Add Your Trusted Infrastructure

​

Add email servers

1. Open shared/guarded_tenants.yml.
2. Under trustedMTAs, add an entry for each email server that is part of your email infrastructure. You only need to add servers that do not use a private IP.
   guarded_tenants.yml

   tenants:
     - name: example
       # Add your servers either via IP OR via hostname. Servers with private IPs do not need to be added
       trustedMTAs:
         # Via IP in CIDR notation
         - hostCidrBlock: 1.2.3.4/32
         - hostCidrBlock: 5.6.7.0/24
         # Via hostname regex (matching the EHLO)
         - hostNamePattern: exchange\.example\.com
         - hostNamePattern: .*\.example\.com
   
3. This step is only required if outgoing email sent to xorlab are not DKIM signed. For all of your Exchange servers, add an authenticDomains parameter that contains all your guarded domains.
   Use authenticDomains only for servers that do not forward malicious emails. Do not use it for your gateway.
   guarded_tenants.yml

   tenants:
     - name: example
       trustedMTAs:
         - hostNamePattern: exchange\.example\.com
           # Add all your guarded domains as regex
           authenticDomains:
             - example\.com
             - example\.net
   

   Information

   authenticDomains will set all emails coming from that corresponding server as authentic. This is used to tell xorlab from which infrastructure you send outgoing emails. When you sign emails with DKIM, this is not required anymore.
4. Open the activeguard/core/startup_cfg/spamass/local.cf file and add the IP address of each of your email server that receives incoming emails before xorlab. This is only required for email servers that do not use a private IP address (RFC1918).
   local.cf

   # Set which networks or MTAs are considered trusted
   trusted_networks 1.2/16 5/8                 # all in 1.2.*.* and 5.*.*.*
   trusted_networks 212.17.35.15               # specific address
   trusted_networks 1.                         # all in 1.*.*.*
   
5. Click Publish. The guarded_tenants.yml changes become active within about one minute. If you edited local.cf in step #4, restart all MTAs as well, because files under activeguard/core/startup_cfg/ require an MTA restart:
   cd /etc/xorlab/activeguard
   docker compose down && docker compose up -d
   

​

Verify

1. Check that outgoing emails are marked as outgoing. For this, search for from:*@guarded.com and see if the direction is correct. Replace guarded.com with your primary guarded domain.
2. Open an incoming email in the detail view and check that the IP and EHLO are correct. They should contain the external sender, not your infrastructure.

​

Next steps

• Enable SAML or LDAP Login
• Integrate Reported Emails