This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG MTA Mode SPAM detection quality and missing reject mode for confirmed spam

Dr No over 5 years ago

first steps with XG and compared to UTM, SPAM-handling could be better to my mind.

However, too much SPAM E-Mails are received so far. Though declared as SPAM, you just have the following options:

- warn (tagged as SPAM in subject)

- drop

- quarantine

- none

What does this mean? It means, that the users are confronted with unwanted mails, though they are already classified as SPAM. They can release it from quarantine or receive them immediatly. But in either case, they have to deal with junk.

Dropping is never an option - no one get's informed, data loss could happen. This would be a bad choice.

What is missing and what UTM can do in this case is rejecting during SMTP conversation. This is the missing point here.

Even in FW 18 I don't find this option, only in legacy mode. But I don't consider this yet, I would prefer MTA mode.

So, will this feature, analog to UTM, be available any time?

Regarding SPAM-Protection, XG seems not to be an alternative at this moment.

This thread was automatically locked due to age.

0 Keyur over 5 years ago

Hi Dr No

I will check your requirement if we can achieve your requirement in Sophos XG and will update the thread.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago

Hi Dr No

I have checked there is no exact feature as per the UTM available in the XG firewall, you may refer to the article.

You may refer to this article - https://docs.sophos.com/nsg/sophos-firewall/v16056/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/EmailRulesManage.html
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Keyur

Wondering, do you have the option "Reject based on IP reputation" on General Settings enabled?
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 5 years ago

Hello Dr No,

Just to add here.

In my opinion Drop Action for "SPAM action" would actually achieve I think the same as in the UTM for reject at SMTP transaction, in which if the UTM detects the email is SPAM the user would never know they were sent this email.

I think this is the reason why the XG has two options for SPAM "Spam Action" and "Probable Spam Action", I would set the Spam Action to DROP "Not a good idea" but I think it would achieve the same as in the UTM, but for Probable Spam Action, then here select either Warn or Quarantine.

Also don't forget to also enable the "Use Graylisting" and as my colleague LuCar Toni mentions, make sure to also enable under Protect >> Email >> General Settings >> SMTP settings >> Reject based on IP reputation.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Dr No over 5 years ago in reply to LuCar Toni

yes, I did.
Cancel
Vote Up 0 Vote Down

Cancel
0 Dr No over 5 years ago in reply to emmosophos

greylisting and I get lots of calls from customers: "where the hell is the e-mail my client sent me 30s ago???"

No, I don't like that, I never use it;-)

As I understood drop is drop. In UTM it states clearly: reject during smtp transfer, thus, the sending mailserver should forward the error code to the sender upon reject. Drop in XG means deleting by the MTA in XG and no one would get informed. In case of false positives or problems with spam detection (and this happens sometimes), data loss occurs.
Cancel
Vote Up 0 Vote Down

Cancel