---

Read all positions in this section carefully (multiple times is recommended!!!)! A wrong configuration sequence or wrong configuration values can lead in to a destroyed ASSP configuration!

---

If set, the configuration value and option files synchronization will be enabled. This synchronization belong to the configuration values, to the file that is possibly defined in a value and to the include files that are possibly defined in the configured file.
If the configuration of all values in this section is valid, the synchronization status will be shown in the GUI for each config value that is, or could be shared. There are several configuration values, that could not be shared. The list of all shareable values could be found in the distributed file assp_sync.cfg

For an initial synchronization setup set the following config values in this order: setup syncServer, syncConfigFile, syncTestMode and as last syncCFGPass (leave isShareSlave and isShareMaster off). Use the default (distributed syncConfigFile assp_sync.cfg) file and configure all values to your needs - do this on all peers by removing lines or setting the general sync flag to 0 or 1 (see the description of syncConfigFile ).
If you have finished this initial setup, enable isShareMaster or isShareSlave - now assp will setup all entrys in the configuration file for all sync peers to the configured default values (to 1 if isShareMaster or to 3 if isShareSlave is selected). Do this on all peers. Now you can configure the synchronization behavior for each single configuration value for each peer, if it should differ from the default setup.
For the initial synchronization, configure only one ASSP installation as master (all others as slave). If the initial synchronization has finished, which will take up to one hour, you can configure all or some assp as master and slave. On the initial master simply switch on isShareSlave. On the inital slaves, switch on isShareMaster and change all values in the sync config file that should be bedirectional shared from 3 to 1. As last action enable enableCFGShare on the SyncSlaves first and then on the SyncMaster.
After such an initial setup, any changes of the peers (syncServer) will have no effect to the configuration file (syncConfigFile)! To add or remove a sync peer after an initial setup, you have to configure syncServer and you have to edit the sync config file manualy.

This option can only be enabled, if isShareMaster and/or isShareSlave and syncServer and syncConfigFile and syncCFGPass are configured!
Because the synchronization is done using a special SMTP protocol (without "mail from" and "rcpt to"), this option requires an installed Net::SMTP module in PERL. This special SMTP protocol is not usable to for any MTA for security reasons, so the "sync mails" could not be forwarded via any MTA.
For this reason all sync peers must have a direct or routed TCP connection to each other peer.

If selected, ASSP will send configured configuration changes to sync peers.

If selected, ASSP will receive configured configuration changes from sync peers. To accept a sync request, every sending peer has to be defined in syncServer - even if there are manualy made entrys in the sync config file for a peer.

Define all configuration sync peers here (to send changes to or to receive changes from). Sepatate multiple values by "|". Any value must be a pair of hostname or ip-address and :port, like 10.10.10.10:25 or mypeerhost:125 or mypeerhost.mydomain.com:225. The :port must be defined!
The target port can be the listenPort , listenPort2 or relayPort of the peer.

If selected, a master (isShareMaster) will process all steps to send configuration changes, but will not really send the request to the peers. A slave (isShareSlave) will receive all sync requests, but it will not change the configuration values and possibly sent configuration files will be stored at the original location and will get an extension of ".synctest".

Define the synchronization configuration file here (default is file:assp_sync.cfg).
This file holds the configuration and the current status of all synchronized assp configuration values.
The format of an initial value is: "varname:=syncflag" - where syncflag could be 0 -not shared and 1 -is shared - for example: HeaderMaxLength:=1 . The syncflag is a general sign, which meens, a value of 0 disables the synchronization of the config value for all peers. A value of 1, enables the peer configuration that possibly follows.
The format after an initial setup is: "varname:=syncflag,syncServer1=status,syncServer2=status,......". The "status" could be one of the following:

0 - no sync - changes of this value will not be sent to this syncServer - I will ignore all change requests for this value from there
1 - I am a SyncMaster, the value is still out of sync to this peer and should be synchronized as soon as possible
2 - I am a SyncMaster, the value is still in sync to this peer
3 - I am not a SyncMaster but a SyncSlave - only this SyncMaster (peer) knows the current sync status to me
4 - I am a SyncMaster and a SyncSlave (bidirectional sync) - a change of this value was still received from this syncServer (peer) and should not be sent back to this syncServer - this flag will be automaticaly set back to 2 at the next synchronization check

The password that is used and required (additionaly to the sending IP address) to identify a valid sync request. This password has to be set equal in all ASSP installations, from where and/or to where the configuration should be synchronized.
The password must be at least six characters long.
If you want or need to change this password, first disable enableCFGShare here an on all peers, change the password on all peers, enable enableCFGShare on SyncSlaves then enable enableCFGShare on SyncMasters.

If selected, the detail synchronization status is shown at the top of each configuration parameter like:

nothing shown - there is no entry defined for this parameter in the syncConfigFile or it is an unsharable parameter
"(shareable)" - the parameter is shareable but the general sync sign in the syncConfigFile is zero
"(shared: ...)" - the detail sync status for each sync peer

If not selected, only different colored bulls are shown at the top of each configuration parameter like:

nothing shown - no entry in the syncConfigFile or it is an unsharable parameter
"black bull •" - the parameter is shareable but the general sync sign in the syncConfigFile is zero
"green bull •" - the parameter is shared and in sync to each peer
"red bull •" - the parameter is shared but it is currently out of sync to at least one peer

If you move the mouse over the bull, a hint box will show the detail synchronization status.

---

nologstandardverbosediagnostic

The port number on which ASSP will listen for incoming SMTP connections (normally 25). You can specify both an IP address and port number to limit connections to a specific interface. Multiple ports (interface:port) are possible separated by a pipe (|). Hint: If you set this port to 25, you must not set "listenPort2" to 25

Examples:25
123.123.123.1:25|123.123.123.5:25

The IP number! and port number of your primary SMTP mail transfer agent (MTA). If multiple servers are listed and the first listed MTA does not respond, each additional MTA will be tried. If only a port number is entered, or the dynamic keyword INBOUND is used with a port number, then the connection will be established to the local IP address on which the connection was received. This is useful when you have several IP addresses with different domains or profiles in your MTA. If INBOUND:PORT is used, ReportingReplies (Analyze,Help,etc and CopyMail will go to 127.0.0.1:PORT. If your needs are different, use smtpReportServer (SMTP Reporting Destination) and sendAllDestination (Copy Spam SMTP Destination). Separate multiple entries by "|".Examples:127.0.0.1:1025, 127.0.0.1:1025|127.0.0.5:1025, INBOUND:1025

Port to connect to when ASSP sends replies to email-interface mails, notifications and block reports. Must be set when smtpDestination contains INBOUND. For example "10.0.1.3:1025", etc.

A secondary port number on which ASSP can accept SMTP connections. This is useful as a dedicated port for TLS or VPN clients or for those who cannot directly send mail to a mail server outside of their ISP's network because the ISP is blocking port 25. Multiple ports (interface:port) are possible separated by a pipe (|). Hint: If you set this port to 587, you must not set another portlike "listenPort" to 587

Examples: 587
192.168.0.100:587
192.168.0.100:587|192.168.0.101:587

The IP address/hostname and port number to connect to when mail is received on the second SMTP listen port. If the field is blank, smtpDestination will be used. The purpose of this setting is to allow remote users to make authenticated connections and transmit their email without encountering SPF failures.

Examples:127.0.0.1:687

Do not allow clients to connect to listenPort2 without Authentication.

If you do not want external clients to use SMTP AUTH - check this option.

The IP number of the Primary MX if there is one.

Disable connections on port 25 if PrimaryMX is up and running.

For IPv6 network support to be enabled, check this box. Default is disabled. IO::Socket::INET6 is able to handle both IPv4 and IPv6. NOTE: This option requires an installed IO::Socket::INET6 module in PERL and your system should support IPv6 sockets.
Before you enable or disable IPv6, please check every IP listener and destination definition in assp and correct the settings. Changing this requires a restart of ASSP! IPv4 addresses are defined for example 192.168.0.1 or 192.168.0.1:25 - IPv6 addresses are defined like [FE80:1:0:0:0:0:0:1]:25 or [FE80:1::1]:25 ! If an IPv4 address is defined for a listener, assp will listen only on the IPv4 socket. If an IPv6 address is defined for a listener, assp will listen only on the IPv6 socket. If only a port is defined for a listener, assp will listen on both IPv4 and IPv6 sockets.

If INBOUND is used in the SMTP Destination field, the rules specified here are used to route the inbound IP address to a different outbound IP address. You must specify a port number with the outbound IP address. This feature works by assigning as many IP numbers to ASSP as you have different receiving Mailservers.

Example:141.120.110.1=>141.120.110.129:25|141.120.110.2=>141.120.110.130:125|141.120.110.3=>141.120.110.130:125

requires ASSP restart

---

nologstandardverbose

The maximum number of SMTP session errors encountered before the connection is dropped. Scoring is done with meValencePB.

The maximum number of simultaneous SMTP sessions. This can prevent server overloading and DoS attacks. 64 simultaneous sessions are typically enough. No entry or zero means no limit.

Mail from any of these IP numbers and Hostnames will pass through without checking maximum number of simultaneous SMTP sessions. For example: [localhost]|145.145.145.145

The maximum number of SMTP sessions allowed per IP number. Use this setting to prevent server overloading and DoS attacks. 5 sessions are typically enough. If left blank or set to 0 there is no limit imposed by ASSP. ispip (ISP/Secondary MX Servers) and acceptAllMail (Accept All Mail) matches are excluded from SMTP session limiting. Scoring is done with iplValencePB.

IP numbers in ispip (ISP/Secondary MX Servers) are normally not checked, this option will include them into SMTP session limiting

The maximum allowed header length, in bytes. At each mail hop header information is added by the mail server. A large mail header can indicate a mail loop. If the value is blank or 0 the header size will not be checked.

The maximum allowed equal X-header lines - eg. "X-SubscriberID". If the value is set to empty the header will not be checked for equal X-header lines. This check will be skipped for noprocessing, whitelisted and outgoing mails.
The default is "*=>20", which means any X-header can occure 20 time maximum. You can define different values for different X-headers - wildcards like "*" and "?" are allowed to be used.
For example:
*=>20|X-Notes-Item=>100|X-Subscriber*=>10|X-AnyTag=>0
An value of zero disables the check for the defined X-header. The check is also skipped if no default like "*=>20" is defined and the X-header defintion is not found.

If set to a value higher than 0, ASSP count its own Received-header in the header of the mail. If this count exceeds the defined value, the transmission of the message will be canceled.

If the value of ([message size]) exceeds maxSize in bytes the transmission of the local message will be canceled. No limit is imposed by ASSP if the field is left blank or set to 0. This option allows admins to limit useless bandwidth wasting based on the transmit size.

Use this parameter to set individual maxSize values for email addresses, domains, user names and IP addresses. A file must be specified if used.
Accepts specific addresses (user@domain.com), user parts (user), entire domains (@domain.com) and IP addresses (CIDR notation like 123.1.101/32 is here not supported!) - group definitions could be used. Use one entry per line. Wildcards are supported (fribo*@domain.co?). A second parameter separated by "=>" specifies the size limit.
For example:
fribo*@thisdomain.co?=>1000000
jhanna=>0
@sillyguys.org=>500000
101.1.2.*=>0
If multiple matches (values) are found in a mail for any IP address in the transport mail chain, any envelope recipient and the envelope sender, the highest value or 0 (no limit) will be used! If no match (value) is found in a mail, the definition in maxSize will take place.

If the value of ([message size]) exceeds maxSizeExternal in bytes the transmission of the message will be canceled. No limit is imposed by ASSP if the field is left blank or set to 0. This option allows admins to limit useless bandwidth wasting based on the transmit size.

Use this parameter to set individual maxSizeExternal values for email addresses, domains, user names and IP addresses. A file must be specified if used.
Accepts specific addresses (user@domain.com), user parts (user), entire domains (@domain.com) and IP addresses (CIDR notation like 123.1.101/32 is here not supported!) - group definitions could be used. Use one entry per line. Wildcards are supported (fribo*@domain.co?). A second parameter separated by "=>" specifies the size limit.
For example:
fribo*@thisdomain.co?=>1000000
jhanna=>0
@sillyguys.org=>500000
101.1.2.*=>0
If multiple matches (values) are found in a mail for any IP address in the transport mail chain, any envelope recipient and the envelope sender, the highest value or 0 (no limit) will be used! If no match (value) is found in a mail, the definition in maxSizeExternal will take place.

Don't check the value of maxSizeExternal and maxRealSizeExternal in messages from these addresses/domain. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com).

If the value of (number of [rcpt to] * [message size]) exceeds maxRealSize in bytes the transmission of the message will be canceled. No limit is imposed by ASSP if the field is left blank or set to 0. This option allows admins to limit useless bandwidth wasting based on the total transmit size.

Use this parameter to set individual maxRealSize values for email addresses, domains, user names and IP addresses. A file must be specified if used.
Accepts specific addresses (user@domain.com), user parts (user), entire domains (@domain.com) and IP addresses (CIDR notation like 123.1.101/32 is here not supported!) - group definitions could be used. Use one entry per line. Wildcards are supported (fribo*@domain.co?). A second parameter separated by "=>" specifies the size limit.
For example:
fribo*@thisdomain.co?=>1000000
jhanna=>0
@sillyguys.org=>500000
101.1.2.*=>0
If multiple matches (values) are found in a mail for any IP address in the transport mail chain, any envelope recipient and the envelope sender, the highest value or 0 (no limit) will be used! If no match (value) is found in a mail, the definition in maxRealSize will take place.

If the value of (number of [rcpt to] * [message size]) exceeds maxRealSizeExternal in bytes the transmission of the external message will be canceled. No limit is imposed by ASSP if the field is left blank or set to 0. This option allows admins to limit useless bandwidth wasting based on the total transmit size.

Use this parameter to set individual maxRealSizeExternal values for email addresses, domains, user names and IP addresses. A file must be specified if used.
Accepts specific addresses (user@domain.com), user parts (user), entire domains (@domain.com) and IP addresses (CIDR notation like 123.1.101/32 is here not supported!) - group definitions could be used. Use one entry per line. Wildcards are supported (fribo*@domain.co?). A second parameter separated by "=>" specifies the size limit.
For example:
fribo*@thisdomain.co?=>1000000
jhanna=>0
@sillyguys.org=>500000
101.1.2.*=>0
If multiple matches (values) are found in a mail for any IP address in the transport mail chain, any envelope recipient and the envelope sender, the highest value or 0 (no limit) will be used! If no match (value) is found in a mail, the definition in maxRealSizeExternal will take place.

SMTP error message to reject maxRealSize exceeding mails. For example:552 message exceeds MAXREALSIZE byte (size * rcpt)! MAXREALSIZE will be replaced by the value of maxRealSize.

If an IP exceeds this number of authentication errors (535) the transmission of the current message will be canceled and any new connection from that IP will be blocked for 5-10 minutes.
Every 5 Minutes the 'AUTHError' -counter of the IP will be decreased by one. autValencePB is used for the penalty box.
No limit is imposed by ASSP if the field is left blank or set to 0. This option allows admins to prevent external bruteforce or dictionary attacks via AUTH command. Whitelisted and NoProcessing IP's and IP's in npPB are ignored like any relayed connection.

The number of seconds a session is allowed to be idle before being forcibly disconnected. No limit is imposed by ASSP if the field is left blank or set to 0. If you have not defined an IdleTimeout on your MTA, this value should not be set to 0, because then a connection will never be timed out!

The number of seconds a session is allowed to be idle after a "NOOP" command is received, before being forcibly disconnected. No limit is imposed by ASSP if the field is left blank or set to 0.
This should prevent hackers to hold and block connections by sending "NOOP" commands short before the "smtpIdleTimeout" is reached.

The number of counts a session is allowed send "NOOP" commands following on each other, before being forcibly disconnected. No limit is imposed by ASSP if the field is left blank or set to 0.
This in cooperation with "smtpNOOPIdleTimeout" should prevent hackers to hold and block connections by sending repeatedly "NOOP" commands short before the "smtpNOOPIdleTimeout" is reached. If "smtpNOOPIdleTimeout" is not defined or 0, this value will be ignored!

---

Setting a filter to TestMode will tell ASSP not to reject the mail but rather build up the whitelist and spam and notspam collections. This can go on for some time without disturbing normal operation. Be sure spamSubject is blank, no user should see anything strange. After this very important phase TestMode can be used to tag the message. For example: [SPAM]

Set all filters to TestMode

-> DoBlockExes

-> DoBayesian

-> DoBlackDomain

-> DoBombHeaderRe

-> DoBombRe

-> DoBlackRe

-> DoFakedLocalHelo

-> DoNoValidLocalSender, DoNoSpoofing

-> DoInvalidFormatHelo

-> DoPenaltyMessage

-> DoPenalty, DoPenaltyExtreme,DoDenySMTP

-> ValidateRBL

-> DoScriptRe

-> DoSenderBase DoCountryBlocking DoOrgBlocking

-> DoMSGIDsig

-> ValidateSPF

-> EnableSRS

-> ValidateURIBL

Put the filter automatically in "Message Scoring Mode" when DoPenaltyMessage is set (instead of stopping spam processing altogether).

---

ASSP uses many methods. The method which caught the spam will be prepended to the subject of the email. For example: [DNSBL]

---

If an incoming email matches this text string it will be considered not-spam. This can be used in Spamerror to ask for resending the mail with this text prepended or appended to the subject.

SMTP error message to reject spam. The literal LOCALDOMAIN will be replaced by the recipient domain or defaultLocalHost. SESSIONID will be replaced by the unique ASSP identifier set by uniqeIDLogging. REASON will be replaced by the actual reason. NOTSPAMTAG will be replaced by NotSpamTag. MYNAME will be replaced by myName.

Set this checkbox if you want ASSP to reply with '250 OK' instead of SMTP error code '554 5.7.1'.

Adds a line to the email header "X-Assp-Spam: YES" if the message is spam.

Add "X-Assp-" to the collected spam-mails.

Adds a line to the email header if the message is spam. For example: X-Spam-Status:yes

Adds a line to the email header "X-Assp-Spam-Level:**** " showing the totalscore represented by stars (1 - 20), every star representing five scoring points.

Adds a line to the email header "X-ASSP-Original-Subject: the subject".

Add X-Assp- header for all IP matches.

Adds a line to the email header "X-Assp-Spam-Reason: " explaining why the message is spam.

---

If set spamSubject does NOT get prepended to the subject of any SpamLover-Message.

spamSubject does NOT get prepended to the subject for these recipients. To enable the selection you need to uncheck spamSubjectSL.

If set, spamTags does NOT get prepended to the subject of the SpamLover-Message.

If a message matches this regular expression it will not been blocked, but tagged.

If a message matches this regular expression it will not been blocked, but tagged.

Messages to e.g. baysSpamLovers whose score exceeds this threshold will be blocked. For example: 75

Messages to Spam-Lovers are processed and filtered by ASSP, but get tagged with spamSubject and are not blocked. When a Spam-Lover is not the sole recipient of a message, the message is processed normally, and if it is found to be spam, it will not be delivered to the Spam-Lover. Accepts specific addresses (user@domain.com), user parts (user) or entire domains (@domain.com). Wildcards are supported (fribo*@domain.com). Default: postmaster|abuse.
For example: fribo*@thisdomain.com|jhanna|@sillyguys.org

---

This option and all SpamLover-Options below accepting a second score parameter like "user@your-domain.com=>70"
If such a parameter is defined in any option for an entry and the recipient address matches this entry and the message score exceeds the parameter value, the message will be blocked.
If there are multiple possible matches for a recipient address found, the generic longest match (and value) will be used.
ASSP will use the highes found value for all recipients of an email.

If a message matches this regular expression it will be considered a Bayesian SpamLover message. For example: passwor|news

If set, prevents mail to Bayesian SpamLover from being stored in Spam/Notspam folder.

SpamHaters are used to override SpamLovers / Testmodes / Tagmodes. If a recipient is set as as SpamHater, all spam-messages are blocked, scoring , testmode and spamlover are overwritten..
Example: If you have set your entire domain as a SpamLover(s), but there are some addresses you still wish to block spam for. The message will only be blocked if all recipients are SpamHaters. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).
For example: *fribo@example.com|jhanna|@example.org

SpamHaters are used to override baysSpamLovers / baysTestMode. It may also be used to increase scoring for DoBayesian with Addhater.

Put the filter automatically in "Message Scoring Mode" when DoPenaltyMessage is set (instead of stopping spam processing altogether).

---

This limit ensures that only incoming messages smaller than this limit are processed by ASSP. Most spam isn't bigger than a few k. ASSP will treat incoming messages larger than this SIZE (in bytes) as 'NoProcessing' mail. Empty or 0 disables the feature.

ASSP will treat outgoing messages larger than this SIZE (in bytes) as 'No Processing' mail. Empty or 0 disables the feature.

Mail from any of these IP numbers and Hostnames will pass through without processing.
For example: 145.145.145.145|[localhost]|146.145. All fields marked by '*' accept a filepath/filename : 'file:files/ipnp.txt'.

Mail solely to or from any of these addresses are proxied without processing. Like a more efficient version of SpamLovers and redlist combined. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).

Mail solely from any of these addresses are proxied without processing. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).

Domains from which you want to receive all mail and proxy without processing. Your ISP, domain registration, mail list servers, stock broker, or other key business partners might be good candidates. Note this matches the end of the address, so if you don't want to match subdomains then include the @. Note that buy.com would also match spambuy.com but .buy.com won't match buy.com. For example: sourceforge.net|@google.com|.buy.com

Enter senders email addresses that you want to be processed, even if they are in noprocessing lists. You can list specific addresses (user@anydomain.com), addresses at any domain (user), or entire domains (@anydomain.com). Wildcards are supported (fribo*@domain.com).
For example: fribo@anydomain.com|jhanna|@sillyguys.org or place them in a plain ASCII file one address per line: 'file:files/nodelayuser.txt'.

If a message matches this Perl regular expression ASSP will treat the message as a 'NoProcessing' mail. For example: X-Assp-Version

---

If an email matches this Perl regular expression it will be considered redlisted.
The Redlist serves several purposes:
1) the Redlist is a list of addresses that cannot contribute to the whitelist and which are not considered local even if their mail is from a local computer. For example, if someone goes on a vacation and turns on their autoresponder, put them on the redlist until they return. Then as they reply to every spam they receive they won't corrupt your non-spam collection or whitelist: \[autoreply\]
2) Redlisted addresses will not be added to the Whitelist.
3) Redlisted messages will not be stored in the SPAM/NOTSPAM-collection if DoNotCollectRedList and/or DoNotCollectRedRe is set.
As all fields marked by * this field accepts a list separated by | or a plain ASCII file one address per line: 'file:files/redre.txt'.

Mails matching redRe will not be stored in the collection folders.

Mails matching Redlist will not be stored in the collection folders.

They contribute to the Whitelist and to Notspam. For example: 145.145.145.145|146.145. All fields marked by '*' accept a filepath/filename : 'file:files/ipwl.txt'.

If an incoming email matches this Perl regular expression it will be considered non-spam.
For example: Secret Ham Password|307\D{0,3}730\D{0,3}4[12]\d\d

Domains and addresses from which you want to receive all mail. Your ISP, domain registration, mail list servers, stock broker, or other key business partners might be good candidates. Do not to put widely used domains here like hotmail.com. Put popular domains into whiteSenderBase. Note this matches the end of the address, so if you don't want to match subdomains then include the @. Note that 'example.com' would also match 'spamexample.com' but '.example.com' won't. Wildcards are supported. For example: sourceforge.net|group*@google.com|.example.com. *You may place them in a plain ASCII file one address per line:'file:files/whitedomains.txt'

Check this if you want to reject all mail from anyone NOT on the Whitelist ( whitelistdb ) and not marked noprocessing.

Put here addresses/domains which should only accept whitelisted/noprocessing mail. Accepts specific addresses (user@domain.com), user parts (user) or entire domains (@domain.com). Wildcards are supported (*@domain.com, abuse@*, *@*).

Check this box to allow additions to the whitelist by EmailWhitelistAdd only.

If this option is not set, all addresses in the FROM, SENDER, REPLY-TO, ERRORS-TO, or LIST-* header fields are processed. If this option is set only the envelope 'MAIL FROM\ will be used.

noneenvelope onlyall senders
Defines what sender addresses are added to the whitelist if a message is considered to be from a whitelisted sender.

Normal operation allows all local, authenticated, or whitelisted users to contribute to the whitelist.
Check this box to not allow whitelisted (but not local) users to add to the whitelist.

Check this box to prevent a local sender with non-local domain from contributing to the whitelist. (for example: redirected messages).

Mails from authenticated users will be processed as whitelisted

Save a copy of the white list every this many seconds. Empty or Zero will prevent any saving.

---

This is the number of days an address will be kept on the whitelist without any email to/from this address.

RWL: Real-time white list. These are lists of IP addresses that have somehow been verified to be from a known good host. Senders that pass RWL validation will pass IP-based filters. This requires an installed Net::DNS module in PERL.

If set, the message will also pass Bayesian Filter and URIBL.

Hostnames of RWLs to use separated by "|".
Examples are: list.dnswl.org

A reply is affirmative or negative reply from a RWL. The RWL module will wait for this number of replies (negative or positive) from the RWLs listed under Service Provider for up to the Maximum Time below. This number should be equal to or less than the number of RWL Service Providers listed to allow for randomly unavailable RWLs.

A hit is an affirmative response from a RWL. The RWL module will check all of the RWLs listed under Service Provider, and flag the email with a RWL 'pass' flag if equal to or more than this number of RWLs return a postive whitelisted response. If the number is less but not zero the email is marked 'neutral'

This sets the maximum time to spend on each message performing RWL checks

Enter IP addresses that you don't want to be RWL validated, separated by pipes (|). For example: 145.145.145.145|146.145.

Add X-Assp-Received-RWL header to header of all emails processed by RWL.

IPs in cache will be removed after this interval in days. 0 will disable the cache.

nologstandardverbose

---

nologstandardverbose

Relaying is allowed for these IP numbers and Hostnames. They contribute also to the whitelist. This can take either a directly entered list of IP numbers and Hostnames separated by pipes or a plain ASCII file one address per line: 'file:files/acceptall.txt'.
An IP range is defined e.g. '182.82.10.'. CIDR notation is accepted (182.82.10.0/24). Hyphenated ranges can be used (182.82.10.0-182.82.10.255)

Similar to acceptAllMail, but this is a file with an ABSOLUTE path, not relative to base. No IP-blocks supported. For example: /usr/local/assp/relayhosts

Put here are the domain names that your mail system considers local. Separate entries with | or place them in a plain ASCII file one address per line: 'file:files/localdomains.txt'. Wildcards are supported.
For example: example.org|*example.com
If ASSP finds no other hint that the domain is local, it will reject messages to domains not listed here with 'RelayAttempt'. A successfull DoLDAP, DoVRFY or hit in LocalAddresses_Flat will put the domain part of the queried address into ldaplistdb and will mark the domain as local. You can set nolocalDomains to disable this check during setup and testing.

Similar to localDomains, but with absolute path to the file. Wildcards are not supported. For access to MTA generated files.

Consider domains in the IMail registry to be local

Do not check relaying for invalid domains - let the MTA do it. This can be set to prevent 'RelayAttempt' errors during setup and testing. Attention: this will make ASSP an open relay, if the MTA behind it does not reject invalid domains.

Your mail relayhost (smarthost). For example: mail.relayhost.com:25
if you run Exchange/Notes and you want assp to update the nonspam database and the whitelist, then enter your smtp relay host here. Blank means no relayhost.

The username used for SMTP AUTH authentication to the relayHost - if your ISP need authentication on the SMTP port. Supported authentication methodes are PLAIN, LOGIN, CRAM-MD5 and DIGEST-MD5 . If the relayhost offers multiple methodes, the one with highest security option will be used. The Perl module Authen::SASL must be installed to use this feature! The usage of this feature will be skipped, if the sending MTA uses the AUTH command. Leave this blank, if you do not want use this feature.

The password used for SMTP AUTH authentication to the relayHost. Leave this blank, if you do not want use this feature.

Tell your mail server to connect to this port as its smarthost/relayhost. For example: 225
Note that you'll want to keep the relayPort protected from external access by your firewall.
You can supply an interface:port to limit connections.

Enter any addresses that are allowed to use the relayPort , separated by pipes (|). If empty, any ip address is allowed to connect to the relayPort. If this option is defined, keep in mind : Addresses defined in acceptAllMail are NOT automaticly included and have to be also defined here, if they should be allowed to use the relayPort. For example: 127.0.0.1|172.16..

Check local domains against an LDAP database.
Note: Checking this requires filling in LDAP DomainFilter ( ldLDAPFilter ).and NET::LDAP module in Perl.

Enter any addresses or hostnames that are your ISP or backup MX servers, separated by pipes (|).
These addresses will (necessarily) bypass Griplist, IP Limiting, Delaying, PenaltyBox, SPF, DNSBL and SRS checks unless the IP can be determined by ispHostnames (ISP Connecting IP). For example: 145.145.145.145|145.145.145.146.

Put anything here to identify messages which should bypass all IP based filter like PB, Sender Validation, Griplist, IP Limiting, Delaying, SPF, DNSBL and SRS. For example: email addresses of people who are forwarding from other accounts to their mailbox on your server.

Hostnames (regular expression) to lookup the IP that connected to the ISP/Secondary server.
If found, this address is used to perform IP-based checks on forwarded messages.
For example: mx1\.yourisp\.com or mx1\.yourisp\.net|mx2\.yoursecondary\.com . This hostnames are found in the 'Received:' header, like 'Received: from ...123.123.123.123... by mx1.yourisp.com'. The frontend IP must be listed in ispip. Leave this blank to disable the feature.

Set this checkbox if you want ASSP to reply to IP numbers in ispip with '250 OK' instead of SMTP error code '554 5.7.1'.

It is recommended to set it to 0.5 (Completely GReyIP) for ISP and Secondary MX servers. If left blank the Griplist X value is used (percentage of spam messages in relation to total).
Note: value should be greater than 0 and less than 1, where 0 = never spam and 1 = always spam

Envelope sender addresses treated as bounce origins. Null sender (\<\>) is always included.
Accepts specific addresses (postmaster@example.com), usernames (mailer-daemon), or entire domains (@bounces.domain.com)
Separate entries with pipes: |. For example: postmaster|mailer-daemon

Enter the DB database filename of your POP before SMTP implementation with records stored for dotted-quad IP addresses.
For example: /etc/mail/popip.db

If set Merak 7.5.2 is supported.

Set this checkbox if you want ASSP to drop the connection immediately after an Relaying Error is encountered.

remove nothingremove all remove nonlocal
Set this if you want ASSP to remove unexpected BCC recipient addresses in incoming mail to:
remove nothing
remove all
remove nonlocal

If you want to be able to send mail to local users without a domain name then put the default local domain here.
Blank disables this feature. For example: assp.local

---

Check this box if you don't want X-Assp- headers on outgoing mail.

If an outging message matches this Perl regular expression ASSP will treat the message as a 'NoProcessing' mail. For example: autoreply

If an outging message matches this Perl regular expression ASSP will block the message.

The time interval in seconds in which the number of envelope recipients per sending address should not exceed a specific number ( LocalFrequencyNumRcpt ).
Use this in combination with LocalFrequencyNumRcpt to limit the number of recipients in a given interval, to prevent local abuse - for example from highjacked local accounts. A value of 0 (default) will disable this feature and clean the cache within five minutes. It is recommended to enable DoLocalSenderAddress and/or DoLocalSenderDomain, if you want to use this feature. To give users the chance to inform an admin about such blocked mails, local mails to EmailAdmins are never blocked because of that feature.

The number of envelope recipients per sending address that should not be exceeded in a specific time interval ( LocalFrequencyInt ).
Use this in combination with LocalFrequencyInt to limit the number of recipients in a given interval, to prevent local abuse - for example from highjacked local accounts. A value of 0 (default) will disable this feature and clean the cache within five minutes. It is recommended to enable DoLocalSenderAddress and/or DoLocalSenderDomain, if you want to use this feature. To give users the chance to inform an admin about such blocked mails, local mails to EmailAdmins are never blocked because of that feature.

A list of local addresses, for which the 'local frequency check' should be done. Leave this field blank (default), to do the check for every address.
Accepts specific addresses (user@domain.com), user parts (user) or entire domains (@domain.com). Wildcards are supported (fribo*@domain.com).
For example: fribo*@thisdomain.com|jhanna|@sillyguys.org

A list of local addresses, for which the 'local frequency check' should not be done. Noprocessing messages will skip this check.
Accepts specific addresses (user@domain.com), user parts (user) or entire domains (@domain.com). Wildcards are supported (fribo*@domain.com).
For example: fribo*@thisdomain.com|jhanna|@sillyguys.org

If activated, each local sender address must have a valid Local Domain - needs localDomains or localDomainsFile or ldLDAP or DoLocalIMailDomains.

If activated, each local sender must have a valid Local Address - needs DoVRFY or DoLDAP or LocalAddresses_Flat.

If set, ASSP will move all Local connections where the sender failed DoLocalSenderDomain or DoLocalSenderAddress to a NULL-connection. The sender will receive "250 OK".

---

nologstandardverbosediagnostic

This is an optional list of local addresses for all MTAs behind ASSP. If the address is not found here ASSP will look for other methods of verification (DoLDAP, DoVRFY). If no ASSP-verification is used, the MTA behind ASSP will do it. You can list specific addresses (user@example.com), addresses at any local domain (user), or entire domains (@example.com). Wildcards are supported (fribo*@example.com). Separate entries with a pipe (|).
For example: fribo@example.com|jhanna|@example.org . You may use a plain ASCII file 'file:files/localuser.txt'.

If set and LocalAddresses_Flat is used all domains must be configured here. If not set, only domains existing in LocalAddresses_Flat will be checked.

If set entries in LocalAddresses_Flat without leading '@' are handled as domains,for example 'example.com' means an entire domain.

If a recipient is found in NoProcessing, the user validation is skipped.

If ANY recipient is on reject list, the message will not be delivered. Used for disabled legitimate accounts, where a user may have left the company. This stops wildcard mailboxes from getting these messages. You can list specific addresses (user@example.com), addresses at any local domain (user), or entire domains (@example.com). Wildcards are supported (fribo*@example.com). The field (indicated by the '*') accepts a list separated by '|' (for example: fribo*@example.com|@example.com|user) or a file designated as follows (path relative to the ASSP directory): 'file:files/filename.txt'. Putting in the file: will prompt ASSP to put up a button to edit that file. files is the subdirectory for files. The file does not need to exist, you can create it from the editor by saving it. The file must have one entry per line; anything on a line following a numbersign or a semicolon ( # is ignored (a comment)

Block all addresses which match this RegEx. Note: if you want to block the pipe char '|' it must be masked with the mask character '\' . You may also use metacharacter brackets ([]) for this purpose.

Allow only addresses which match this RegEx.

nologstandardverbose

Mail to any of these addresses will be blocked and the scoring value is added. These addresses are not checked for validity. Entries are separated by '|' where '*' can be used as a match anything wildcard. Entries that start with '@' indicate that all addresses with that domain should match. Entries without '@' indicate the user part of email addresses with any domain.
Valid entries are: john.doe@example.tld|jane.doe|@example.tld|*.department@example.tld

If set, ASSP will move connections with spamtrapaddresses to a NULL-connection. The sender will receive "250 OK".

SMTP reply for trapaddresses. Default: '550 5.1.1 User unknown: EMAILADDRESS'
The literal EMAILADDRESS (case sensitive) is replaced by the fully qualified SMTP recipient (e.g., thisuser@example.com). Make this empty if you do not want to be polite.

disableduse for spamtrapaddressesuse for spamaddressesuse for validation
If enabled, unknown addresses are cached. If set to 'use for spamtrapaddresses' addresses which reach the limit in PenaltyMakeTraps will be used like spamtrapaddresses. If set to 'use for spamaddresses' they will work like spamaddresses. If set to 'use for validation' all entries regardless of their frequency will be used to validate incoming addresses. Note: LocalAddresses_Flat or DoLDAP or DoVRFY must be enabled.

Minimum number of times an address must appear during PBTrapCacheExp before it will be used as spamaddress/spamtrapaddress in DoPenaltyMakeTraps.

Addresses will be removed after this interval in hours if the frequency in PenaltyMakeTraps is not reached.

Addresses which should not be cached. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).

If activated and the format 'Domain=>MTA' is encountered in vrfyDomains recipient addresses will be verified with SMTP-VRFY (if VRFY is not supported 'MAIL FROM:' and 'RCPT TO:' will be used). If you know that VRFY is not supported with a MTA, you may put the MTA into VRFYforceRCPTTO.

Put here the domain names that should be verified with SMTP-VRFY. Separate entries with | or place them in a plain ASCII file one address per line: 'file:files/vrfydomains.txt'. Use the syntax: *mydomain.com=>smtp.mydomain.com|other.com=>mx.other.com:port to verify the recipient addresses with the SMTP-VRFY (if VRFY is not supported 'MAIL FROM:' and 'RCPT TO:' will be used) command on other SMTP servers. The entry behind => must be the hostname:port or ip-address:port of the MTA which is used to verify 'RCPT TO' addresses with a VRFY command! If :port is not defined, port :25 will be used. You can use an entry like ALL=>vrfyhost:port to define a VRFY host for all entries without the MTA part. The default host will also be used for all domains in localDomains which are not set here. If you have only one MTA for verifying and your domains in locadDomains listed, it is sufficient to put ALL=>vrfyhost:port as the single entry here. You have to enable the SMTP 'VRFY' command on your MTA - the 'EXPN' command should be enabled! This requires an installed Net::SMTP module in PERL.
If you have configured LDAP and enabled DoLDAP and ASSP finds a VRFY entry for a domain, LDAP search will be done first and if this fails, the VRFY will be used. So VRFY could be used for LDAP backup/fallback/failover!
It is recommended to configure 'ldaplistdb' in the 'File Paths and Database' section when using this verify extension - so ASSP will store all verified recipients addresses there to minimize the querys on MTA's. There is no need to configure LDAP, but both VRFY and LDAP are using ldaplistdb. Please go to the 'LDAP setup' section to configure MaxLDAPlistDays and LDAPcrossCheckInterval or start a crosscheck now with forceLDAPcrossCheck. This three parameters belong also to VRFY.

The number of seconds ASSP will wait for an answer of the MTA that is queryed with the VRFY command to verify a recipient address. See description of localDomains for the necessary modification to localDomains to run this feature

Define local MTAs here for which you want ASSP to force the usage of 'MAIL FROM:' and 'RCPT TO:' instead of the VRFY command. The definition of the MTA(s) has to be exactly the same as already defined in localDomains (after the '=>') for example: smtp.mydomain.com|mx.other.com:port|10.1.1.1|10.1.1.2:125 .

If you have enabled VRFY on your MTA to allow ASSP to verify addresses and you do not want external clients to use VRFY/EXPN - select this option.

The maximum number of failed 'RCPT TO' or 'VRFY' commands encountered before the connection is dropped. ASSP will drop the connection, if the count of '550 unknown user' errors, received from your 'smtpDestination'(MTA), reached this value!

VRFY failures return false when an error occurs in VRFY lookups.

nologstandardverbose

disabledblockmonitorscore
Block remote servers that uses the same recipient address more times, than the number defined in MaxDupRcpt in the RCPT TO: command. Scoring is done with mdrValencePB . This check is skipped for outgoing, noprocessing, whitelisted and spamlovers mails. If a message has to be delayed, this check will score before the delay if set to block or score - and score and/or block on the next server request.

The maximum number of duplicate recipient addresses that are allowed in the sequence of the RCPT TO: commands!
The number per mail is calculated by 'number of RCPT TO: commands - number of unique recipient addresses'.
For example: if one address is used three times or two addresses are used each two times, will result in the same count - 2. Or if both is the case in one mail, the count will be 4.

recommended if used: file:files/rcptreplrules.txt - default empty ! This enables recipient replacement. The replacement will be done before any ASSP check. For a more detailed description of the rules and options, read the file: Recipient Replacement Test

ASSP will deliver messages addressed to all postmasters of your local domains to this address. For example: postmaster@example.com

ASSP will deliver messages to all abuse addresses of your local domains to this address. For example: abuse@example.com

If activated, each local address is checked to conform with the email format defined in RFC5322 .
This requires an installed Email::Valid module in PERL.

ASSP will send to these addresses if no valid user is found in LocalAddresses_Flat or LDAP.
For example: catchall@domain1.com|catchall@domain2.com

If set, ASSP will move all ISP connections with wrong recipient addresses to a NULL-connection. The ISP will receive "250 OK" until the mail has passed, but the mail will not be sent to your MTA. This is done after CatchAll but before CatchAllAll is checked.

ASSP will send to this address if no valid user is found in LocalAddresses_Flat or LDAP and no match is found in Catchall per Domain.
For example: catchall@example.com

ASSP will discard a message silently when encountering such an address in "MAIL FROM:" or "RCPT TO:". Accepts specific addresses (null@example.com), user parts (nobody) or entire domains (@example.com).

These local addresses do not accept mail externally. Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).

RFC 3598 describes subaddressing with a Separation Character. A star ('*') is not allowed as Separation Character. Everything between Separation Character and @ is ignored (including Separation Character). For Example = '+' will allow user+subaddress@example.com.

If set, ASSP will support addresses like domainx!user@domainy and will convert them to user@domainx .

SMTP reply for invalid Users. Default: '550 5.1.1 User unknown: EMAILADDRESS'
The literal EMAILADDRESS (case sensitive) is replaced by the fully qualified SMTP recipient (e.g., thisuser@example.com).

---

disabledmonitorscore
Use the list of blacklisted-helo hosts built by rebuildspamdb. Scoring is done with hlValencePB.

nologstandardverbose

disabledmonitorscore
Score servers with SuspiciousHeloRe in Helo. Scoring is done with shValencePB

Score Suspicious HELOs will check incoming HELOs for this.
For example: 'dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|ADSL|dial(up|in)|pool|dhcp|leased'

disabledmonitorscore
Score servers with reversed IP number in Helo and check for mismatch with sending IP.

disabledblockmonitorscore
Block remote servers that claim to come from our Local Domain/Local IPs/Local Host. Scoring with fhValencePB, testmode with fhTestMode.

If set and DoFakedLocalHelo is enabled, ASSP will check faked Helos before Delaying. Note: fhTestMode or allTestMode will disable the early execution.

If set, DoFakedLocalHelo will use localDomains.

Disable "Block Forged Helo's" for whitelisted addresses (not recommended).

Disable "Block Forged Helo's" for addresses identified as noprocessing (not recommended).

Local Domains, IP numbers and Hostnames are often use to fake (forge) the Helo. Include all IP addresses and hostnames for your server here, localhost is already included. Include Local Domains of your choice here, if you deactivated the automatic use of the localDomains list. For example: 11.22.33.44|mx.example.com|example.org

Enter IP addresses that you don't want to be HELO validated.
For example: 145.145.145.145|146.145

HELO / EHLO greetings on this list will be excluded from the HELO checks. For example: host123.isp.com|host456.*.com

If set and DoInvalidFormatHelo is enabled, ASSP will do DoInvalidFormatHelo before Delaying. Note: ihTestMode or allTestMode will disable the early execution.

disabledblockmonitorscore
If activated, the HELO is checked against the expression below. If the Regular Expression matches, the HELO is not ok. Scoring is done with ihValencePB, set testmode with ihTestMode.

Invalidate Format HELO will check incoming HELOs for this. Each regex can be assigned a weight. If the score which results from weight is less than ihValencePB, the message will not be blocked (even if 'block' is set) but scored.
For example: \.user=>0.5|^\d+\.\d+\.\d+\.\d+$|^[^\.]+\.?$ or place them in a plain ASCII file one address per line: file:files/invalidhelo.txt

Validate Format HELO will check incoming HELOs according to rfc1123.
For example: ^(([a-z\d][a-z\d-]*)?[a-z\d]\.)+[a-z]{2,6}$

Do validate Helo for whitelisted addresses.

Do validate Helo for messages marked 'noprocessing'.

---

nologstandardverbose

disabledblockmonitorscore
DoBlackDomain uses blackListedDomains and blackAddresses. Scoring is done with blValencePB, testmode with blTestMode.

Do blacklisting addresses & domains in messages which are marked whitelisted by whiteRe, whiteListedDomains, whiteListedIPs or whitelistdb.

Do blacklisting addresses & domains in messages marked 'noprocessing' by npRe, npSize, noProcessingDomains, noProcessingIPs or noProcessing.

Addresses and Domains from which you always want to reject mail, they only send you spam. Note this matches the end of the address, so if you don't want to match subdomains then include the @. Note that example.com would also match spamexample.com but .example.com won't match example.com. abc@example.com will match abc@example.com but won't match bbc@example.com. Wildcards are supported.

If not enabled all addresses in the FROM, SENDER, REPLY-TO, ERRORS-TO, or LIST-* header fields are checked.

Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com).

Accepts specific addresses (user@example.com), user parts (user) or entire domains (@example.com). Wildcards are supported. A positive weight will make the address 'blackish'. A negative weight will make the address into 'whitish'. For example: fribo*@example.com|@*.gov=>-0.5|@*.biz=>0.5 .

disabledmonitorscore
Score messages with missing/suspicious/invalid Message-ID. Scoring is done by midmValencePB / midsValencePB / midiValencePB .

Enter IP addresses that you don't want to be Message-ID validated, separated by pipes (|). For example: 127.0.0.1|192.168.

Check Message IDs will check incoming messages for valid Message-IDs.
For example: ^.+@.+\..+$

Check Message IDs will check incoming messages for invalid Message-IDs.

disabledblockmonitorscore
If activated, each external sender from a domain listed in localDomains is checked against LocalAddresses_Flat, LDAP or is verified using VRFY. An external sender is a sender from an IP not in acceptAllMail, not authenticated and not coming through the relayPort.Scoring is done with flValencePB, testmode with flsTestMode.

If set and DoNoValidLocalSender is enabled, ASSP will do DoNoValidLocalSender before Delaying. Note: flsTestMode or allTestMode will disable the early execution.

disabledblockmonitorscore
If activated, each external sender address from a domain listed in localDomains is regarded a spoofed address. An external sender is a sender from an IP not in acceptAllMail, not authenticated and not coming through the relayPort. flValencePB is used for scoring, testmode is set with flsTestMode.