Comma-delimited list of domainkey domains to enable and use DKIM.

• Default: N/A
• Required: No
• Values: Text

Comma-delimited list of customer header and values to use for whitelisting downstream.

• Default: N/A
• Required: No
• Values: Text

Hostname of Gateway must be populated to match the TLS certificate CN (common name).

• Default: N/A
• Required: Yes
• Values: Text

Domain name of organization

• Default: N/A
• Required: Yes
• Values: Text

Enable Proxy Protocol for SMTP.  Most situations will require this setting to be a 0.  A 1 is required only when the Load Balancer supports proxy functionality.

• Default: 1
• Required: Yes
• Values: 0,1

Comma-delimited list of trusted networks in CIDR notation allowed to connect to this Gateway.

• Default: N/A
• Required: Yes
• Values: Text

Comma-delimited set of domains to relay for

• Default: N/A
• Required: No
• Values: Text

Comma-delimited set of domains to whitelist.

• Default: N/A
• Required: No
• Values: Text
• Note: Applicable only when Gateway is used in the inbound mode.

If enabled, these are the domains and their corresponding users, and passwords.

• Default: N/A
• Required: No
• Values: Text
• Note: Applicable only when:
  • GATEWAY_SMTP_SASL_ENABLED_DOWNSTREAM=0

example.com=>user1=>password1

example.com=>user2=>password2

example.net=>user3=>password3

• Default: 0
• Required: No
• Values: 0,1

If SASL_ENABLED_DOWNSTREAM enabled, specify Postfix SMTP client SASL security options here.

• Default: N/A
• Required: No
• Values: Text

Sets the minimum transport security required for outbound connections from the Gateway.

• Default: opportunistic.
• Required: No
• Values: mandatory or opportunistic
• Note: Only used when GATEWAY_SMTP_USE_TLS=1

Enable TLS connection outbound from the Gateway.

• Default: 1
• Required: No
• Values: 0,1

TLS Compliance Level for downstream (outbound) connections.  This sets TLS version and cipher list accordingly. Customer is still responsible for following other NIST and/or OWASP recommendations, notably making sure certificates are signed and keys are rotated regularly.

• Default: N/A
• Required: No
• Values:
  • LOW
  • MEDIUM
  • HIPAA_2018
  • PCI_321
  • HIGH
• Note: If any level above LOW, you must set:
  • GATEWAY_SMTP_SECURITY_LEVEL= mandatory
  • GATEWAY_SMTP_USE_TLS=1

Outbound TLS Log Level.  This is used for outbound connections made from the Gateway.

• Default: 2
• Required: No
• Values: 0-4

Outbound Transport Security requirements in a comm-delimited list of domains and TLS requirements for those domains.

• Default: N/A
• Required: No
• Values: Text

example1.com=>may

example2.com=>none

example3.com=>encrypt

example4.net=>none

If enabled, these are the domains and their corresponding users, and passwords.

• Default: N/A
• Required: No
• Values: Text
• Note: Applicable only when:
  • GATEWAY_SMTP_SASL_ENABLED_UPSTREAM=0

example.com=>user1=>password1

example.com=>user2=>password2

example.net=>user3=>password3 

Require SASL authentication for inbound clients or mail servers upstream attempting to connect this server.

• Default: 0
• Required: No
• Values: 0,1

Space-delimited list of SASL mechanisms to support for upstream SASL.

• Default: N/A
• Required: No
• Values:
  • PLAIN
  • LOGIN
  • CRAM-MD5
  • DIGEST-MD5
• Note: Only required when GATEWAY_SMTPD_SASL_ENABLED_UPSTREAM=1

DIGEST-MD5 LOGIN

GATEWAY_XHEADER_AUTH_ENABLED

Inbound X-Header Authentication

• Enable inbound X-Header authentication
• Values
  • 1 Enabled
  • 0 Disabled
• Default: 0
• Require: No

GATEWAY_XHEADER_AUTH_ENABLED=1

GATEWAY_XHEADER_AUTH_SECRET

Inbound X-Header Authentication

Enable inbound X-Header authentication Shared Secret

X-Header-Virtru-Auth=secret

Require: No

Example:

X-Header-Virtru-Auth=123456789

Sets the minimum transport security required for inbound connections to the Gateway.

• Default: opportunistic.
• Required: No
• Values: mandatory or opportunistic
• Note: Only used when GATEWAY_SMTPD_USE_TLS=1

TLS Compliance Level for upstream (inbound) connections.  This sets TLS version and cipher list accordingly. Customer is still responsible for following other NIST and/or OWASP recommendations, notably making sure certificates are signed and keys are rotated regularly.

• Default: N/A
• Required: No
• Values:
  • LOW
  • MEDIUM
  • HIPAA_2018
  • PCI_321
  • HIGH
• Note: If any level above LOW, you must set:
  • GATEWAY_SMTPD_SECURITY_LEVEL= mandatory
  • GATEWAY_SMTPD_USE_TLS=1

Inbound TLS Log Level.  This is used for incoming connections made to the Gateway.

• Default: 2
• Required: No
• Values: 0-4

Enable TLS connection inbound to the Gateway.

• Default: 1
• Required: No
• Values: 0,1

Comma-delimited set of domains and next-hop destinations and optional ports

• Default: N/A
• Required: No
• Values: Text

example.com=>mail.example.com

examplemail.com=>mx.examplemail.com:10025

*=>[192.168.1.1]:10026

Enable verbose logging in Gateway.  Set this to 0 unless you are debugging something.

• Default: 0
• Required: No
• Values: 0, 1

Sensitivity level of logs above which messages will be displayed.

• Default: 0
• Values: info,warn,debug 

The maximal time between attempts to deliver a deferred message. Set to a value greater than or equal to MIN_BACKOFF_TIME.  Time units: s (seconds), m (minutes), h (hours), d (days).

• Default: 4000s
• Required: No
• Values: Text
• Recommend: 45s

Consider a message as undeliverable, when delivery fails with a temporary error, and the time in the queue has reached the MAX_QUEUE_LIFETIME limit.  Time units: s (seconds), m (minutes), h (hours), d (days).

Specify 0 when mail delivery should be tried only once.

• Default: 5d
• Required: No
• Values: Time
• Recommend: 5m

1d

15m

300s 

The minimal time between attempts to deliver a deferred message.  Time units: s (seconds), m (minutes), h (hours), d (days).

• Default: 300s
• Required: No
• Values: Text
• Recommend: 30s

The time between deferred queue scans by the queue manager.  Time units: s (seconds), m (minutes), h (hours), d (days).

• Default: 300s
• Required: No
• Values: Text
• Recommend: 30s

 300s

Whether to cache outgoing connections to mailservers. If "1", use on-demand connection caching. If "0", do not cache. If a list of domains (e.g. example.org,hotmail.com,gmail.com) then use per-destination connection caching.

1

"Postfix time unit: n(s,m,h,d), e.g. 5m" How long to cache SMTP connections for. Sets smtp_connection_cache_time_limit to the provied value so that the smtp daemon doesn't close the connection and sets connection_cache_ttl_limit to the same value so that the cached value is still valid

5s

URL to Virtru's Accountsservice. 

• Default: N/A
• Required: Yes
• Values: Text
• Note: Do not change this.

URL to Virtru's ACM service

• Default: N/A
• Required: Yes
• Values: Text
• Note: Do not change this.

GATEWAY_AMPLITUDE_API_KEY

Amplitude Token is used to authenticate the Virtru tenant in Amplitude.  Amplitude is an events platform used to store general performance metrics.

• Default: N/A
• Required: Yes
• Values: Text

HMAC Token is used to authenticate the Virtru Gateway. 

• Default: N/A
• Required: Yes
• Values: Text

HMAC Token is used to authenticate the Virtru Gateway.  

• Default: N/A
• Required: Yes
• Values: Text

The interval of time between refreshing the DLP rules.

• Default: 30
• Minimum: 0
• Required: No
• Values: Number in minutes.  To refresh every request, set to 0.

The mode for the Gateway. 

• Default: encrypt-everything
• Required: Yes
• Values:
  • encrypt-everything
  • decrypt-everything
  • dlp

Domain name of organization

• Default: N/A
• Required: Yes
• Values: Text

The base URL for remote content.

• Default: N/A
• Required: Yes
• Values: Text
• Note: Do not change unless directed by Virtru.  If "Custom Secure Reader URL" is in use the URL should match.

• Default: outbound
• Required: Yes
• Values:
  • outbound
  • inbound

• Enable or disable the "from" address rewriting (inbound topology only) -
• default "enabled"

The base URL for remote content.

• Default: N/A
• Required: Yes
• Values: Text
• Note: Do not change unless directed by Virtru.  If "Custom Secure Reader URL" is in use the URL should match.

• Default: outbound
• Required: Yes
• Values:
  • outbound
  • inbound

• Enable decryption of `persistent protection` files in *decrypt* mode - default will not decrypt
• default "enabled"

• SMTP XHeaders for the Gateway to set on all mail it processes

• Record policy security options upon decrypt
  Only available on outbound decrypt-everything mode
• Required: Yes
   Default: 0

• Use existing policy security options
• Only available on outbound encrypt-everything mode 
• Will use the additional policy security settings
   based on the security settings of the original policy before decryption
• Required: Yes
  Default: ignore

• If you use a multi-gateway approach for sending email. I.e. your workflow looks something like (Decrypt -> Scan -> Encrypt) before sending/receiving email.

• The source of encryption keys. To enable CKS, use the value "CKS"
• Required for inbound modes

• The expiry time, in minutes, of each CKS Session Key

Add a new environment variable `GATEWAY_HEADER_REWRITES` that contains a comma separated
list of rules of the from:

• <field to rewrite>: <if this content is present> => <with this field>
  
  
• So, a rule like `From: secure-reply@virtru.com => Reply-To` would modify the contents
  of the `From` header with the contents of the `ReplyTo` header if the `From` header
  contains the string `secure-reply@virtru.com`.
• It's also possible to omit the content part and specify rules like `From => Reply-To` so
  that the `From` header will always be overwritten with the `Reply-To` header,
  regardless of what the `From` header contains.

• TLS Level Minimum
  • TLS 1.0
• TLS Requirement
  • Opportunistic

• TLS Level Minimum
  • TLS 1.1
• TLS Requirement
  • Mandatory

• TLS Level Minimum
  • TLS 1.0
• TLS Requirement
  • Mandatory
• Ciphers
  • RSA-WITH-3DES-EDE-CBC-SHA
  • RSA-WITH-AES-128-CBC-SHA
  • RSA-WITH-AES-256-CBC-SHA
  • ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA
  • ECDHE-ECDSA-WITH-AES-128-CBC-SHA
  • ECDHE-RSA-WITH-3DES-EDE-CBC-SHA
  • ECDHE-RSA-WITH-AES-128-CBC-SHA
  • RSA-WITH-AES-128-GCM-SHA256
  • RSA-WITH-AES-256-GCM-SHA384
  • ECDHE-ECDSA-WITH-AES-128-CBC-SHA256
  • ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
  • ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
  • ECDHE-RSA-WITH-AES-128-CBC-SHA256
  • ECDHE-RSA-WITH-AES-128-GCM-SHA256

• TLS Level Minimum
  • TLS 1.2
• TLS Requirement
  • Mandatory
• Ciphers
  • DHE-RSA-AES256-GCM-SHA384
  • DHE-RSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES128-GCM-SHA256
  • DHE-RSA-AES256-SHA256
  • DHE-RSA-AES128-SHA256
  • ECDHE-RSA-AES256-SHA384
  • ECDHE-RSA-AES128-SHA256

• TLS Level Minimum
  • TLS 1.2
• TLS Requirement
  • Mandatory
• Ciphers
  • ADH-AES256-GCM-SHA384
  • ADH-AES256-SHA256
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-ECDSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES256-SHA384
  • ECDHE-ECDSA-AES256-SHA384
  • DH-DSS-AES256-GCM-SHA384
  • DHE-DSS-AES256-GCM-SHA384
  • DH-RSA-AES256-GCM-SHA384
  • DHE-RSA-AES256-GCM-SHA384
  • DHE-RSA-AES256-SHA256
  • DHE-DSS-AES256-SHA256
  • DH-RSA-AES256-SHA256
  • DH-DSS-AES256-SHA256
  • ECDH-RSA-AES256-GCM-SHA384
  • ECDH-ECDSA-AES256-GCM-SHA384
  • ECDH-RSA-AES256-SHA384
  • ECDH-ECDSA-AES256-SHA384
  • AES256-GCM-SHA384
  • AES256-SHA256
  • ADH-AES128-GCM-SHA256
  • ADH-AES128-SHA256
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-ECDSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-SHA256
  • ECDHE-ECDSA-AES128-SHA256
  • DH-DSS-AES128-GCM-SHA256
  • DHE-DSS-AES128-GCM-SHA256
  • DH-RSA-AES128-GCM-SHA256
  • DHE-RSA-AES128-GCM-SHA256
  • DHE-RSA-AES128-SHA256
  • DHE-DSS-AES128-SHA256
  • DH-RSA-AES128-SHA256
  • DH-DSS-AES128-SHA256
  • ECDH-RSA-AES128-GCM-SHA256
  • ECDH-ECDSA-AES128-GCM-SHA256
  • ECDH-RSA-AES128-SHA256
  • ECDH-ECDSA-AES128-SHA256
  • AES128-GCM-SHA256
  • AES128-SHA256