This article applies to:
- Trustwave MailMarshal (SEG) 7.2 and above
- IPv6
Question:
- What are the features of MailMarshal that support IPv6?
- What are the configuration options for IPv6 with MailMarshal?
- What are the limitations on use of IPv6 with MailMarshal?
Information:
SEG/MailMarshal 7.2 and above supports use of IPv6 connectivity for email transmission, user interface connections, array connectivity, and database connectivity.
In an environment that supports IPv6, in general you can use an IPv6 address in SEG anywhere that you can enter an IP address. Also, you can use FQDNs or machine names that resolve to IPv6 addresses.
This article notes some exceptions and some configuration options that are specific to IPv6 environments.
Sender binding:
You can bind the MailMarshal Sender service to specific IPv6 (and IPv4) addresses on the server. See article Q10034.
Features that do not support IPv6:
- IP Reputation services (DNS based block lists) do not currently list any information or accept queries for IPv6 addresses. This limitation applies to all supported services such as Spamhaus, the Marshal IP Reputation Service, and others. IPv6 addresses are excluded from these checks and the exclusion is logged in service text logs. Trustwave expects to support IPv6 reputation services in the future when the vendors update their services.
- SPF evaluation:
- In SEG 8.0 and above, SPF evaluation is available for IPv6 addresses.
- In SEG 7.X, SPF evaluation does not trigger for IPv6 addresses. The exclusion is logged in service text logs. This issue affects Receiver SPF criteria and the Engine Spoofing criteria.
- CountryCensor does not trigger for IPv6 addresses. The exclusion is logged in service text logs.
- Note that Country Censor is not available in SEG 8.0 and above.
Automatic Updates and IPv6:
SEG automatic updates are served from sites that do not currently have IPv6 addresses. This includes SpamCensor and unpacking DLL updates, as well as the Sophos for Marshal, McAfee for Marshal, and Bitdefender for Marshal virus scanner updates.
- If the SEG components are in a pure IPv6 environment, you can use a proxy server to retrieve the updates.
Upgrade and configuration import:
- When you upgrade SEG or import a configuration for an earlier version, IPv6 binding for the Receiver connections is disabled by default. This is to avoid changes in policy results that depend on IP addresses.
- If a server had custom (IPv4) binding settings before upgrade, they will not be changed by the upgrade process
- To accept messages via IPv6, change the Receiver binding for each processing server.
- Find this setting in the Configurator, Server and Array Configuration > Servers > {server name}, open Server Properties and select Advanced.
- To allow binding on all IP addresses and ports, delete any entries in the Receiver Binding list. A default entry will be added automatically.
- Save and commit configuration.
- All network mask entries are now expressed in CIDR notation (for example, 127.0.0.1/32). On upgrade any network masks in dotted quad format (255.255.255.255) are translated to the equivalent CIDR number. Any invalid masks that are found are reported by the upgrade process.