> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Add Your Trusted Infrastructure

> Register your own email infrastructure as trusted so xorlab can trace the true origin of an email.

More information and explanations about trusted infrastructure can be found under [Trusted MTAs](/latest/trusted-mtas).

## Add email servers

1. Open `shared/guarded_tenants.yml`.
2. Under `trustedMTAs`, add an entry for each email server that is part of your email infrastructure. You only need to add servers that do not use a private IP.
   ```yaml guarded_tenants.yml theme={null}
   tenants:
     - name: example
       # Add your servers either via IP OR via hostname. Servers with private IPs do not need to be added
       trustedMTAs:
         # Via IP in CIDR notation
         - hostCidrBlock: 1.2.3.4/32
         - hostCidrBlock: 5.6.7.0/24
         # Via hostname regex (matching the EHLO)
         - hostNamePattern: exchange\.example\.com
         - hostNamePattern: .*\.example\.com
   ```
3. This step is only required if outgoing email sent to xorlab are not DKIM signed. For all of your Exchange servers, add an `authenticDomains` parameter that contains all your guarded domains.
   <Warning>
     **Use `authenticDomains` only for servers that do not forward malicious emails. Do not use it for your gateway.**
   </Warning>
   ```yaml guarded_tenants.yml highlight={6-8} theme={null}
   tenants:
     - name: example
       trustedMTAs:
         - hostNamePattern: exchange\.example\.com
           # Add all your guarded domains as regex
           authenticDomains:
             - example\.com
             - example\.net
   ```
   <Accordion title="Information">
     `authenticDomains` will set all emails coming from that corresponding server as authentic. This is used to tell xorlab from which infrastructure you send outgoing emails. When you sign emails with DKIM, this is not required anymore.
   </Accordion>
4. Open the `activeguard/core/startup_cfg/spamass/local.cf` file and add the IP address of each of your email server that receives incoming emails before xorlab. This is only required for email servers that do not use a private IP address (RFC1918).
   ```shell local.cf theme={null}
   # Set which networks or MTAs are considered trusted
   trusted_networks 1.2/16 5/8                 # all in 1.2.*.* and 5.*.*.*
   trusted_networks 212.17.35.15               # specific address
   trusted_networks 1.                         # all in 1.*.*.*
   ```
5. Click **Publish**. The `guarded_tenants.yml` changes become active within about one minute. If you edited `local.cf` in step #4, [restart all MTAs](/latest/activate-configuration#configuration-files) as well, because files under `activeguard/core/startup_cfg/` require an MTA restart:
   ```shell theme={null}
   cd /etc/xorlab/activeguard
   docker compose down && docker compose up -d
   ```

## Verify

1. Check that outgoing emails are marked as outgoing. For this, search for `from:*@guarded.com` and see if the direction is correct. Replace `guarded.com` with your primary guarded domain.
2. Open an incoming email in the detail view and check that the `IP` and `EHLO` are correct. They should contain the external sender, not your infrastructure.

## Next steps

Optionally continue with:

* [Enable SAML or LDAP Login](/latest/on-prem-saml-ldap-authentication)
* [Integrate Reported Emails](/latest/on-prem-reporting-integration)

Once the integration is complete, continue with [What to Configure Next](/latest/integration-next-steps).