Filter before your mail server
The gateway receives your mail from the Internet first, filters it, then passes the clean mail on to your real mail server.
邮件（网关）
A mail security gateway: ToutWAF installs and manages Postfix and Rspamd on a server of yours, over SSH, to filter the incoming mail of your domains (anti-spam, anti-phishing, attachments, data-loss prevention). Under licence and experimental: not yet tried in real conditions.
Where to find it in the console : Console: Infrastructure > Mail (“Mail security”).
Read this first
This function is experimental, not yet proven in production. We prefer to say so before describing anything.
- Not yet tried in real conditions: the configuration was read by the real Postfix and Rspamd tools, but no message has gone through a gateway in operation. Try it with a few messages of your own and read the report before sending your domain's mail through it.
- Under licence, with no free tier. When a licence expires, what is set up keeps filtering and everything stays readable; only saving the configuration, installing and applying are refused.
- It needs a dedicated Linux server that does not host mailboxes, with port 25 free and reachable from the Internet.
What it is for
Without typing a command
ToutWAF installs and manages Postfix and Rspamd from the console, on your server, over SSH. No SSH access is stored: the credentials are used once.
Never an open relay
Every generated configuration is checked: the relayed domains are exactly your protected domains. A gateway that would accept an unprotected domain is shown red.
Nothing goes to a third party
The Rspamd modules that contact a third party are off; the “online reputation lists” option turns them back on and says exactly what leaves. The content of a message is never in the audit log.
What the gateway does
Everything marked “off by default” stays off until you switch it on: switch one family on at a time and watch the message log.
Anti-spam
A score per message; above the spam threshold (6 by default) the action applies: quarantine (recommended), a mark in the subject or refusal; above the rejection threshold (15), refusal.
Sender verification
SPF, DKIM and DMARC, off by default: observation mode (headers are written, nothing weighs on the score) or enforcement.
Data-loss prevention
Detects payment cards, IBANs, French and US social security numbers and your keywords, with an action per detector. Off by default, on incoming mail only.
Attachments
Checks the type of files by name, including inside archives: programs, documents with macros, double extensions, password-protected archives. Off by default.
ClamAV antivirus
If you enable it, each attached file is handed to ClamAV (or an engine speaking its protocol) running on the gateway. ToutWAF does not install ClamAV. When the antivirus does not answer, you choose: try again later (default), hold in quarantine, or let through.
Quarantine, Doctor, reports
A quarantine to release or delete from, a mail diagnostic, reports and, as an option (off by default), outgoing mail with DKIM signing and sending limits.
What was verified
With the real Postfix 3.8.6 and Rspamd 3.8.1 tools from Ubuntu, outside a running server.
- Every generated configuration is read without warning by Postfix and Rspamd.
- Protected domains relayed and others refused; greylisting, detections, attachment policy and verifiable DKIM signing.
- The antivirus was proven against a fake daemon that speaks the ClamAV protocol, not against real signatures.
What is not done
Said plainly.
- Mail archiving, a per-user digest, a release portal for users, Microsoft 365 and Google connectors and a filter on the machine that hosts the mailboxes are not built.
- Advanced data-loss prevention (document fingerprints, attachment extraction, API keys, approval flows) and DLP on outgoing mail are not done.
- QR codes in images are not read; links are not rewritten with a check at click time.
What remains to be proven
We prefer to say it plainly.
- The Postfix daemon never ran in these tests: the durable queue, STARTTLS, rate limits, releasing a message and the sender's real retry after greylisting were not exercised.
- No real ClamAV, no real mail received or delivered (no open port 25, no Gmail or Outlook, no IPv6), no real DNS or blocklist request.
- No spam or phishing corpus, no performance measurement, no false-positive rate: that is why every detection is off by default and adjustable.
- Only Rspamd 3.8.1 and Postfix 3.8.6 were tried; the availability of the Rspamd package on AlmaLinux and Rocky Linux (EPEL) was not verified.
Use cases
Protect a domain's mail
The gateway sits in front of your mail server; you try it with a few messages, in quarantine, before sending all the mail through it.
Spot data leaks
You switch one detector on at a time (cards, IBANs, keywords) and watch the message log before acting.
Check attachments
Programs, macros and password-protected archives go to quarantine; you release what was legitimate.
What is included, by edition
A function under licence: it stays visible in the console, locked, without a licence.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
尚未在真实环境中试过 在产品测试中运行正常，但尚未用真实的服务、系统或设备试过。您设置该功能时，控制台会在相应位置显示同样的提示。
- 置于邮件服务器之前的入站网关，通过 SSH 在专用 Linux 服务器上安装和管理 尚未在真实环境中试过Pro 及以上
- 反垃圾邮件与反钓鱼、附件策略、可选杀毒、隔离区 尚未在真实环境中试过Pro 及以上
- 防止邮件中的数据泄露 尚未在真实环境中试过Pro 及以上
- 发件人验证（SPF、DKIM、DMARC）、灰名单、冒充与链接检测：默认全部关闭 尚未在真实环境中试过Pro 及以上
- 绝不会成为开放中继：每份配置都经过检查；过滤器停止时邮件被暂存，而不会丢失 尚未在真实环境中试过Pro 及以上
- 可选的外发邮件：中继、DKIM 签名、发送限额 尚未在真实环境中试过Pro 及以上
- 邮件诊断、隔离区每日摘要、报告和导出 尚未在真实环境中试过Pro 及以上
- 默认情况下您的邮件不会发给任何第三方；邮件内容绝不会出现在审计日志中 尚未在真实环境中试过Pro 及以上
Every function in this list carries the note “not yet proven in production”. When a paid licence ends, what is set up keeps filtering; only saving the configuration, installing and applying are refused.