Switch Between Inline and Monitoring Mode

xorlab can run in either of the following modes:

Monitoring: xorlab is located out-of-band of the mail flow and is only used to monitor the traffic (it cannot intervene in your mail flow). Usually, it receives the email traffic as an additional BCC recipient and the copies are dropped after processing. This mode allows email traffic monitoring with low impact on the infrastructure. Detection and the configured actions still run in full, so emails do get the QUARANTINED decision — see Decisions and quarantine in Monitoring mode.
Inline: xorlab is inline in the mail flow and actively filters emails. This mode is configured whenever xorlab is used for inbound email security. Emails are forwarded after they have been processed.

Monitoring mode

The following changes are necessary to run xorlab in Monitoring mode:

Open Expert Editor and navigate to the activeguard/core/active_guard.yml file.

Under the relevant SMTP handler, set senderRecipientExtraction.recipientExtraction: MAIL_HEADER and senderRecipientExtraction.senderExtraction: HEADER:

For M365 integrations, the value for senderRecipientExtraction.senderExtraction should be MAIL_ENVELOPE.

active_guard.yml

scanSources:
  smtp:
    port: 10025
    handler:
      smtpReport: {}
    # The following line activates Monitoring mode.
    # All emails will be dropped after processing.
      smtpOffline:
        senderRecipientExtraction:
          # Get the recipients from the TO and CC headers
          recipientExtraction: MAIL_HEADER
          # Get the envelope `FROM` from email headers
          senderExtraction: HEADER

Set up SMTP routing for Monitoring mode: see Set Up Email Routing in xorlab for on-premises or Microsoft 365.
Disable delivery status notifications.
Click Publish. The monitoring mode configuration becomes active within about one minute.

This configuration sets xorlab Security Platform into Monitoring mode. For more information about sender and recipient extraction, please see the next section. It is possible to omit the handler block as it is set to smtpOffline {} by default:

active_guard.yml

scanSources:
  smtp:
    port: 10025
    ## Default handler configuration - applied if nothing else specified
    #handler:
    #- smtpReport
    #- smtpOffline

Envelope-fromIt is important to provide xorlab Security Platform the original envelope FROM in Monitoring mode. With the above configuration, xorlab tries to derive it from email headers. Further possibilities are described in the next chapter.

Sender and recipient extraction

In Monitoring mode, emails are often forwarded as copies (BCC) to xorlab. In this case, it is possible that the SMTP envelope FROM and recipient information have been overwritten as a part of the BCC forward. The envelope FROM might be something like MAILER-DAEMON@gateway.internal and the envelope recipient is xorlab itself like, for example, emails@xorlab.internal when the email arrives at xorlab. Therefore, you need to configure xorlab to get the envelope FROM and recipients from the correct location:

active_guard.yml

scanSources:
  smtp:
    port: 10025
    handler:
      smtpOffline:
        senderRecipientExtraction:
          recipientExtraction: MAIL_HEADER
          senderExtraction: HEADER

For M365 integrations, set senderRecipientExtraction.senderExtraction to MAIL_ENVELOPE instead of HEADER.

Wrong configurationThe usual symptom of a wrong envelope FROM configuration is a missing or wrong envelope FROM shown in the detail view of an email in XCC. Consequently, xorlab cannot do various checks like, for example, SPF verification.

The following values are supported for senderRecipientExtraction.senderExtraction:

Value	Default	Description
`HEADER`	Default for `smtpOffline` (Monitoring mode)	Try to get the original envelope `FROM` from email headers
`MAIL_ENVELOPE`	Default for `smtpInline` (Inline mode)	Take the envelope `FROM` from the SMTP `MAIL FROM` command

The following values are supported for senderRecipientExtraction.recipientExtraction:

Value	Default	Description
`MAIL_HEADER`	Default for `smtpOffline` (Monitoring mode)	Use the `TO` and `CC` headers to get all recipients
`MAIL_ENVELOPE`	Default for `smtpInline` (Inline mode)	Take the recipients from the SMTP `RCPT TO` command

For reported email handlers, senderRecipientExtraction.reporterExtraction controls how the sender of the report itself is extracted. Supported values are MAIL_ENVELOPE and FROM_HEADER. You can also provide the original envelope FROM through specific headers by matching them with senderHeaderNamePattern:

active_guard.yml

scanSources:
  smtp:
    port: 10025
    handler:
      smtpOffline:
        senderRecipientExtraction:
          recipientExtraction: MAIL_HEADER
          senderExtraction: CUSTOM_HEADER
          # Specify a custom header that contains the original envelope `FROM`
          senderHeaderNamePattern: "x-original-envelope-from"

It is also possible to use a regex when you have multiple custom headers to check; provide that regex as the value for senderHeaderNamePattern:

active_guard.yml

          senderHeaderNamePattern: x-one-envelope-from|x-other-envelope-from

The above expression matches either first or second header.

Disable delivery status notifications

For Monitoring mode, we recommend to generally disable delivery status notifications. This includes bounce emails. This will make sure that xorlab will never send delivery status notifications back to the sender when being in Monitoring mode.

Open the Expert Editor and navigate to the activeguard/mta/startup_cfg/postfix_custom/master.cf file.

Find the three lines starting with bounce unix, defer unix, and trace unix, and set the last word on all three lines to discard:

# Disable all delivery status notifications
bounce    unix  -       -       n       -       0       discard
defer     unix  -       -       n       -       0       discard
trace     unix  -       -       n       -       0       discard

Open the activeguard/mta/startup_cfg/postfix_custom/main.cf file and comment out (e.g., using the Ctrl+/ or Cmd+/ keyboard shortcut) the delay_warning_time property (if you have multiple main.cf files, do it in each of them):
## Deactivate delivery delay notifications through commenting it out #delay_warning_time = 1h #confirm_delay_cleared = yes

Disable Delivery Status Notification (DSN) for bcc deployments in each main.cf file.

## xorlab bcc deployment specific settings
# Disable Delivery Status Notification (DSN) for bcc deployments
smtpd_discard_ehlo_keywords = silent-discard, dsn

Click Publish. The new Postfix settings become active within about one minute.

Decisions and quarantine in Monitoring mode

Detection and the Actions configuration screen apply exactly as they do in Inline mode:

An email whose verdict and confidence lead to a quarantine action gets the QUARANTINED decision, and its copy is kept in the matching quarantine instead of being dropped. Search for status:quarantined to list them.
Every other email is dropped after processing.

None of this reaches your mail flow. xorlab only ever holds back its own copy, and the email the recipient received was delivered by your existing mail flow, untouched. A quarantine that fills up in Monitoring mode is therefore expected.

Inline mode

In Inline mode, xorlab Security Platform is part of the email traffic and forwards emails accordingly. In order to activate it:

Open Expert Editor and navigate to the activeguard/core/active_guard.yml file.

Under the relevant SMTP handler, set smtpInline: {} instead of smtpOffline. senderExtraction and recipientExtraction can be omitted as they default to MAIL_ENVELOPE:

active_guard.yml

scanSources:
  smtp:
    port: 10025
    handler:
      smtpReport: {}
    # The following line activates the Inline mode.
      smtpInline: {}

Make sure that bounce messages are enabled in activeguard/mta/startup_cfg/postfix_custom/master.cf:

# bounce, defer and trace must be set to "bounce"
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce

Activate delivery delay notifications in activeguard/mta/startup_cfg/postfix_custom/main.cf:

## Enable delivery delay notifications
delay_warning_time = 1h
confirm_delay_cleared = yes

Set up SMTP routing for Inline mode: see Set Up Email Routing in xorlab for on-premises or Microsoft 365.
Click Publish. The inline mode configuration becomes active within about one minute.

​Monitoring mode

​Sender and recipient extraction

​Disable delivery status notifications

​Decisions and quarantine in Monitoring mode

​Inline mode

Monitoring mode

Sender and recipient extraction

Disable delivery status notifications

Decisions and quarantine in Monitoring mode

Inline mode