Filter before your mail server
The gateway receives your mail from the Internet first, filters it, then passes the clean mail on to your real mail server.
E-mail (gateway)
A mail security gateway: ToutWAF installs and manages Postfix and Rspamd on a server of yours, over SSH, to filter the incoming mail of your domains (anti-spam, anti-phishing, attachments, data-loss prevention). Under licence and experimental: not yet tried in real conditions.
Where to find it in the console : Console: Infrastructure > Mail (“Mail security”).
Read this first
This function is experimental, not yet proven in production. We prefer to say so before describing anything.
- Not yet tried in real conditions: the configuration was read by the real Postfix and Rspamd tools, but no message has gone through a gateway in operation. Try it with a few messages of your own and read the report before sending your domain's mail through it.
- Under licence, with no free tier. When a licence expires, what is set up keeps filtering and everything stays readable; only saving the configuration, installing and applying are refused.
- It needs a dedicated Linux server that does not host mailboxes, with port 25 free and reachable from the Internet.
What it is for
Without typing a command
ToutWAF installs and manages Postfix and Rspamd from the console, on your server, over SSH. No SSH access is stored: the credentials are used once.
Never an open relay
Every generated configuration is checked: the relayed domains are exactly your protected domains. A gateway that would accept an unprotected domain is shown red.
Nothing goes to a third party
The Rspamd modules that contact a third party are off; the “online reputation lists” option turns them back on and says exactly what leaves. The content of a message is never in the audit log.
What the gateway does
Everything marked “off by default” stays off until you switch it on: switch one family on at a time and watch the message log.
Anti-spam
A score per message; above the spam threshold (6 by default) the action applies: quarantine (recommended), a mark in the subject or refusal; above the rejection threshold (15), refusal.
Sender verification
SPF, DKIM and DMARC, off by default: observation mode (headers are written, nothing weighs on the score) or enforcement.
Data-loss prevention
Detects payment cards, IBANs, French and US social security numbers and your keywords, with an action per detector. Off by default, on incoming mail only.
Attachments
Checks the type of files by name, including inside archives: programs, documents with macros, double extensions, password-protected archives. Off by default.
ClamAV antivirus
If you enable it, each attached file is handed to ClamAV (or an engine speaking its protocol) running on the gateway. ToutWAF does not install ClamAV. When the antivirus does not answer, you choose: try again later (default), hold in quarantine, or let through.
Quarantine, Doctor, reports
A quarantine to release or delete from, a mail diagnostic, reports and, as an option (off by default), outgoing mail with DKIM signing and sending limits.
What was verified
With the real Postfix 3.8.6 and Rspamd 3.8.1 tools from Ubuntu, outside a running server.
- Every generated configuration is read without warning by Postfix and Rspamd.
- Protected domains relayed and others refused; greylisting, detections, attachment policy and verifiable DKIM signing.
- The antivirus was proven against a fake daemon that speaks the ClamAV protocol, not against real signatures.
What is not done
Said plainly.
- Mail archiving, a per-user digest, a release portal for users, Microsoft 365 and Google connectors and a filter on the machine that hosts the mailboxes are not built.
- Advanced data-loss prevention (document fingerprints, attachment extraction, API keys, approval flows) and DLP on outgoing mail are not done.
- QR codes in images are not read; links are not rewritten with a check at click time.
What remains to be proven
We prefer to say it plainly.
- The Postfix daemon never ran in these tests: the durable queue, STARTTLS, rate limits, releasing a message and the sender's real retry after greylisting were not exercised.
- No real ClamAV, no real mail received or delivered (no open port 25, no Gmail or Outlook, no IPv6), no real DNS or blocklist request.
- No spam or phishing corpus, no performance measurement, no false-positive rate: that is why every detection is off by default and adjustable.
- Only Rspamd 3.8.1 and Postfix 3.8.6 were tried; the availability of the Rspamd package on AlmaLinux and Rocky Linux (EPEL) was not verified.
Use cases
Protect a domain's mail
The gateway sits in front of your mail server; you try it with a few messages, in quarantine, before sending all the mail through it.
Spot data leaks
You switch one detector on at a time (cards, IBANs, keywords) and watch the message log before acting.
Check attachments
Programs, macros and password-protected archives go to quarantine; you release what was legitimate.
What is included, by edition
A function under licence: it stays visible in the console, locked, without a licence.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Nog niet onder echte omstandigheden getest Werkt in de tests van het product, maar is nog niet geprobeerd met de echte dienst, het echte systeem of de echte apparatuur. De console toont dezelfde opmerking waar u de functie instelt.
- Inkomende gateway vóór uw mailserver, via SSH geïnstalleerd en beheerd op een dedicated Linux-server Nog niet onder echte omstandigheden getestPro en hoger
- Antispam en antiphishing, bijlagebeleid, optionele antivirus, quarantaine Nog niet onder echte omstandigheden getestPro en hoger
- Preventie van gegevenslekken in berichten Nog niet onder echte omstandigheden getestPro en hoger
- Afzenderverificatie (SPF, DKIM, DMARC), greylisting, detectie van imitatie en links: alles standaard uit Nog niet onder echte omstandigheden getestPro en hoger
- Nooit een open relay: elke configuratie wordt gecontroleerd; als het filter stopt, wordt de mail vastgehouden, niet verloren Nog niet onder echte omstandigheden getestPro en hoger
- Optionele uitgaande mail: relay, DKIM-ondertekening, verzendlimieten Nog niet onder echte omstandigheden getestPro en hoger
- Maildokter, dagelijkse samenvatting van de quarantaine, rapporten en exports Nog niet onder echte omstandigheden getestPro en hoger
- Standaard gaat niets van uw mail naar derden; de inhoud van een bericht staat nooit in het auditlogboek Nog niet onder echte omstandigheden getestPro en hoger
Every function in this list carries the note “not yet proven in production”. When a paid licence ends, what is set up keeps filtering; only saving the configuration, installing and applying are refused.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.