cancel
Showing results for 
Search instead for 
Did you mean: 

Questions on Quarantine

Beran
Grafter
Posts: 63
Registered: 31-07-2007

Questions on Quarantine

Currently I'm reviewing Quarantine functionality on a free account before enabling it on our main paid accounts. I've searched through the forum and help, and seem unable to find the answers to a number of questions.
1. It seems that there is an independant quarantine for each email mailbox. (i.e. fred@myaccount.plus.com and bert@myaccount.plus.com). Is this right?
2. With hosted domains, are there separate quarantines for each domain, or is the quarantine shared across the aliased email addresses?
3. If the quarantine is shared, what is the login email address (fred@myaccount.plus.com or fred@mydomain.com or either?)
4. The PlusNet portal allows the loading of a Whitelist/Blacklist for each account or domain. The IronPort quarantine screen allows addition to a Safelist. As the Safelist appears to be on an mailbox basis, is this the same as, or related to, the PlusNet Whitelist? Ideally, the PlusNet whitelist would apply on a domain/account wide basis, and the Safelist be personal to the mailbox. (Am I hoping for too much?)
5. If you are on a free account, and add an address to the SafeList, how do you verify this, or delete it, as you are unable to login to manage the list?
6. With the Postini system, there was a limit on the size of the whitelist, which made the whitelist system totally unusable for a business. Is there a limit on the size of whitelist/blacklist/safelists?
7. Is there a known set of  'Spam' email which can be used for testing the system? When working with Antivirus solutions, the Eicar 'virus' is used to verify correct operation. Is something similar available for IronPort? In particular, it would be helpful to be able to send a mail which is supposed to end up in Quarantine to verify operation, and allow user training.
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?
14 REPLIES
Community Veteran
Posts: 26,341
Thanks: 595
Fixes: 8
Registered: 10-04-2007

Re: Questions on Quarantine

Quote from: Beran
Currently I'm reviewing Quarantine functionality on a free account before enabling it on our main paid accounts. I've searched through the forum and help, and seem unable to find the answers to a number of questions.
1. It seems that there is an independant quarantine for each email mailbox. (i.e. fred@myaccount.plus.com and bert@myaccount.plus.com). Is this right?

Yes
Quote from: Beran
2. With hosted domains, are there separate quarantines for each domain, or is the quarantine shared across the aliased email addresses?

Separate. You have to log in to fred@username.plus.com, fred@domain1.co.uk and fred@domain2.com (same password for all three)
Quote from: Beran
3. If the quarantine is shared, what is the login email address (fred@myaccount.plus.com or fred@mydomain.com or either?)

N/A
Quote from: Beran
4. The PlusNet portal allows the loading of a Whitelist/Blacklist for each account or domain. The IronPort quarantine screen allows addition to a Safelist. As the Safelist appears to be on an mailbox basis, is this the same as, or related to, the PlusNet Whitelist? Ideally, the PlusNet whitelist would apply on a domain/account wide basis, and the Safelist be personal to the mailbox. (Am I hoping for too much?)

I think you may be hoping for too much. AIUI if you make any changes in MMM they will update everything for the selected domain - including all mailboxes. I suppose it is possible that you can make additions for specific mailboxes - you'd have to see of changes you'd made in IronPort were overwritten by changes made in MMM (don't forget to allow plenty of time for the changes to filter through)
Quote from: Beran
5. If you are on a free account, and add an address to the SafeList, how do you verify this, or delete it, as you are unable to login to manage the list?

Are you talking about the IronPort safelist? I'd have thought the only safe way was to make all changes via MMM.
Quote from: Beran
6. With the Postini system, there was a limit on the size of the whitelist, which made the whitelist system totally unusable for a business. Is there a limit on the size of whitelist/blacklist/safelists?

Pass
Quote from: Beran
7. Is there a known set of  'Spam' email which can be used for testing the system? When working with Antivirus solutions, the Eicar 'virus' is used to verify correct operation. Is something similar available for IronPort? In particular, it would be helpful to be able to send a mail which is supposed to end up in Quarantine to verify operation, and allow user training.

What a good idea! (I've had very dodgy results when testing what happened when I sent myself the Eicar!)
Quote from: Beran
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?

I suspect that's pretty unlikely.
Do you also use aliases or redirects? If so read http://community.plus.net/forum/index.php/topic,71696.0.html
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Beran
Grafter
Posts: 63
Registered: 31-07-2007

Re: Questions on Quarantine

Jelv,
Thanks for the helpful replies. Anyone from PlusNet fancy filling in the answers still missing?
ramidoodle
Grafter
Posts: 265
Registered: 28-09-2008

Re: Questions on Quarantine

Quote from: Beran
6. With the Postini system, there was a limit on the size of the whitelist, which made the whitelist system totally unusable for a business. Is there a limit on the size of whitelist/blacklist/safelists?

not sure if this has been changed, if not then it's still 4000 characters
Quote from: Beran
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?

AFAIK, The email service for free accounts is exactly the same as for subscription accounts. the only difference is that you will not be able to use your username and password for authentication with our outgoing mail servers via the free account login details
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Questions on Quarantine

Quote from: RamiDoodle
Quote from: Beran
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?

AFAIK, The email service for free accounts is exactly the same as for subscription accounts. the only difference is that you will not be able to use your username and password for authentication with our outgoing mail servers via the free account login details

But as stated in Bob P's blog IronPort anti-spam migration FAQ non-subscription accounts do not have logon access to IronPort quarantine - which I assume is the reason for the quoted question.
David
cjags
Grafter
Posts: 390
Thanks: 3
Registered: 31-08-2007

Re: Questions on Quarantine

But as stated in Bob P's blog non-subscription accounts do not have logon access to IronPort quarantine...

Which is causing an interesting gotcha for my partner.
She still has a free plusnet account (just for email) and is getting the daily email from Ironport.
It has the options to forward messages marked as spam and when she does this, she gets an option to add this address to the safelist.
She clicks on the option to do this and is presented with the Ironport login screen.
However, being a free account, she can't login.  Undecided
I am guessing that the only way to get these added to the safelist is via MMM in the membership centre?
Also, should Ironport be giving options to free accounts that they can't possibly use?
Beran
Grafter
Posts: 63
Registered: 31-07-2007

Re: Questions on Quarantine

I've tried raising a ticket to get answers on some of these questions, but I'm not getting any useful responses.
The questions still unresolved are:-
With the Postini system, there was a limit on the size of the whitelist, which made the whitelist system totally unusable for a business. Is there a limit on the size of whitelist/blacklist/safelists? The CSC 'thinks' that there 4000 character limit doesn't exist, but can't say what has replaced it.
I'm still unclear about the relationship between the IronPort Safelist, and the Portal Whitelist. The portal whitelist is common across all mailboxes, so if a mailbox user addes to the Safelist, does it then get addedd to the account global Whitelist?
I'm not happy to enable Quarantine for our business account, until I understand properly how it works, which I can't do through the free trial account I'm using.
Community Gaffer
Community Gaffer
Posts: 12,799
Thanks: 630
Fixes: 62
Registered: 04-04-2007

Re: Questions on Quarantine

Quote from: Beran
4. The PlusNet portal allows the loading of a Whitelist/Blacklist for each account or domain. The IronPort quarantine screen allows addition to a Safelist. As the Safelist appears to be on an mailbox basis, is this the same as, or related to, the PlusNet Whitelist? Ideally, the PlusNet whitelist would apply on a domain/account wide basis, and the Safelist be personal to the mailbox. (Am I hoping for too much?)

Adding things to the whitelist via Manage My Mail should add the same entries to the safelist on *all* of your domains. If you add enties via the IronPort interface then AIUI this would work on a mailbox by mailbox basis.
Quote
5. If you are on a free account, and add an address to the SafeList, how do you verify this, or delete it, as you are unable to login to manage the list?

Wasn't aware that this happened. It's not the greatest of user experiences but not sure if there's an awful lot we can do about it from an architectural point of view Sad
Quote
6. With the Postini system, there was a limit on the size of the whitelist, which made the whitelist system totally unusable for a business. Is there a limit on the size of whitelist/blacklist/safelists?

Yes there is, I believe it's 500 addresses/domains per list.
Quote
7. Is there a known set of  'Spam' email which can be used for testing the system? When working with Antivirus solutions, the Eicar 'virus' is used to verify correct operation. Is something similar available for IronPort? In particular, it would be helpful to be able to send a mail which is supposed to end up in Quarantine to verify operation, and allow user training.

Whilst looking into another problem recently, I've used telnet to compose an email containing a dodgy link - This always gets picked up as spam (thanks to mikeb of Usergroup ilk for this one). From a command line...
 C:\Users\bpullen>telnet mx-ironport.core.plus.net 25
220 mx.ptn-ipin02.plus.net ESMTP
ehlo ironport
250-mx.ptn-ipin02.plus.net
250-8BITMIME
250 SIZE 104857600
mail from:<me@privacy.net>
250 sender <me@privacy.net> ok
rcpt to:<local_part@your_username.plus.com>
250 recipient <local_part@your_username.plus.com> ok
data
354 go ahead
See attached
BEST OFFER. VISIT RIGHT NOW! <http://bwbflp.niebgeqn.com/?00444621>
.
250 ok:  Message 5081957 accepted
quit
221 mx.ptn-ipin02.plus.net

Quote
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?

No, although it's worth bearing in mind that Quarantine now uses exactly the same heuristics as if you were to tag junk messages as [-SPAM-] or have them delivered to your 'Spam' folder.
Quote from: RamiDoodle
Quote from: Beran
8. Is it possible to get the full Quarantine functionality enabled on a free account, to allow testing and training preparation prior to relasing it across the entire business?

AFAIK, The email service for free accounts is exactly the same as for subscription accounts. the only difference is that you will not be able to use your username and password for authentication with our outgoing mail servers via the free account login details

That's not the case Rami, non-subscription accounts cannot log into http://quarantine.plus.net, instead you need to use the links in the notification emails. Come and grab me the next time I'm in if you want further clarification.

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 26,341
Thanks: 595
Fixes: 8
Registered: 10-04-2007

Re: Questions on Quarantine

Quote from: Bob
Quote from: Beran
4. The PlusNet portal allows the loading of a Whitelist/Blacklist for each account or domain. The IronPort quarantine screen allows addition to a Safelist. As the Safelist appears to be on an mailbox basis, is this the same as, or related to, the PlusNet Whitelist? Ideally, the PlusNet whitelist would apply on a domain/account wide basis, and the Safelist be personal to the mailbox. (Am I hoping for too much?)

Adding things to the whitelist via Manage My Mail should add the same entries to the safelist on *all* of your domains. If you add enties via the IronPort interface then AIUI this would work on a mailbox by mailbox basis.

That's not my experience. Unless I tick Apply these settings to all my domains the additions apply to just the selected domain.
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Questions on Quarantine

I suspect Bob should have said
Adding things to the whitelist via Manage My Mail should add the same entries to the safelist on *all* mailboxes for the selected domain (or of all your domains if Apply these settings to all of my domains is selected). If you add enties via the IronPort interface then AIUI this would work on a mailbox by mailbox basis.
Thanks for pointing that out. I'll add this answer to the FAQ.

David
Beran
Grafter
Posts: 63
Registered: 31-07-2007

Re: Questions on Quarantine

I tried creating a mail with the content suggested by Bob:-
BEST OFFER. VISIT RIGHT NOW! <http://bwbflp.niebgeqn.com/?00444621>
It sailed right into my mailbox without any tagging at all.
I've actually not seen any email tagged with [SPAM] for some while now, maybe something is broken somewhere?
Community Gaffer
Community Gaffer
Posts: 12,799
Thanks: 630
Fixes: 62
Registered: 04-04-2007

Re: Questions on Quarantine

@Beran, there seems to be some mail marked as [-SPAM-] in your default mailbox. I also sent a couple of test emails to you using telnet as described in my last post. If you don't get these then you might want to consider switching Edge Protection off for all of your domains and see if that makes a difference.
Quote from: spraxyt
I suspect Bob should have said
Adding things to the whitelist via Manage My Mail should add the same entries to the safelist on *all* mailboxes for the selected domain (or of all your domains if Apply these settings to all of my domains is selected). If you add enties via the IronPort interface then AIUI this would work on a mailbox by mailbox basis.

Yep, that's right. I should have made that a little clearer Embarrassed

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵

ramidoodle
Grafter
Posts: 265
Registered: 28-09-2008

Re: Questions on Quarantine

Quote from: Bob
That's not the case Rami, non-subscription accounts cannot log into http://quarantine.plus.net, instead you need to use the links in the notification emails. Come and grab me the next time I'm in if you want further clarification.

Ops! sorry, I must admit that I haven't read all of the FAQ when it has been first posted Embarrassed
Thanks Bob  Wink
cjags
Grafter
Posts: 390
Thanks: 3
Registered: 31-08-2007

Re: Questions on Quarantine

Quote from: Bob
That's not the case Rami, non-subscription accounts cannot log into http://quarantine.plus.net, instead you need to use the links in the notification emails. Come and grab me the next time I'm in if you want further clarification.

Although those links contain some options that require you to login to http://quarantine.plus.net
Community Gaffer
Community Gaffer
Posts: 12,799
Thanks: 630
Fixes: 62
Registered: 04-04-2007

Re: Questions on Quarantine

@cjags, which links? All the ones I can see automatically log you into Quarantine Undecided

Bob Pullen
Plusnet Products Team
If I've been helpful then please give thanks ⤵