topic Re: Anti-Spam & Mail block list not working in Firewall and Security Management

Anti-Spam & Mail block list not working

king_slavcho — Tue, 18 Apr 2023 09:12:10 GMT

Hello friends, I wanted to ask you if someone knows why my Anti Spam and Mail Block List is not working? I insert the mails that have to be blocked but the list is not working.. I save it there and than install the policy to my gateways that are in front of my mail server. Is there anything else i have to do in order for this block list to start blocking mails?

The version is 81.10 and firewall appliances are Check Point Quantum 6400

Re: Anti-Spam & Mail block list not working

Chris_Atkinson — Tue, 18 Apr 2023 09:10:15 GMT

Could you please share some additional information like version / type of appliance / diagram etc.

Are the mail servers using SMTP or SMTP (TLS) ?

Re: Anti-Spam & Mail block list not working

king_slavcho — Tue, 18 Apr 2023 09:15:26 GMT

I wrote the info required above.. The mail server is using SMTP TLS 1.2. Will attach the network diagram if you want also. Thank you

Re: Anti-Spam & Mail block list not working

Chris_Atkinson — Tue, 18 Apr 2023 10:19:36 GMT

Is the Gateway configure as an MTA with the TLS certificates?

Refer: sk98973: Encrypted mail traffic (SMTP TLS) is bypassed

Re: Anti-Spam & Mail block list not working

Wolfgang — Tue, 18 Apr 2023 19:02:37 GMT

There are two ways to do SMTP handling on a gateway. AntiSpam blade and ThreatPrevention blade. More informations are needed of your configuration. Is AntSpam blade used and activated, are the directions and/or hosts from/to to scan set correct?

If only encrypted SMTP traffic traversing the gateway you cant‘t block mail addresses…
As I wrote, more information are really helpfully.

Re: Anti-Spam & Mail block list not working

king_slavcho — Wed, 19 Apr 2023 07:54:25 GMT

The content based and IP reputation spam is set to work on high protection with spam confidence on 90.

The block list has domains and mail but does not work.. I do not know what is the connection between the block list and the content based and ip reputation anti spam filter..

Also checked on the gateways if the blade is working and there it says that its working..

The SMTP and POP3 traffic is set to be scanned by mail direction..