Filter before your mail server
The gateway receives your mail from the Internet first, filters it, then passes the clean mail on to your real mail server.
البريد (بوابة)
A mail security gateway: ToutWAF installs and manages Postfix and Rspamd on a server of yours, over SSH, to filter the incoming mail of your domains (anti-spam, anti-phishing, attachments, data-loss prevention). Under licence and experimental: not yet tried in real conditions.
Where to find it in the console : Console: Infrastructure > Mail (“Mail security”).
Read this first
This function is experimental, not yet proven in production. We prefer to say so before describing anything.
- Not yet tried in real conditions: the configuration was read by the real Postfix and Rspamd tools, but no message has gone through a gateway in operation. Try it with a few messages of your own and read the report before sending your domain's mail through it.
- Under licence, with no free tier. When a licence expires, what is set up keeps filtering and everything stays readable; only saving the configuration, installing and applying are refused.
- It needs a dedicated Linux server that does not host mailboxes, with port 25 free and reachable from the Internet.
What it is for
Without typing a command
ToutWAF installs and manages Postfix and Rspamd from the console, on your server, over SSH. No SSH access is stored: the credentials are used once.
Never an open relay
Every generated configuration is checked: the relayed domains are exactly your protected domains. A gateway that would accept an unprotected domain is shown red.
Nothing goes to a third party
The Rspamd modules that contact a third party are off; the “online reputation lists” option turns them back on and says exactly what leaves. The content of a message is never in the audit log.
What the gateway does
Everything marked “off by default” stays off until you switch it on: switch one family on at a time and watch the message log.
Anti-spam
A score per message; above the spam threshold (6 by default) the action applies: quarantine (recommended), a mark in the subject or refusal; above the rejection threshold (15), refusal.
Sender verification
SPF, DKIM and DMARC, off by default: observation mode (headers are written, nothing weighs on the score) or enforcement.
Data-loss prevention
Detects payment cards, IBANs, French and US social security numbers and your keywords, with an action per detector. Off by default, on incoming mail only.
Attachments
Checks the type of files by name, including inside archives: programs, documents with macros, double extensions, password-protected archives. Off by default.
ClamAV antivirus
If you enable it, each attached file is handed to ClamAV (or an engine speaking its protocol) running on the gateway. ToutWAF does not install ClamAV. When the antivirus does not answer, you choose: try again later (default), hold in quarantine, or let through.
Quarantine, Doctor, reports
A quarantine to release or delete from, a mail diagnostic, reports and, as an option (off by default), outgoing mail with DKIM signing and sending limits.
What was verified
With the real Postfix 3.8.6 and Rspamd 3.8.1 tools from Ubuntu, outside a running server.
- Every generated configuration is read without warning by Postfix and Rspamd.
- Protected domains relayed and others refused; greylisting, detections, attachment policy and verifiable DKIM signing.
- The antivirus was proven against a fake daemon that speaks the ClamAV protocol, not against real signatures.
What is not done
Said plainly.
- Mail archiving, a per-user digest, a release portal for users, Microsoft 365 and Google connectors and a filter on the machine that hosts the mailboxes are not built.
- Advanced data-loss prevention (document fingerprints, attachment extraction, API keys, approval flows) and DLP on outgoing mail are not done.
- QR codes in images are not read; links are not rewritten with a check at click time.
What remains to be proven
We prefer to say it plainly.
- The Postfix daemon never ran in these tests: the durable queue, STARTTLS, rate limits, releasing a message and the sender's real retry after greylisting were not exercised.
- No real ClamAV, no real mail received or delivered (no open port 25, no Gmail or Outlook, no IPv6), no real DNS or blocklist request.
- No spam or phishing corpus, no performance measurement, no false-positive rate: that is why every detection is off by default and adjustable.
- Only Rspamd 3.8.1 and Postfix 3.8.6 were tried; the availability of the Rspamd package on AlmaLinux and Rocky Linux (EPEL) was not verified.
Use cases
Protect a domain's mail
The gateway sits in front of your mail server; you try it with a few messages, in quarantine, before sending all the mail through it.
Spot data leaks
You switch one detector on at a time (cards, IBANs, keywords) and watch the message log before acting.
Check attachments
Programs, macros and password-protected archives go to quarantine; you release what was legitimate.
What is included, by edition
A function under licence: it stays visible in the console, locked, without a licence.
الإصدارمجاني مشمول في جميع العروض، ومنها العرضان المجانيان (Free وFree +)Pro وما فوق العروض المدفوعة: ظاهرة في وحدة التحكم ومقفلة دون ترخيص. ابتداءً من Pro ما لم يُذكر Agency أو Enterprise
لم تُجرَّب بعد في ظروف حقيقية تعمل في اختبارات المنتج، لكنها لم تُجرَّب بعد مع الخدمة أو النظام أو العتاد الحقيقي. تعرض وحدة التحكم الملاحظة نفسها في المكان الذي تضبط فيه الوظيفة.
- بوابة واردة أمام خادم بريدك، تُثبَّت وتُدار عبر SSH على خادم Linux مخصص لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- مكافحة الرسائل المزعجة والتصيّد، وسياسة المرفقات، ومضاد فيروسات اختياري، وحجر لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- منع تسرّب البيانات في الرسائل لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- التحقق من المرسل (SPF وDKIM وDMARC) والقائمة الرمادية وكشف انتحال الهوية والروابط: كلها معطّلة افتراضياً لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- ليست أبداً مُمرِّراً مفتوحاً: تُفحص كل إعدادات، وإن توقف المرشّح تُحتجز الرسائل ولا تضيع لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- بريد صادر اختياري: تمرير وتوقيع DKIM وحدود للإرسال لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- طبيب البريد، والملخص اليومي للحجر، والتقارير والتصدير لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
- لا يذهب أي شيء من بريدك إلى طرف ثالث افتراضياً؛ ومحتوى الرسالة لا يظهر أبداً في سجل التدقيق لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
Every function in this list carries the note “not yet proven in production”. When a paid licence ends, what is set up keeps filtering; only saving the configuration, installing and applying are refused.
الأسعار Read the documentation
ضع درعاً أمام تطبيقاتك اليوم
ثبّته على خادمك الخاص، أو راسلنا للحديث عن التراخيص.