmail Secure E-Mail Gateway.

This setting is only editable when creating a new Managed domain - that is when the menu was opened via the Add managed domain... button (see ADD MANAGED DOMAIN Settings).

Forwarding server

Name of the email server to which the incoming emails for the above-mentioned Domain name are to be forwarded after processing by the SEPPmail Secure E-Mail Gateway .

The following is accepted as input:

When specifying an IP address, a host name or an MX name, there is the option to additionally enter an individual port. The port is entered directly afterwards, separated by a colon ":", that is "[IP address]:port", "[hostname]:port" or "MX name:port".

If no port is specified, the standard SMTP port TCP25 is used.

Header Check

Under Mails from this domain must have a header, an X header can be indicated, whose expected value is entered under with the following value:.

If an attempt is now made to send an email from the current Managed domain, it must contain the X header specified here with the corresponding value (case sensitive!). Otherwise, the email will be rejected.

The corresponding X header is removed after testing.

Exchange Online Integration

(changed in 12.1.16)

By entering the Microsoft 365 Tenant ID (see also Search for your Microsoft 365 Tenant ID) the relaying from Microsoft 365 (see Exchange Online Relaying) for the respective Managed domain is limited to the specific Microsoft 365 tenant.

(new in 12.1.6)

List of allowed exchange online originator organisations (comma seperated list)

To check the identity of the sender domain, the header

X-OriginatorOrg

set by Microsoft 365 is used.

By comparing the header value with the respective SEPPmail Managed domain, the relaying from Microsoft 365 (see Exchange Online Relaying) for the respective Managed domain is limited to the specific Microsoft 365 tenant.

Any further alias domains can alternatively be maintained manually.

(changed in 12.1.16)

Exchange online tenant ID (informational only)

A Microsoft 365 Tenant ID displayed here (see also Search for your Microsoft 365 Tenant ID) is only for information.

(new in 13.0.15)

Domain is parallel connected

For a parallel connection with Exchange Online ("Forwarding Server" corresponds to "Send ALL outgoing mails from this domain to the following SMTP server (optional)" (see also Connecting Exchange Online with ATP / EOP), this option must be set. Otherwise, the direction of the mail may not be recognised correctly.

Password and certificate authentication

(new in 12.1.1)

If the Submission Port has been activated, by default, for a User signed in via STARTTLS, only emails can be delivered that originate from their own SMTP email address.
 

However, if, for example, an external email server is to send all or part of its email traffic via a connector that connects via STARTTLS with the SEPPmail Secure E-Mail Gateway, this can be done using the following two options.

Usually, first a dedicated User for the connection has to be created.

Allow relaying for this domain for authenticated users whose mail address matches the following regular expression:

Entry of a regular expression that represents all email addresses that are allowed to use the above connection.

Allow relaying for this domain for users whose certificate cn matches the following regular expression (submission port only):

Specification of the CN (Common Name) in the applicant of the certificate used when establishing the connection.

Allowed sending servers for this domain

(leave empty to allow all relaying networks, unless an originator org is specified above)

At this point, the IP address(es) or subnet(es) that are allowed to send on behalf of the respective Managed domain can be entered. This prevents, for example, that a client can send emails in the name of another in client-capable systems. If no entry is made here, any address listed under Mail System Relaying is allowed to send emails from this Managed domain.

Usually, the input corresponds to the IP address(es) of the entered Forwarding server (see table under Mail System Managed domains Column Server IP Address).

(changed in 13.0.8)

It is possible to enter the network 0.0.0.0/0 as the relaying network to enable the sending of e-mails from an external web server, for example. Please use with care.

After saving, a further input field is displayed.

Send ALL outgoing mails from this domain to the following SMTP server (optional)

By entering a target server (input format identical to Mail System Managed domain ADD/EDIT MANAGED DOMAIN Settings Forwarding server IP or MX name), for the respective Managed domain the Outgoing server (see Mail System) is overridden (sender based routing).

Any possibly required TLS settings can be made under Mail System TLS Settings Add TLS Domain ADD TLS DOMAIN.

SSL certificate

(new in 13.0.8)

An SSL certificate can be specified here for each managed domain, which is used as an identification certificate for sending via this managed domain. The configuration is done in the same way as for GINA domains, see SSL.

If no certificate is configured, the default certificate configured under SSL is used.

Postmaster address

If an email address is entered here, it will be used as the sender (from-header) for sending bounce and notification emails of the respective Managed domain.

S/MIME domain keys

Depending on the global selection under Mail System Managed domain Create S/MIME domain keys for managed domain encryption and send public key to vendor pool:, different statuses are displayed.

Globally on

This is displayed if the global setting On for all domains has been selected.

With this setting, the participation in the Managed Domain Service is activated or deactivated.

With the activation, for the corresponding Managed domain, a self-signed X.509 S/MIME domain certificate (see S/MIME domain encryption) is created automatically and transferred to the central SEPPmail licence and/or key server. The corresponding newly created S/MIME domain certificate (that means only the public key!) is then automatically distributed to all SEPPmail Secure E-Mail Gateways so that all companies operating a SEPPmail Secure E-Mail Gateway can exchange emails without any further effort among each other, at least on a domain-encrypted basis.

This service is already included in the basic licence and does not require any additional encryption licences.

Create S/MIME domain keys for managed domain encryption for this domain and send public key to vendor pool

By default, this option is inactive

This is displayed if the global setting Use domain settings has been selected.

Globally off

This is displayed if the global setting Off for all domains has been selected.

Internal mail handling

(new in 13.0.4)

The option "Send internal mails (between two managed domains) to the configured smarthost" applies to the routing of internal mails, if the general setting Use domain settings is selected.

Disclaimer

(changed in 12.0)

For using the Central Disclaimer Management (CDM), a corresponding licence is necessary.

Disclaimers and/or personalised footers can be created and edited via the menu Mail System Edit mail disclaimer....

If a licence is available, the disclaimer is attached in accordance with the following selection.

Initial disclaimer

Selection of the disclaimer for new outgoing emails.

Reply disclaimer

(new in 12.0)

Selection of the disclaimer for outgoing email replies.

GINA domain

Via the selection, the GINA settings to be used for the entered email domain can be selected. These can be created and edited via the menu GINA Domains Domains.

If "-DISABLED-" is selected here, for the selected Managed domain no GINA technology is available. This also means that if encryption is requested and the recipient's public key is missing, the email is rejected (bounced) (see also Bounce templates No public key).

For client-capable systems, the GINA domain(s) specifically set up for the customer must be selected here, provided that the GINA technology has not been disabled by means of "-DISABLED-".

(new in 14.0.0) In the following parameters, the LFT use can be specified. If not specified, the default values are inherited.  

Global LFT quota in MB

Defines the global quota for this domain. LFT will not exceed this value.

Global LFT quota warn levels

The default is "80,90,95". If the global quota exceeds one of these values, a notification email is sent.

Enforce global LFT quota

If activated, the global quota is strictly adhered to. If not, then only a warning is issued if the global quota is overwritten. Possible values are "true", "false" and "reset to default values".

User LFT quota in MB (must not be bigger than global quota of x)

Defines the quota per user of this managed domain.

Users are allowed to use LFT

Allows specifying if the user may use LFT. Possible values are "true", "false" and "reset to default values".

Assigned to customer

(only for client-capable systems)

Allocation to a customer who has already been created under Customers in a client-capable system.

The allocation to a customer is only possible when creating a new Managed domain - that is when the menu was opened via the button Add managed domain....

No authentication

By default, bounce_noauth is selected.

Shows the selected bounce template for requested encryption/signatures by non-existent users (Users).

No public key

By default, bounce_noenc is selected.

Shows the selected bounce template for failed encryption.

No private key

By default, bounce_noseckey is selected.

Displays the selected bounce template if the key material of the internal sender is missing.

Policy not applicable

By default, bounce_policy is selected.

Generally, this template is used for all rejections due to an ENCRYPTION POLICY provided that no other template has been explicitly selected in the corresponding ENCRYPTION POLICY. Thus, if an ENCRYPTION POLICY is used for more than one Managed domain, the template of the corresponding Managed domain is used instead of a template obtained via the ENCRYPTION POLICY.

The order is then ascending:

•Default template

•Domain template

•Policy template.

Send OpenPGP keys

By default, sendpgpkeys is selected.

If applicable, the template selected here overrides the global selection of the option Mail Processing Miscellaneous options Send new OpenPGP public keys to users when a key is created with template.

LDAP

If the GINA technology is also used internally, for example for Large File Transfer (LFT) or internal email encryption (IME), this option enables the authentication of the users of the respective Managed domain against an external LDAP in the organisation-internal network (for example Active Directory).

This also enables users from the corresponding Managed domain to directly login at the GINA portal with their email address and the password stored in the LDAP (that means in the case of AD, the Windows password).

Operating mode:

If, due to the above-mentioned configuration, the email address (the main address, no email alias!) of the registering user (GINA account) and thus their DN is found in the LDAP database, another connection attempt is made with this DN and the password entered by the user in the GINA portal. If this attempt is successful, the authentication at the GINA portal is also successful.

Here, the SEPPmail Secure E-Mail Gateway runs its own counter for incorrect password entries. If the external authentication fails more frequently than the maximum admissible number, the account is locally temporarily disabled. Here, there is no interaction with the external server anymore. The deactivation is thus exclusively local. This means that a SEPPmail Secure E-Mail Gateway administrator can always reactivate or finally disable a deactivated GINA Account in the SEPPmail Secure E-Mail Gateway administration interface.

Additionally, there is an option of excluding individual GINA Accounts from external authentication. In this case, the local password is used for the login again (please also refer to GINA Accounts GINA User Details User Data External Authentication).

Authenticate GINA users from this domain to external LDAP server (eg. Active Directory)

By default, this option is inactive.

Activates the "external LDAP authentication".

Automatically create GINA account if user exists on external LDAP server

By default, this option is inactive.

If this option is enabled, a GINA Account is automatically created upon successful authentication via LDAP, unless one already exists. The registration process for the initial registration is thus not necessary for the GINA user.

One precondition is that the GINA Domain), to which the respective user logs in, is also allocated to this Managed domain.

If this option is not enabled, the GINA Accounts (unless there is also no alternative IDP setting active) still need to be registered on the SEPPmail Secure E-Mail Gateway. Here, a local password must be set. However, this password is not used for authentication as long as authentication via IDP is active. A corresponding message is displayed during the initial registration of the account.

If, when logging in at the GINA portal, the local password is used instead of the IDP password (in this case only!), the user receives a corresponding note (see GINA Domains Domain GINA Edit CHANGE GINA SETTINGS FOR Language Settings Edit Translations Edit translation file Advanced view Edit translation file msgid "ext_auth_enabled").

If the option is deactivated retrospectively, the already existing GINA users will be asked to register when they next log in.

Server

Indication of the LDAP server(s) against which an authentication is to be realised. The hostname or IP address is accepted as input.

Several servers can be entered, separated by spaces. The servers are processed in the specified order until one of them returns either OK or INVALID_CREDENTIALS (incorrect password). For all other responses (or errors in the connection establishment), the next server in the list is tried.

Port

By default, this is set to 636

Specifies the port on which the external LDAP server receives requests. The standard LDAP port is 389, and 636 for LDAPS (see also TLS required).

TLS required

By default, this option is active.

Enforces the encryption of the connection to the LDAP server by means of TLSv1 or higher (LDAPS or LDAPS+STARTTLS).

Bind DN

Indication of the full distinguished name (DN) of the read-only account which is entitled to search under External user attributes Search base Email attribute in the LDAP database.

Bind password

Password for the authentication of the account entered under Bind DN.

External user attributes

Customer Login Test

Authenticate local users as GINA users

By default, this option is inactive.

Activate if local users should be able to log in at GINA.

Select the condition:

•If you select the mail processing groups, only users who belong to one of the selected mail processing groups are allowed to do so.

•If no mail processing group is selected, all users of the managed domain may authenticate themselves.

The method with which a user originally was created can be analysed with the Show users created by authentication filter.

Displays the key ID of the OpenPGP domain key(s)

Displays the key IDs of all existing subkeys.

Displays the user ID associated with the key ID. If the key was generated by the appliance, it is usually the key

OpenPGP Domain Encryption <domain-confidentiality-authority@yourdomain.tld>

Date of issue of the key

YYYY-MM-DD

Expiration date of the key

YYYY-MM-DD

Displays the fingerprint(s) of the S/MIME domain key(s).

Note:

If, under Settings in the section S/MIME domain keys, one of the options Globally on or Create S/MIME domain keys for managed domain encryption for this domain and send public key to vendor pool

is activated, at least one certificate is displayed.

Date of issue of the key

YYYY-MM-DD

Expiration date of the key

YYYY-MM-DD

Displays whether a key has been released and is used.

Possible status:

•managed by SEPPmail
used for the automatically managed domain encryption (see Managed Domain Service and the status managed in SEPPmail domain encryption)
 

•unmanaged
Please also refer to the status unmanaged, and/or mismatch in SEPPmail domain encryption
In the case where the status is mismatch, a corresponding warning is issued in the status bar!

Displays the fingerprint(s) of the S/MIME domain key(s) which is/are required for the internal email encryption as of IME 2.0.

Date of issue of the key

YYYY-MM-DD

Expiration date of the key

YYYY-MM-DD

Generate a DKIM key pair for this domain

By default, this option is inactive.

Placing a check mark and subsequently clicking on Save changes generates a DKIM key pair for the corresponding managed domain. As of this point in time, all outgoing emails of the Managed domain will bear a DKIM signature.

Selector:

(new in 13.0.0)

By default, this option is set to "default".

Add ARC seal to incoming mails for this domain

By default, this option is inactive.

Placing a check mark and subsequently clicking on Save changes activates the ARC seal, based on the key source set below.

Key source:

By default, this option is set to "Use the DKIM key". This is the DKIM key of the managed domain.

Alternatively, a Master ARC key or a separate ARC key for this managed domain can be used.

The Master ARC key is defined in Mail Settings.

Displays whether the "Extended Field" is in status

"Active"

or

"Inactive"

and therefore ready to use or not.

Displays the name of the respective "Extended Fields" as set up under Mail Processing Extended Fields Extended Fields Name .

Displays the value of the respective "Extended Fields". If this corresponds to the one under Mail Processing Extended Fields Extended Fields Default value, then behind the entry field

default value

is displayed, otherwise

domain specific value

Displays the Type of the respective "Extended Fields" as entered under Mail Processing Extended Fields Extended Fields.

Number of accounts in this domain

Number of users created on the SEPPmail Secure E-Mail Gateway (corresponds to user licences).

S/MIME-encrypted

emails sent

Number of emails sent that were encrypted using the S/MIME technology.

S/MIME-encrypted

emails received

Number of emails received that were encrypted using the S/MIME technology.

OpenPGP-encrypted emails sent

Number of emails sent that were encrypted using the OpenPGP technology.

OpenPGP-encrypted emails received

Number of emails received that were encrypted using the OpenPGP technology.

S/MIME domain-encrypted emails sent

Number of emails sent which were domain-encrypted by means of the S/MIME technology.

S/MIME domain-encrypted emails received

Number of emails received which were domain-encrypted by means of the S/MIME technology.

OpenPGP domain-encrypted emails sent

Number of emails sent which were domain-encrypted by means of the OpenPGP technology.

OpenPGP domain-encrypted emails received

Number of emails received that were domain-encrypted by means of the OpenPGP technology.

S/MIME signed

emails sent

Number of emails sent that were signed by means of the S/MIME technology.

S/MIME signed

emails received

Number of emails received that were signed by means of the S/MIME technology.

GINA encrypted

emails sent

Number of emails sent that were encrypted by means GINA technology