Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Customer Hosted: Environment Variables

  • Updated

The following environment variables are used to configure Virtru Email Gateway Docker image. They can be updated per customer requirements. Variables are split into 2 major categories:

Additional Details

 

SMTP Variables

These variables control how Gateway receives, processes and sends emails. Not every variable in this table is used in order for the Virtru gateway to function. The addition variables can be used for a company specific use case. The primary variables used are highlighted in green in the table, the secondary variables that can be used but are initially commented out are highlighted in yellow, the remainder of the vaiables can be used to fit specific use cases for your organizational needs.

Environment Variable Variable Value Option(s) Example .env Value Explanation of the Variable
GATEWAY_DKIM_DOMAINS

Comma-separated list of domainkey domains to enable and use DKIM.

  • Default: N/A
  • Required: No
  • Values: Text
 gw._domainkey.yourdomain.com DKIM signing domain for email validation and mitigating delivery issues.
GATEWAY_HEADER_ALLOW_RULES

Comma-delimited list of customer header and values to use for whitelisting downstream.

  • Default: N/A
  • Required: No
  • Values: Text
    
GATEWAY_HOSTNAME

Hostname of Gateway must be populated to match the TLS certificate CN (common name).

  • Default: N/A
  • Required: Yes
  • Values: Text
    
GATEWAY_ORGANIZATION_DOMAIN

Domain name of organization

  • Default: N/A
  • Required: Yes
  • Values: Text
    
GATEWAY_PROXY_PROTOCOL

Enable Proxy Protocol for SMTP.  Most situations will require this setting to be a 0.  A 1 is required only when the Load Balancer supports proxy functionality.

  • Default: 1
  • Required: Yes
  • Values: 0,1
    
GATEWAY_RELAY_ADDRESSES

Comma-delimited list of trusted networks in CIDR notation allowed to connect to this Gateway.

  • Default: N/A
  • Required: Yes
  • Values: Text
    
GATEWAY_RELAY_DOMAINS

Comma-delimited set of domains to relay for

  • Default: N/A
  • Required: No
  • Values: Text
    
GATEWAY_SMTP_ALLOW_DOMAINS

Comma-delimited set of domains to whitelist.

  • Default: N/A
  • Required: No
  • Values: Text
  • Note: Applicable only when Gateway is used in the inbound mode.
    
GATEWAY_SMTP_SASL_ACCOUNTS

If enabled, these are the domains and their corresponding users, and passwords.

  • Default: N/A
  • Required: No
  • Values: Text
  • Note: Applicable only when:
    • GATEWAY_SMTP_SASL_ENABLED_DOWNSTREAM=0
    
GATEWAY_SMTPD_SASL_ENABLED_UPSTREAM

Require SASL authentication for inbound clients or mail servers upstream attempting to connect this server.

  • Default: 0
  • Required: No
  • Values: 0,1
    
GATEWAY_SMTPD_SASL_MECHANISMS

Space-delimited list of SASL mechanisms to support for upstream SASL.

  • Default: N/A
  • Required: No
  • Values:
    • PLAIN
    • LOGIN
    • CRAM-MD5
    • DIGEST-MD5
  • Note: Only required when GATEWAY_SMTPD_SASL_ENABLED_UPSTREAM=1
    
GATEWAY_XHEADER_AUTH_ENABLED

Inbound X-Header Authentication

  • Enable inbound X-Header authentication
  • Values
    • 1 Enabled
    • 0 Disabled
  • Default: 0
  • Require: No
    
GATEWAY_XHEADER_AUTH_SECRET

Inbound X-Header Authentication

Enable inbound X-Header authentication Shared Secret

X-Header-Virtru-Auth=secret

Require: No


 

    
GATEWAY_SMTPD_SECURITY_LEVEL

Sets the minimum transport security required for inbound connections to the Gateway.

  • Default: opportunistic.
  • Required: No
  • Values: mandatory or opportunistic
  • Note: Only used when GATEWAY_SMTPD_USE_TLS=1
   
GATEWAY_SMTPD_TLS_COMPLIACE_UPSTREAM

TLS Compliance Level for upstream (inbound) connections.  This sets TLS version and cipher list accordingly. Customer is still responsible for following other NIST and/or OWASP recommendations, notably making sure certificates are signed and keys are rotated regularly.

  • Default: N/A
  • Required: No
  • Values:
    • LOW
    • MEDIUM
    • HIPAA_2018
    • PCI_321
    • HIGH
  • Note: If any level above LOW, you must set:
    • GATEWAY_SMTPD_SECURITY_LEVEL= mandatory
    • GATEWAY_SMTPD_USE_TLS=1
    
GATEWAY_SMTPD_TLS_LOGLEVEL

Inbound TLS Log Level.  This is used for incoming connections made to the Gateway.

  • Default: 2
  • Required: No
  • Values: 0-4
    
GATEWAY_SMTPD_USE_TLS

Enable TLS connection inbound to the Gateway.

  • Default: 1
  • Required: No
  • Values: 0,1
    
GATEWAY_SMTP_SECURITY_LEVEL

Sets the minimum transport security required for outbound connections from the Gateway.

  • Default: opportunistic.
  • Required: No
  • Values: mandatory or opportunistic
  • Note: Only used when GATEWAY_SMTP_USE_TLS=1
   
GATEWAY_SMTP_TLS_COMPLIANCE_DOWNSTREAM

TLS Compliance Level for downstream (outbound) connections.  This sets TLS version and cipher list accordingly. Customer is still responsible for following other NIST and/or OWASP recommendations, notably making sure certificates are signed and keys are rotated regularly.

  •  
    • Default: N/A
    • Required: No
    • Values:
      • LOW
      • MEDIUM
      • HIPAA_2018
      • PCI_321
      • HIGH
    • Note: If any level above LOW, you must set:
      • GATEWAY_SMTP_SECURITY_LEVEL= mandatory
      • GATEWAY_SMTP_USE_TLS=1
    
GATEWAY_SMTP_TLS_LOGLEVEL

Outbound TLS Log Level.  This is used for outbound connections made from the Gateway.

  • Default: 2
  • Required: No
  • Values: 0-4
    
GATEWAY_SMTP_TLS_POLICY_MAPS

Outbound Transport Security requirements in a comm-delimited list of domains and TLS requirements for those domains.

  • Default: N/A
  • Required: No
  • Values: Text
    
GATEWAY_SMTPD_SASL_ACCOUNTS

If enabled, these are the domains and their corresponding users, and passwords.

  • Default: N/A
  • Required: No
  • Values: Text
  • Note: Applicable only when:
    • GATEWAY_SMTP_SASL_ENABLED_UPSTREAM=0
    
GATEWAY_SMTP_SASL_ENABLED_DOWNSTREAM

Require SASL authentication for outbound downstream or relay servers attempting to connect this server.

  • Default: 0
  • Required: No
  • Values: 0,1
    
GATEWAY_SMTP_SASL_SECURITY_OPTIONS

If SASL_ENABLED_DOWNSTREAM enabled, specify Postfix SMTP client SASL security options here.

  • Default: N/A
  • Required: No
  • Values: Text
    
GATEWAY_TRANSPORT_MAPS

Comma-delimited set of domains and next-hop destinations and optional ports

  • Default: N/A
  • Required: No
  • Values: Text
    
GATEWAY_VERBOSE_LOGGING

Enable verbose logging in Gateway.  Set this to 0 unless you are debugging something.

  • Default: 0
  • Required: No
  • Values: 0, 1
    
GATEWAY_LOG_LEVEL

Sensitivity level of logs above which messages will be displayed.

  • Default: 0
  • Values: info,warn,debug 
    
MAX_BACKOFF_TIME

The maximal time between attempts to deliver a deferred message. Set to a value greater than or equal to MIN_BACKOFF_TIME.  Time units: s (seconds), m (minutes), h (hours), d (days).

  • Default: 4000s
  • Required: No
  • Values: Text
  • Recommend: 45s
    
MAX_QUEUE_LIFETIME

Consider a message as undeliverable, when delivery fails with a temporary error, and the time in the queue has reached the MAX_QUEUE_LIFETIME limit.  Time units: s (seconds), m (minutes), h (hours), d (days).

Specify 0 when mail delivery should be tried only once.

  • Default: 5d
  • Required: No
  • Values: Time
  • Recommend: 5m
    
MIN_BACKOFF_TIME

The minimal time between attempts to deliver a deferred message.  Time units: s (seconds), m (minutes), h (hours), d (days).

  • Default: 300s
  • Required: No
  • Values: Text
  • Recommend: 30s
    
QUEUE_RUN_DELAY

The time between deferred queue scans by the queue manager.  Time units: s (seconds), m (minutes), h (hours), d (days).

  • Default: 300s
  • Required: No
  • Values: Text
  • Recommend: 30s
    
GATEWAY_SMTP_CACHE_CONNECTIONS Whether to cache outgoing connections to mailservers. If "1", use on-demand connection caching. If "0", do not cache. If a list of domains (e.g. example.org,hotmail.com,gmail.com) then use per-destination connection caching.    
GATEWAY_SMTP_CONNECTION_CACHE_TIME_LIMIT "Postfix time unit: n(s,m,h,d), e.g. 5m" How long to cache SMTP connections for. Sets smtp_connection_cache_time_limit to the provied value so that the smtp daemon doesn't close the connection and sets connection_cache_ttl_limit to the same value so that the cached value is still valid    

 

Virtru Variables

These variables play a role in performing Virtru encryption or decryption.

Environment Variable Variable Value Option(s) Example .env Value Explanation of the Variable
GATEWAY_ACCOUNTS_URL

URL to Virtru's Accountsservice. 

  • Default: N/A
  • Required: Yes
  • Values: Text
  • Note: Do not change this.
 https://api.virtru.com/accounts  
GATEWAY_ACM_URL

URL to Virtru's ACM service

  • Default: N/A
  • Required: Yes
  • Values: Text
  • Note: Do not change this.
 https://api.virtru.com/acm  

GATEWAY_AMPLITUDE_API_KEY

Amplitude Token is used to authenticate the Virtru tenant in Amplitude.  Amplitude is an events platform used to store general performance metrics.

  • Default: N/A
  • Required: Yes
  • Values: Text
 Contact Virtru Support to obtain your token.  
GATEWAY_API_TOKEN_NAME

HMAC Token is used to authenticate the Virtru Gateway. 

  • Default: N/A
  • Required: Yes
  • Values: Text
 Contact Virtru Support to obtain your token.  
GATEWAY_API_TOKEN_SECRET

HMAC Token is used to authenticate the Virtru Gateway.  

  • Default: N/A
  • Required: Yes
  • Values: Text
 Contact Virtru Support to obtain your token.  
GATEWAY_DLP_CACHE_DURATION

The interval of time between refreshing the Security Rules.

  • Default: 30
  • Minimum: 0
  • Required: No
  • Values: Number in minutes.  To refresh every request, set to 0.
 30  
GATEWAY_MODE

The mode for the Gateway. 

  • Default: encrypt-everything
  • Required: Yes
  • Values:
    • encrypt-everything
    • decrypt-everything
    • dlp

*Please note: DLP mode correlates to Security Rule scanning

 encrypt-everything  
GATEWAY_ORGANIZATION_DOMAIN

Domain name of organization

  • Default: N/A
  • Required: Yes
  • Values: Text
 example.com  
GATEWAY_REMOTE_CONTENT_BASE_URL

The base URL for remote content.

  • Default: N/A
  • Required: Yes
  • Values: Text
  • Note: Do not change unless directed by Virtru.  If "Custom Secure Reader URL" is in use the URL should match.
 https://secure.virtru.com/start/  
GATEWAY_TOPOLOGY

Topology of the gateway.

  • Default: outbound
  • Required: Yes
  • Values:
    • outbound
    • inbound
 outbound  
GATEWAY_DECRYPT_PERSISTENT_PROTECTED_ATTACHMENTS
  • Enable decryption of `persistent protection` files in *decrypt* mode - default will not decrypt
  • default "enabled"
 "1" to decrypt attachments that have persistent protection enabled  
GATEWAY_ROUTING_XHEADERS

 

  • SMTP XHeaders for the Gateway to set on all mail it processes
 `X-Header-1: value1, X-Header-2: value2`  
GATEWAY_DECRYPT_THEN_ENCRYPT
  • If you use a multi-gateway approach for sending email. I.e. your workflow looks something like (Decrypt -> Scan -> Encrypt) before sending/receiving email.
 "0" for default, and "1" to activate.  
GATEWAY_ENCRYPTION_KEY_PROVIDER
  • The source of encryption keys. To enable CKS, use the value "CKS"
  • Required for inbound modes
 "CKS"  
GATEWAY_CKS_SESSION_KEY_EXPIRY_IN_MINS
 
  • The expiry time, in minutes, of each CKS Session Key
 "360"  
GATEWAY_HEADER_REWRITES

Add a new environment variable `GATEWAY_HEADER_REWRITES` that contains a comma separated
list of rules of the from:

 

  • <field to rewrite>: <if this content is present> => <with this field>
     
  • So, a rule like `From: secure-reply@virtru.com => Reply-To` would modify the contents
    of the `From` header with the contents of the `ReplyTo` header if the `From` header
    contains the string `secure-reply@virtru.com`.
  • It's also possible to omit the content part and specify rules like `From => Reply-To` so
    that the `From` header will always be overwritten with the `Reply-To` header,
    regardless of what the `From` header contains.
 GATEWAY_HEADER_REWRITES=From: secure-reply@virtru.com => Reply-To  
GATEWAY_HTTP_PROXY_HOST

HTTP proxy hostname or IP address for Gateway container traffic to reach Virtru endpoints.

 proxy.example.com Allows Gateway to route HTTP traffic through a proxy server. Persists through container upgrades.
GATEWAY_HTTP_PROXY_PORT

HTTP proxy port.

  • Default: 80
  • Required: No
  • Values: Number
  • Note: Only used when GATEWAY_HTTP_PROXY_HOST is set. Available in Gateway v2.72.0+.
 80 HTTP proxy port. Defaults to 80 if not specified.
GATEWAY_HTTPS_PROXY_HOST

HTTPS proxy hostname or IP address for Gateway container traffic to reach Virtru endpoints.

 proxy.example.com Allows Gateway to route HTTPS traffic through a proxy server. Persists through container upgrades.
GATEWAY_HTTPS_PROXY_PORT

HTTPS proxy port.

  • Default: 443
  • Required: No
  • Values: Number
  • Note: Only used when GATEWAY_HTTPS_PROXY_HOST is set. Available in Gateway v2.72.0+.
 443 HTTPS proxy port. Defaults to 443 if not specified.

 

 

TLS Compliance Levels

Option Description
LOW
  • TLS Level Minimum
    • TLS 1.0
  • TLS Requirement
    • Opportunistic
MEDIUM
  • TLS Level Minimum
    • TLS 1.1
  • TLS Requirement
    • Mandatory
HIPAA_2018
  • TLS Level Minimum
    • TLS 1.0
  • TLS Requirement
    • Mandatory
  • Ciphers
    • RSA-WITH-3DES-EDE-CBC-SHA
    • RSA-WITH-AES-128-CBC-SHA
    • RSA-WITH-AES-256-CBC-SHA
    • ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA
    • ECDHE-ECDSA-WITH-AES-128-CBC-SHA
    • ECDHE-RSA-WITH-3DES-EDE-CBC-SHA
    • ECDHE-RSA-WITH-AES-128-CBC-SHA
    • RSA-WITH-AES-128-GCM-SHA256
    • RSA-WITH-AES-256-GCM-SHA384
    • ECDHE-ECDSA-WITH-AES-128-CBC-SHA256
    • ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
    • ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
    • ECDHE-RSA-WITH-AES-128-CBC-SHA256
    • ECDHE-RSA-WITH-AES-128-GCM-SHA256
PCI_321
  • TLS Level Minimum
    • TLS 1.2
  • TLS Requirement
    • Mandatory
  • Ciphers
    • DHE-RSA-AES256-GCM-SHA384
    • DHE-RSA-AES128-GCM-SHA256
    • ECDHE-RSA-AES256-GCM-SHA384
    • ECDHE-RSA-AES128-GCM-SHA256
    • DHE-RSA-AES256-SHA256
    • DHE-RSA-AES128-SHA256
    • ECDHE-RSA-AES256-SHA384
    • ECDHE-RSA-AES128-SHA256
HIGH
  • TLS Level Minimum
    • TLS 1.2
  • TLS Requirement
    • Mandatory
  • Ciphers
    • ADH-AES256-GCM-SHA384
    • ADH-AES256-SHA256
    • ECDHE-RSA-AES256-GCM-SHA384
    • ECDHE-ECDSA-AES256-GCM-SHA384
    • ECDHE-RSA-AES256-SHA384
    • ECDHE-ECDSA-AES256-SHA384
    • DH-DSS-AES256-GCM-SHA384
    • DHE-DSS-AES256-GCM-SHA384
    • DH-RSA-AES256-GCM-SHA384
    • DHE-RSA-AES256-GCM-SHA384
    • DHE-RSA-AES256-SHA256
    • DHE-DSS-AES256-SHA256
    • DH-RSA-AES256-SHA256
    • DH-DSS-AES256-SHA256
    • ECDH-RSA-AES256-GCM-SHA384
    • ECDH-ECDSA-AES256-GCM-SHA384
    • ECDH-RSA-AES256-SHA384
    • ECDH-ECDSA-AES256-SHA384
    • AES256-GCM-SHA384
    • AES256-SHA256
    • ADH-AES128-GCM-SHA256
    • ADH-AES128-SHA256
    • ECDHE-RSA-AES128-GCM-SHA256
    • ECDHE-ECDSA-AES128-GCM-SHA256
    • ECDHE-RSA-AES128-SHA256
    • ECDHE-ECDSA-AES128-SHA256
    • DH-DSS-AES128-GCM-SHA256
    • DHE-DSS-AES128-GCM-SHA256
    • DH-RSA-AES128-GCM-SHA256
    • DHE-RSA-AES128-GCM-SHA256
    • DHE-RSA-AES128-SHA256
    • DHE-DSS-AES128-SHA256
    • DH-RSA-AES128-SHA256
    • DH-DSS-AES128-SHA256
    • ECDH-RSA-AES128-GCM-SHA256
    • ECDH-ECDSA-AES128-GCM-SHA256
    • ECDH-RSA-AES128-SHA256
    • ECDH-ECDSA-AES128-SHA256
    • AES128-GCM-SHA256
    • AES128-SHA256

 

GATEWAY_RELAY_ADDRESSES default values for Gmail and Office 365:

Mail Provider CIDR Blocks
Gmail

35.190.247.0/24,64.233.160.0/19,66.102.0.0/20,66.249.80.0/20,72.14.192.0/18,74.125.0.0/16,108.177.8.0/21,

173.194.0.0/16,209.85.128.0/17,216.58.192.0/19,216.239.32.0/19,172.217.0.0/19,172.217.32.0/20,172.217.128.0/19,

172.217.160.0/20,172.217.192.0/19,108.177.96.0/19,35.191.0.0/16,130.211.0.0/22,172.253.56.0/21,172.253.112.0/20

Office 365

23.103.132.0/22,23.103.136.0/21,23.103.144.0/20,23.103.198.0/23,23.103.200.0/22,23.103.212.0/22,40.92.0.0/14,

40.107.0.0/17,40.107.128.0/18,52.100.0.0/14,65.55.88.0/24,65.55.169.0/24,94.245.120.64/26,104.47.0.0/17,104.212.58.0/23,

134.170.132.0/24,134.170.140.0/24,157.55.234.0/24,157.56.110.0/23,157.56.112.0/24,207.46.51.64/26,207.46.100.0/24,

207.46.163.0/24,213.199.154.0/24,213.199.180.128/26,216.32.180.0/23

Related articles