Sophos XG Firewall Administrator Guide v15.01.0

| Protection | 149
POP/S and IMAP/S Settings
Don't Scan Emails Greater Than
Specify maximum file size (in KB) for scanning. Files exceeding this size received through POP/IMAP will not
be scanned.
Default - 1024 KB
Specify 0 to increase the default file size restriction to 10240 KB.
Recipient Headers
Specify Header value to detect recipient for POP3/IMAP.
Default - Delivered-To, Received, X-RCPT-TO
Figure 124: POP/S and IMAP/S Settings
SMTP TLS Configuration
TLS Certificate
Select the CA for scanning SMTP traffic over SSL from the available options.
Available Options
DefaultSecurityAppliance_SSL_CAList of custom CAs if added. You can create the custom CA from Objects >
Identity > Certificate Authority.
Allow Invalid Certificate
If enabled, SMTP over SSL connections will be allowed with an invalid certificate from the Email Server.
Disable this option to reject such connections.
Default - Enable
Require TLS Negotiation with Host/Net
Select the remote host (Email Server) or network from available options on whose connections TLS encryption
is to be enforced. In other words, the Device will always initiate TLS-secured connections when Emails are to
be sent to selected hosts/networks. If TLS is enforced but connection cannot be established, then Emails to that
remote host/network are discarded.
Require TLS Negotiation with Sender Domain
Specify the Sender Domain(s) on whose Email connections TLS encryption is to be enforced.
Sender Domain is the domain of the Email sender. Emails from the specified Sender Domain will be sent over
TLS-encrypted connections only. If TLS is enforced but connection cannot be established, then Emails from that
sender domain are discarded.
Skip TLS Negotiation Hosts/Nets
Select the remote host (Email Server) or network from available options on whose connections TLS encryption is
to be skipped or bypassed. When configured, SMTP connections to selected hosts will be established in clear text
and unencrypted.