> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Before You Begin

> Complete before any integration: configure guarded domains, set data retention, and choose inline or monitoring mode.

## Configure your guarded domains

Open the Expert Editor and add all domains that should be protected by xorlab to `shared/guarded_tenants.yml`.

```yaml shared/guarded_tenants.yml theme={null}
tenants:
- name: xorlab
  # Add all domains that should be protected
  domains:
  - xorlab.com
  - "**.xorlab.com" # To include subdomains; note the required quotes
```

## Define data retention

Review the default data retention parameters below. If you want to change a parameter, specify it in the same file `shared/guarded_tenants.yml`. Otherwise, no action is required.

<Note>
  **SaaS**

  For xorlab SaaS, these values are managed by xorlab. Please contact [support@xorlab.com](mailto:support@xorlab.com) if you want to change it.
</Note>

```yaml shared/guarded_tenants.yml theme={null}
tenants:
- name: xorlab
  ## Default data retention
  dataRetention:
    ## Duration after which benign mails are deleted.
    deliveredTtlDays: 90
    ## Duration after which reported messages are deleted.
    reportedTtlDays: 730
    ## Duration after which quarantind emails are deleted.
    quarantinedDefaultTtlDays: 30
```

For all available retention and storage configurations, see [Data Retention Overview](/latest/data-retention-overview).

When you finish editing `shared/guarded_tenants.yml`, click **Publish**. The new configuration becomes active within about one minute.

## Choose between Inline and Monitoring mode

**Choose and configure either of those two modes.** This choice will also be required later in the setup.

For new xorlab instances, the mode is normally already preconfigured.

<CardGroup cols={2}>
  <Card title="Inline" icon="shield" href="/latest/before-begin-integration#configure-inline-mode">
    Active protection. Emails pass through xorlab and are forwarded to the next system. This mode is required for productive integrations. Supports *toothless* operation.
  </Card>

  <Card title="Monitoring" icon="envelope-open-text" href="/latest/before-begin-integration#configure-monitoring-mode">
    xorlab receives only a copy of every email, and discards it after processing. This mode is used for temporary evaluations.
  </Card>
</CardGroup>

### Configure Inline mode

For more information and explanations, see [Inline and Monitoring Mode](/latest/inline-and-monitoring-mode).

1. In `activeguard/core/active_guard.yml`, configure the SMTP handlers and the sender/recipient extraction settings:
   ```yaml active_guard.yml theme={null}
   scanSources:
     smtp:
       port: 10025
       handler:
       # Inline mode - filter and forward processed emails
         smtpInline: {}
         smtpReport: {}
   ```
2. Open `activeguard/mta/startup_cfg/postfix_custom/master.cf` and set the following lines to `bounce`.
   ```ini master.cf theme={null}
   # Enable all delivery status notifications
   bounce    unix  -       -       n       -       0       bounce
   defer     unix  -       -       n       -       0       bounce
   trace     unix  -       -       n       -       0       bounce
   ```
3. Open `activeguard/mta/startup_cfg/postfix_custom/main.cf` and configure it like this.
   ```ini main.cf highlight={2-3,6} theme={null}
   # Enable delay warnings
   delay_warning_time = 1h
   confirm_delay_cleared = yes
   # Ativate DSNs
   smtpd_discard_ehlo_keywords = silent-discard
   ```
4. **Optional:** Enable *toothless* mode during learning phase. This will force xorlab to deliver all emails, even malicious ones.
   <Accordion title="Toothless mode">
     In toothless mode, xorlab will not take any actions on emails and always deliver them. This is only used for the first few weeks to avoid false positives during the learning phase. Afterward, this profile needs to be removed again. In toothless mode, you can search for `#quarantine` to find the emails that xorlab would have quarantined.
   </Accordion>
   ```yaml guarded_tenants.yml theme={null}
   tenants:
   - name: xorlab
     ruleProfiles:
     - default_dana.properties
     - default_actions.properties
     # Add this line to enable toothless mode
     - no_subject_rewrite_no_quarantine.properties
   ```
5. Click **Publish**. The new configuration becomes active within about one minute.

### Configure Monitoring mode

For more information and explanations, see [Inline and Monitoring Mode](/latest/inline-and-monitoring-mode).

1. In `activeguard/core/active_guard.yml`, configure the SMTP handlers and the sender/recipient extraction settings:

   ```yaml active_guard.yml theme={null}
   scanSources:
     smtp:
       port: 10025
       handler:
       # Activate Monitoring mode - all emails will be dropped after processing.
         smtpOffline:
           senderRecipientExtraction:
             # Get the recipients from the TO and CC headers
             recipientExtraction: MAIL_HEADER
             # Get the envelope sender from email headers
             senderExtraction: HEADER
         smtpReport: {}
   ```

   <Warning>
     For M365 integrations, set `senderRecipientExtraction.senderExtraction` to `MAIL_ENVELOPE` instead of `HEADER`.
   </Warning>

2. Open `activeguard/mta/startup_cfg/postfix_custom/master.cf` and set the following lines to `discard`.
   ```ini master.cf theme={null}
   # Disable all delivery status notifications
   bounce    unix  -       -       n       -       0       discard
   defer     unix  -       -       n       -       0       discard
   trace     unix  -       -       n       -       0       discard
   ```

3. Open `activeguard/mta/startup_cfg/postfix_custom/main.cf` and configure it like this.
   ```ini main.cf highlight={2-3,6} theme={null}
   # Comment out the following two lines. This will deactivate delay notifications.
   #delay_warning_time = 1h
   #confirm_delay_cleared = yes
   # Disable Delivery Status Notification (DSN) extension
   smtpd_discard_ehlo_keywords = silent-discard, dsn
   ```

4. Click **Publish**. The new configuration becomes active within about one minute.