GFI MAX MailProtection™ - How it works

Infrastructure

At GFI Software, we have invested significantly in developing a reliable, stable, and scalable hosted mail protection service that is hands-free and trouble-free for our customers. The GFI MAX MailProtection software architecture is designed for high availability and our network spans multiple, geographically distributed datacenters as the foundation for our services. Significant attention is paid to the many components affecting the reliability and scalability of GFI MAX MailProtection including its network, systems and software architecture.

Network architecture

GFI MAX MailProtection’s distributed network architecture uses multiple datacenters. For maximum reliability, the datacenters have diversified management, regional power sources, and network peering arrangements.  Each location features a Cisco-based, fault-tolerant network with redundant Gigabit Ethernet connectivity to multiple Tier 1 backbone providers.

Hosting environment

Each carrier-grade datacenter chosen by GFI meets stringent requirements including multiple power feeds from redundant power sources, continuously online UPS systems, redundant climate control, 24x7 manned guard stations, and institutional banking quality access procedures. All have emergency diesel generators with ample fuel on-site as well as negotiated arrangements for priority refuelling in the event of an extended utility power outage.

Redundant parallel systems

The GFI MAX MailProtection architecture is modular and comprised of load balancers, front-end message processing servers, back-end filtering systems, supervisor modules and database servers. All of these systems - from the front-end load balancers to the back-end database servers - are redundant and running in parallel.  Additionally, the application is designed for geographic diversity, with distributed logging and processing across multiple datacenters.

Proven software

Engineered to scale with the rapid growth of junk mail, the software used for GFI MAX MailProtection is purpose-built and highly optimized. The third-generation software design uses modular scanning techniques for maximum flexibility and includes an adaptive system to detect emerging junk mail.  The software is designed to avoid unnecessary use of disk at all opportunities, and through a variety of innovative techniques, can provide faster message processing, greater scalability and flexibility than traditional approaches to spam detection. The software has been proven through the processing of billions of messages for customers.

Monitoring

Each network component and each system within the GFI MAX MailProtection service is continuously tested at the network-level and/or service-level by redundant monitoring systems. Furthermore, 24x7 full-path message monitoring tests real-world system performance across the application.

Management

GFI MAX MailProtection’s management capabilities allow for fine-grained control over the handling of email threats, while requiring minimal or no time commitments from technical staff or email users.

Administrators can use the service's easy-to-navigate web-based interface to manage a broad range of options related to the service, including parameters for inbound and outbound filtering, user management, message search, delivery logs, and statistical reporting. Administrators can apply configuration settings to a single user, a group of users, an entire domain, or multiple domains across an organization. While there is substantial flexibility in the configuration of the system for administrators who choose to take an active role in maintaining the service, the service is designed to work with little or no such management.

The same philosophy is true for end-users. At the discretion of system administrators, email users may access various functions of the management interface, such as their searchable junk mail quarantines, or their message queues in the event that their primary mail server is offline. That said, GFI MAX MailProtection is designed to minimize the need for changes to end user behavior. Users are not required to log into the interface, and instead can simply use features such as GFI MAX MailProtection’s one-click whitelisting, summary digests, and selective tagging in order to manage their junk mail from their desktop.

Seamless integration

Ongoing management requirements are further simplified by GFI MAX MailProtection’s seamless integration with a wide variety of email systems such as Microsoft Exchange, Lotus Notes, Novell GroupWise and many others. With secure and automated account synchronization via LDAP/LDAPS or other methods, GFI MAX MailProtection relieves system administrators from having to maintain user data in multiple locations. And with a modular web services-based API, organizations can manage their email security from virtually any application.

Message handling

GFI MAX MailProtection offers several options for handling of detected junk which can be established globally across one or more domains, or for one or more individual users, and which can be changed at any time. Customers can choose to:

• Drop detected spam – an aggressive approach that reduces a customer’s network bandwidth requirements and mail server load. Due to GFI MAX MailProtection’s extremely low percentage of false positives (legitimate email wrongly classified as spam), it is very rare that a legitimate email message will be dropped.
• Tag and forward detected spam – with a modified subject line, incoming email can be automatically directed to a specific folder in each user’s email program for periodic review and/or deletion.
• Redirect detected spam - junk mail can be directed to an alternative address, e.g., spam@example.com
• Quarantine - junk messages are redirected to individual web-mail quarantine accounts that can be reviewed at any time by end users. The most common choice of larger businesses and ISPs, this approach reduces bandwidth requirements and mail server load for customers while providing complete assurance that no legitimate message will ever be lost.

Message digests

Customers can opt to receive periodic message digests, which provide each user a summary list of the junk email received for them.  Digests can be sent as infrequently as once per week, or as frequently as several times per day, at times defined by the customer.  Each digest includes a means to immediately release each message from the quarantine in case it is or may be legitimate, providing reassurance that no valid mail is being detected as spam.

Messaging analysis

GFI MAX MailProtection uses a combination of techniques for spam and message analysis. While generally no single element will by itself classify a message as spam, the use of multiple methods in conjunction with each other reduces the number of false positives compared to other approaches to spam detection.

GFI MAX MailProtection continually refines its message analysis techniques, with a focus on adaptive technologies to detect evolving spam patterns.  GFI MAX MailProtection incorporates techniques such as:

• Authenticity checks including detailed header analysis, SMTP conversation details, message encoding and formatting, etc.,
• Message fingerprinting to compare email signatures to frequently-updated public and internal databases of known spam messages.
• An extensive, continually updated Heuristic Rule Set that encompasses message headers, body text, and other characteristics of both English and non-English language messages.
• Public and private blacklists of mail servers, relays, or networks known to be used by spammers.
• Extensive URI databases of unique elements such as URLs, phone numbers, and physical addresses known to be used by spammers.
• Incorporation of Domain history and reputation to increase the accuracy of blacklists and URI databases.
• Real-time message source analysis to assess whether an increased volume of mail flow is simply a legitimate high-volume mailing, or the result of a spammer hijacking or the use of a ‘zombie’ network.
• Dynamic feedback-based rules optimization to leverage feedback from thousands of GFI MAX MailProtection service users, as well as from many monitored legitimate and ‘spam trap’ email addresses.
• User-based message profiling that allows for refinement of message scoring for each user based on a history of his or her message traffic.
• Customizable whitelists and blacklists which can be applied on an account-wide, organization-wide, domain-wide, or user-specific basis.

Working together, these elements accurately detect a very high percentage of spam, phishing emails, and other unwanted messages – while minimizing the chances of a legitimate message being detected as spam.

True continuity

GFI MAX MailProtection provides organizations with peace of mind regarding their email via an integrated continuity service.

In the event that the customer's mail server is temporarily down or inaccessible, GFI MAX MailProtection acts as a message queue. No messages are lost, and people who send email to that organization don’t receive error messages; GFI MAX MailProtection simply stores those messages and delivers them once the customer’s mail server is back online. It uses a timing algorithm to deliver queued messages to ensure that the customer’s mail server is not overwhelmed with a sudden barrage of queued messages once the server is back up and running.

More importantly, customers can access and respond to any queued messages via the GFI MAX MailProtection control panel - allowing customers to continue their business-critical email communications even when their own mail infrastructure is off-line. This on-demand, full-fledged backup mail service is available at any time, without the need for customers to invest in hardware or software or to make any advance preparations other than normal use of the service.

With these features, GFI Software provides companies with true email continuity under circumstances ranging from a brief, planned mail server upgrade, to a major network outage caused by a natural disaster.

Want to learn more?

If you are interested in GFI MAX MailProtection and how we can help you protect your messaging infrastructure, view this video.

Read this quick start guide – Partner edition
Read this quick start guide – Business user edition