The VBSpam certification denotes that GFI MailEssentials is capable of the following:

• blocking a large percentage of emails in a live spam stream
• correctly identifying all but a very small percentage of emails in a live stream of legitimate emails.

I found out that the build version of GFI MailEssentials is up-to-date, my license key is entitled to download update files for SpamRazer and both update procedures (auto and manual update) fails.

At this stage I can only say that the SpamRazer module fails permanently to download the updates files. Now I need to verify whether the update failure also affects the Anti-Phishing and the Bayesian filter module of GFI MailEssentials.

I will open the property option of the “Phishing” module and then I will retrieve the following information from the “Phishing” tab:

a) Is the Phishing module “enabled”?
b) Is the licensing status of the Phishing module “licensed”?

In my case the Phishing anti-spam module is a) active and the license key is b) entitled to download the latest update files. (3)

In the next step go to the tab “Updates”. (4) Click on “Download updates now…” and after five minutes check whether the download process still fails. GFI MailEssentials will confirm that the download process has started successfully.

The result of the last download attempt will be shown in form of a message box. The message box confirms that the download of the update files for Anti-Phishing has been successful.

So at this stage my conclusion is:

The SpamRazer update fails permanently; however the Phishing updates seem to be working fine. This is quite interesting!

Now, do the same procedure for the Bayesian filter. The required steps are similar. As you can see from the next screenshot the Bayesian filter is also able to check for the latest update files.

So in other words:

The SpamRazer update fails permanently; however the Phishing and the Bayesian filter updates seem to be working fine. This means that only one anti-spam module is failing to download the updates.

SpamRazer downloads the update files from a different update server. Therefore, I need to check if my Proxy Server or Firewall may have blocked the outbound HTTP connection to the SpamRazer update server.

The URL of the SpamRazer update server is: sn92.mailshell.net and not “update.gfi.com”.

I checked the settings in my Microsoft ISA Server and I found out that it was blocking the outbound HTTP connection to sn92.mailshell.net. This was the main reason for the update failure issue for the SpamRazer anti-spam module.

URL was blocked by Firewall or Proxy Server

Furthermore, I could see that the update requests by the Bayesian Filter and Anti-Phishing module to “update.gfi.com” are not blocked by my ISA Server. This would explain why both anti-spam modules succeeded to download the update files.

After granting access to the URL “sn92.mailshell.net” from the GFI MailEssentials machine the update failure issue was fixed.

Any questions? Feel free to comment below.

In the next pre-check I need to ensure that my GFI MailEssentials installation is on the latest build. This is a prevention to ensure that it is not a bug that may have caused the update failure.

Bug in the old GFI MailEssentials build

How do I check the current build of my GFI MailEssentials installation?

The current version of the GFI MailEssentials installation can be retrieved from the configuration menu as follow:

Click on GFI MailEssentials >> General >> Version Information (1) >> “Properties”

The version information of GFI MailEssentials is: v2010 build 2010050. (2) Click on “Check for latest version”. (3) GFI MailEssentials will then verify the build and it will prompt the result of the build check in the message box. The message box prompts the following message:

The build of the GFI MailEssentials installation is up-to-date. So, I will do further pre-checks as I do not yet know the main reason for the update failure. One of the questions I’m asking myself is whether only one specific or all three anti-spam modules fail to download the update files?

I need to verify whether all three anti-spam modules (SpamRazer/Phishing/Bayesian Analysis) are up-to-date or not. I open the property option of the “SpamRazer” module and retrieve the following information from the “SpamRazer” tab:

1. Is the SpamRazer module “enabled”?
2. Is the licensing status of the SpamRazer module “licensed?

License key is not entitled to download the update files

In my case the SpamRazer anti-spam module is a) active and the license key is b) entitled to download the latest update files. (3)

In the next step I go to the “Updates” tab. Here I can see, if and when the last auto update attempt was performed by the SpamRazer anti-spam module and which version of the update files is currently installed on the machine. (4)

The last attempt to download the SpamRazer update files failed. Furthermore the current version of the SpamRazer module is not up-to-date. (4)

Click on “Download updates now…” and ten minutes later check whether the download process still fails. GFI MailEssentials will confirm that the download process has started successfully.

Ten minutes later the last attempt result is still showing the information “Download failed.” This means that the manual update has not succeeded.

Un-Authenticated connections from the GFI MailEssentials machines to our update server are blocked by a Proxy Server

If the manual update had worked and the last attempt result had shown “Successful”, then it would mean that the auto-update fails; however, the manual update works fine. In such a case un-authenticated connections appears not to be allowed from the GFI MailEssentials machine to the update server via port 80. I would then follow the steps described in this knowledge base article.

At this stage I am still on the chase to find the main reason for the update failure issue. In my next post I will introduce some more techniques to narrow the reason of my problem.

Do you have any further questions? Just post your comments!

There can be various reasons why one or more GFI MailEssentials Anti-Spam modules may fail to download the latest updates files or to update the local engines of GFI MailEssentials.

Generally a notification email for each update failure will be sent to the administrator looking like this: “GFI MailEssentials notification: Antiphishing Database Update Failed.”

How would you judge and handle such notifications?

First we need to find out whether this is a permanent or sporadical event. If it is an event that occurs sporadically, then you may ignore this notification email.

Bad network connection

A good reason for a sporadical event is, in most cases, a bad network connection with our update server that may have caused a timeout event on the client machine.

However, if the event occurs with every download attempt, then it is recommended to investigate further. A permanent content update failure can be a serious threat for GFI MailEssentials.

GFI MailEssentials would not only be outdated, but it might also not be able to block the latest spam trends successfully. Therefore, it is very important that GFI MailEssentials is kept up-to-date including all its anti-spam engines like SpamRazer, Anti-Phishing, etc.

In this case GFI MailEssentials has failed permanently, so I have decided to do some pre-checks to ensure that this issue has not been caused by a simple reason.

License Key expired

In some cases an expired license key may be the key reason why GFI MailEssentials is not allowed to download the latest updates files from our update server.

For this pre-check I will log on to the GFI MailEssentials machine. Then I will open the GFI MailEssentials configuration from the Start menu >> All Programs >> GFI MailEssentials >> GFI MailEssentials Configuration (1).

In the GFI MailEssentials configuration I will navigate to the node GFI MailEssentials >> General >> Licensing >> Properties (2). A dialog box will pop up and will display the current information about the license status (3).

If the license key has been expired or the licensed user has been exceeded, then GFI MailEssentials will not be able to work properly or it will not be able to download the update files from our update server.

If the license status key has been expired, then I need to ensure that I am using the latest license key for GFI MailEssentials. If necessary, I will need to buy a renewal license key to ensure that the license key allows me to download the latest updates files from our update server.

In my case the license key was correct and valid. Furthermore, the license key allows me to download the latest update files.

Licensed Users exceeded

The license status shows me some useful information. It counts 25 users and my license key allows me to use up to 25 users. So, the licensed users have not been exceeded. If it exceeds the amount of licensed users, then I would need to verify whether the license key needs to be upgraded for further X amount of users.

The following knowledge base article explains how the users are counted by GFI MailEssentials and how unnecessary licensed users can be removed from the user list.

In the next step I will need to check whether only one specific or all Anti-Spam modules fail to download the update files. GFI MailEssentials has three modules which periodically download update files from our update server:

• SpamRazer
• Phishing
• Bayesian

In the next post I’ll talk about some further tricks to troubleshoot common issues like that. If you have any queries in the meantime, feel free to comment.

Spam emails are sent using what is known as the fire and forget method, which means that emails are sent without checking for any errors returned by the receiving server. This is the most cost effective and cheapest way of sending large spam runs. Legitimate mail servers are genuinely interested in the delivery of emails, so they do their best to abide to the SMTP RFC standard, and will periodically try to resend emails that have failed with a temporary failure.

So, let’s delve into the details of how Greylisting works. A mail server is trying to send an email message to another mail server for the first time. Such a message is temporarily rejected with error code “451 4.7.1 – Please try again later…” At the same time a triplet is recorded in the Greylisting database as an unconfirmed triplet.

A triplet consists of:

• IP address of the sending server,
• Sender address, and
• Recipient address.

A spammer will normally give up on the first error encountered. The spammer’s target is to send as many emails as possible in the least amount of time. Thus when an error is encountered while transmitting the email, the spammer will just move on to sending the next message.

On the other hand, a legitimate mail server would try to send the message again after a few minutes when such an error is encountered. The SMTP RFC recommends 30 minutes; however, it does provide the liberty of “variable strategies” to the sending mail server.

On receiving the email with the same triplet for the second time, the receiving mail server confirms the triplet recorded previously and allows the message through. New messages with the same triplet are not rejected in the future.

A benefit of Greylisting is that emails are processed at SMTP level before the sending mail server starts transmitting the email, thus limiting the amount of bandwidth used for rejected messages.

One drawback of Greylisting is that some emails are delayed. The fact that triplet information is stored so that emails with the same triplet are allowed through once confirmed, mitigates the delays for a good portion of legitimate emails. Emails from the same triplet are only delayed the first time the triplet is processed.

Having said that, Greylisting is a very efficient way of detecting spam originating from mail servers which are not RFC compliant – most spammers use such mail servers. Greylisting is also very easy to configure, and any maintenance required can be fully automated by the application implementing the technology. (Click on image to see full animation).

GFI MailEssentials 2010 introduces Greylisting as another method to reject spam.

In the works right now are a number of launches. This quarter started with the launch of our revamped GFI Partner Program on April 12 followed by the much-awaited release of GFI Backup 2010 – Business Edition three days later, our new fast and fuss-free backup, restore and synchronization solution for small and medium-size businesses. Both were launched internationally in English, with translation works currently in the mix to roll them out in various languages as soon as possible.

Meanwhile our energies are highly focused on the 10-language launch of GFI MAX MailProtection and GFI MAX MailEdge which kicks off on April 26 and comprises a mix of partner seminars across various EMEA locations, webinars, live press events and more throughout the quarter! Our spreadsheets to coordinate the mailers, web pages, documentation, sales and marketing collateral, travel, accommodation and event plans, and so on are a riot of multi-coloured rows. These are pored over and heartily discussed by marketing team members in Dundee, Staines, Boston and San Gwann (Malta), not to mention various GFI Channel Sales Managers located around Europe.  Coupled with this is our launch of the Spanish and Italian versions of GFI MAX RemoteMangement.

Coming up in May are GFI MailEssentials 2010 and GFI EventsManager 2010 – new versions of our on-premise anti-spam and event log management solutions. GFI MailEssentials will now also offer greylisting, spam quarantine and auto-log rotation while delivering enhanced performance; and GFI EventsManager will now support events auto-archiving in parallel with events processing (so that archived events are stored into files while the database hosts important events only); an improved dashboard with real-time details about what is happening on the network – e.g., failed logons, logons outside normal working hours, Windows service status and critical events – and various new reports, as well as improved usability and performance.

We are also gearing up to ship a couple of point releases before this quarter ends  – in the form of GFI LANguard 9.5 and GFI EndPointSecurity 4.3 – as well as a major new feature for GFI MAX RemoteManagement.

Two people have the chance of winning either the first prize which is a 50 user license pack or the runner up prize – a 25 user license pack.

For details on how to enter the competition check out Paul’s blog post. The deadline for the contest is 31 January 2010, Australian EST.

The new Exchange Server has been designed to help users achieve new levels of reliability and performance by delivering features that simplify administration, protect communications, and meet user demands for greater business mobility.

“The latest version of Microsoft Exchange aims to give users a more holistic, stable and efficient server offering. I am pleased to announce that GFI’s Exchange Server-based products now support the new version giving Exchange users the ability to improve upon and do more with the new features that are included. As a Microsoft Gold Partner, GFI has always endeavored to make sure that our portfolio of products provides support for Microsoft’s latest operating systems and other Microsoft products, thereby ensuring that our customers can avail themselves of new Microsoft platforms and yet continue to use our products without interruption,” GFI’s CEO Walter Scott said.

“Our engineering teams are continuously looking at integrating or supporting new developments in Microsoft’s products in order to give our customer install the best choice at all times and on the platforms they require,” Mr. Scott added.

For more information on these products please visit http://www.gfi.com/pages/prodinfo.htm.

These new platforms have been designed to improve upon performance, applicability, device compatibility, reliability, security and battery life as well as important enhancements to manageability and security.

“There is a great deal of pent-up demand for Windows 7 in the SMB market and believe this will be the fastest upgrade cycle of any Windows products since Windows 3.1; this is why we have supported Windows 7 even through the beta and release candidates, and are pleased to announce that we offer full support on all of our client based products. As a Microsoft Gold Partner, GFI has always endeavored to make sure that our portfolio of products provides support for Microsoft’s latest operating systems and other Microsoft products, thereby ensuring that our customers can avail themselves of new Microsoft platforms and yet continue to use our products without interruption,” GFI’s CEO Walter Scott said.

“I am pleased to announce that 9 of our products now support, are compatible with or have achieved Frontrunner status on these new platforms. Our engineering teams have been working on this important development in order to give our customer install the best choice at all times and on the platforms they require,” Mr. Scott added.

The following products are compatible with Windows 7: GFI LANguard; GFI EndPointSecurity, GFI EventsManager, GFI Backup - Home Edition and GFI MAX.

The following products support or are compatible with Windows Server 2008 R2: GFI LANguard, GFI EventsManager, GFI FAXmaker, GFI MailEssentials, GFI MailSecurity, GFI WebMonitor, GFI Backup – Home Edition, GFI EndPointSecurity and GFI MAX. GFI MailArchiver will support Windows Server 2008 R2 later this year.

Frontrunner status has been given to GFI MailEssentials, GFI MailSecurity and GFI LANguard.

All product and company names herein may be trademarks of their respective owners.

GFI rated exceptionally well in the Network Security category and very high in terms of ease of upgrade and VARs’ ability to service the product.

The winning products are: GFI MailEssentials, GFI MailArchiver, GFI EndPointSecurity, GFI WebMonitor and GFI MAX , the latest offering from GFI specifically for VARs, MSPs and IT support companies.

Over 2,000 VAR subscribers to Business Solutions Magazines were asked to rate vendors’ products according to the richness of features; product reliability/durability; ease of integration, ease of upgrade and VARs’ ability to service the product. The results show that the Channel ranks GFI’s products as exceptional and a favorite among resellers in the US.

“GFI certainly earned its spot on the Business Solutions Magazine Best Channel Products list,” said Sue Bresee, publisher of Business Solutions magazine. “GFI rated exceptionally well overall in the Network Security Suite category, but particularly high in Ease of Upgrade and VAR’s Ability to Service. Our survey results clearly show that GFI has many satisfied resellers.”

Commenting on the results, CEO Walter Scott said:

“This is a fantastic result for GFI and clearly shows that our products are among the best out there for small and medium-sized business. I am particularly pleased that we have rated high in terms of their ease-of-use and the Channel’s ability to service our products. Our efforts to make life easier for our customers, while providing them with exceptional quality products at a very competitive price, are paying off.”

“That GFI MAX, formerly HoundDog, has also been acknowledged as a leading product by the Channel shows that we have made a wise move and this encourages us to continue pushing hard to give the Channel the solutions that they and their customers need. Hats off to all those who have contributed to this success and sincere thanks to the Channel for its support, confidence in GFI and encouragement,” he added.

Clearly this shows that GFI products are first-class as proven by a first-class clientele.