Skip to main content

LevelBlue Completes Acquisition of Cybereason. Learn more

LevelBlue Completes Acquisition of Cybereason. Learn more

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

HOWTO: How do email messages flow through MailMarshal SMTP?

Expand / Collapse


This article applies to:

  • MailMarshal (SEG)

Symptoms:

  • How do email messages flow through MailMarshal SMTP?
  • How does MailMarshal handle or process email messages?

Information:

  1. Messages are received by MailMarshal with the MMReceiver service and are placed into the Incoming directory. By default, this directory is located in the subfolder \Queues\Incoming within the product installation. Messages are created with a unique name of the form Bnnnnnnnnnnnn.nnnnnnnnnnnn.nnnn.mml and will be preceded by a ~ character until the entire message has been received.
  2. Once received the MMEngine service will unpack a copy of the email message into the Unpacking directory. By default, this directory is located at \Unpacking.  Once processed the messages are either placed in a user defined Quarantine directory or into the ProcessedOK directory. By default, this directories are located at \Quarantine and \Queues\ProcessedOK.
  3. The MMSender service picks messages from the ProcessedOK directory and places them into the Sending directory. By default, this directory is located at \Queues\Sending. The messages stay in this directory until they are successfully delivered or the message has expired.

The MMEngine and MMSender services can generate Dead letters and place them in one of the Dead Letter directories.  Dead Letters can be generated when a message cannot be, or for security reasons should not be delivered to the intended recipient. Typical reasons for this are routing problems, corrupted messages, or in certain circumstances corrupted content.

A Dead Letter is a message MailMarshal cannot process or cannot deliver. Dead Letters can result from bad email addresses, from corrupted data, from differing interpretations of Internet standards, or when a message is intentionally malformed in an attempt to exploit a security vulnerability.

The MMPOP3 service is only present if MailMarshal is being used as a POP3 server.  In this case, it reads messages from mailbox directories stored under the Sending directory.  The MMSender service places messages into these directories as appropriate based on addressing information.

Message Flow Diagram:


 

Notes:

  • Default install locations differ depending on version. For more information, see Q10832: What are the MailMarshal SMTP install paths and registry key locations?
  • For more information about message names, see Q11347: Message and Quarantine Naming Conventions 

This article was previously published as:
NETIQKB45234

To contact LevelBlue about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.