Administrator's Guide - Kerio Software Archive

14.4 Email scanning
Figure 14.9
Settings for SMTP and POP3 scanning
Note: Regardless of what action is set to be taken, the attachment is always removed and
a warning message is attached instead.
Use the TLS connections section to set firewall behavior for cases where both mail client and
the server support TLS-secured SMTP or POP3 traffic.
In case that TLS protocol is used, unencrypted connection is established first. Then, client
and server agree on switching to the secure mode (encrypted connection). If the client or the
server does not support TLS, encrypted connection is not used and the traffic is performed in
a non-secured way.
If the connection is encrypted, firewall cannot analyze it and perform antivirus check for
transmitted messages. The firewall administrator can select one of the following alternatives:
• Enable TLS. This alternative is suitable for such cases where protection from
wiretapping is prior to antivirus check of email.
Hint:
In such cases, it is recommended to install an antivirus engine at
individual hosts that would perform local antivirus check.
• Disable TLS. Secure mode will not be available. Clients will automatically assume
that the server does not support TLS and messages will be transmitted through an
unencrypted connection. Firewall will perform antivirus check for all transmitted mail.
201