Configuring relay control options

Administrator Help | Forcepoint Email Security | Version 8.4.x

You can prevent the unauthorized use of your mail system as an open relay by limiting the domains and IP address groups for which your server is allowed to relay mail. Protected domains are defined in the Settings > Users > Domain Groups page. Trusted IP address groups are defined in the Settings > Inbound/Outbound > IP Groups page.

Configure relay control settings in the Settings > Inbound/Outbound > Relay Control page as follows:

In the Inbound Relay Options section, enable Sender Policy Framework (SPF) checking by marking the Enable SPF check box. This option is enabled by default.

Configure the SPF check function to reject mail for the following results:

Fail. The domain owner's SPF record does not authorize the sender host machine to send email for the domain.

SoftFail. The domain owner's SPF record allows the sender host machine to send email for this domain, even though the host is not explicitly authorized to do so.

Neutral. The domain owner's SPF record makes no statement as to whether the sender host machine is authorized to send email for the domain.

None. The lack of definitive SPF information prevents an SPF check (e.g., an SPF record does not exist).

PermError. A permanent error occurs (e.g., the SPF record has an invalid format).

TempError. A transient error occurs (e.g., a DNS timeout).

These options are not marked by default.

In the Bypass SPF Option box, you can specify a sender domain group for which SPF settings are bypassed.

Mark the Bypass SPF validation for senders in the following domain group check box.

Select a sender domain from the Domain group drop-down list.

In the Outbound Relay Options section, select the relay setting for senders in protected domains when SMTP authentication is not required. Default setting is Allow relays only for senders from trusted IP addresses.

You must use the default setting if you use SMTP authentication.

Note that allowing all outbound relays may create a security vulnerability in your system.

In the Internal Relay Options section, select the relay setting for mail between protected domains when SMTP authentication is not required. Default setting is Allow relays only for senders from trusted IP addresses.

You must use the default setting if you use SMTP authentication.

Note that allowing all outbound relays may create a security vulnerability in your system.