Net-based email filtering
A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and/or not phishing and/or not containing a virus, the junk store can forward the email to a local mail server for delivery.
1. An email filtering system comprising:
a unified threat management gateway that:
receives an email from a mail transfer agent across a first internet-based communication connection, and
checks a reputation of an internet protocol address of the mail transfer agent;
an email security appliance that:
receives the email from the unified threat management gateway across a second internet-based communication connection,
processes the email to determine a filtered status of the email, and
sends the email with the filtered status to the unified threat management gateway across a third internet-based communication connection; and wherein the unified threat management gateway further:
sends the email with the filtered status to a junk store across a local communication connection, and
sends email filter processing rules to the email security appliance, wherein the unified threat management gateway sends email filter processing rules using a custom simple mail transfer protocol HELO command using a transmission control protocol port, and wherein the HELO command comprises ASCII encoded text using name-value pairs to convey information.
2. The email filtering system of claim 1 , wherein:
the first internet-based communication connection is established between the unified threat management gateway and the mail transfer agent;
the second internet-based communication connection is established between the unified threat management gateway and the mail transfer agent;
the third internet-based communication connection is established between the unified threat management gateway and the email security appliance; and
the local communication connection is established between the unified threat management gateway and the junk store.
3. The email filtering system of claim 1 , wherein the junk store quarantines the email with the filtered status when the filtered status indicates that the email is spam.
4. The email filtering system of claim 1 , wherein the junk store quarantines the email with the filtered status at the junk store when the filtered status indicates that the email is phishing.
5. The email filtering system of claim 1 , wherein the junk store quarantines the email with the filtered status at the junk store when the filtered status indicates that the email contains a virus.
6. The email filtering system of claim 1 , wherein the unified threat management gateway checks the internet protocol address of the mail transfer agent against an allow list and a block list on the unified threat management gateway.
7. The email filtering system of claim 1 , wherein the unified threat management gateway checks the internet protocol address of the mail transfer agent by communicating with an internet protocol address reputation service.
8. The email filtering system of claim 1 , wherein the first internet-based communication connection is a simple mail transfer protocol connection using port 25 of the unified threat management gateway.
9. The email filtering system of claim 1 , wherein the second internet-based communication connection is a simple mail transfer protocol connection using port 25 of the email security appliance.
10. The email filtering system of claim 1 , wherein the third internet-based communication connection is a simple mail transfer protocol connection using port 10025 of the unified threat management gateway.
11. The email filtering system of claim 1 , wherein the unified threat management gateway scans the email received from the mail transfer agent for viruses before sending the email to the email security appliance.
12. The email filtering system of claim 1 , wherein the junk store sends the email with the filtered status to a local mail server when the filtered status indicates that the email is non-phishing.
13. The email filtering system of claim 1 , wherein the junk store sends the email with the filtered status to a local mail server when the filtered status indicates that the email is non-spam.
14. The email filtering system of claim 1 , wherein the junk store sends the email with the filtered status to a local mail server when the filtered status indicates that the email does not contain a virus.
15. A non-transitory computer-readable storage medium, having embodied thereon instructions executable to perform a method of filtering email, the method comprising:
receiving an email at a unified threat management gateway from a mail transfer agent across a first internet-based communication connection;
checking a reputation of an internet protocol address of the mail transfer agent;
sending the email from the unified threat management gateway to an email security appliance across a second internet-based communication connection;
processing the email at the email security appliance to determine a filtered status of the email;
receiving the email with the filtered status at the unified threat management gateway from the security appliance across a third internet-based communication connection;
sending the email with the filtered status from the unified threat management gateway to a junk store across a local communication connection; and
sending email filter processing rules from the unified threat management gateway to the email security appliance, wherein the unified threat management gateway sends email filter processing rules using a custom simple mail transfer protocol HELO command using a transmission control protocol port, wherein the HELO command comprises ASCII encoded text using name-value pairs to convey information.