LevelBlue Knowledge Base » Knowledgebase » MailMarshal (SEG) SPE

Enabling Strong TLS for .NET

Charles — Thu, 16 Apr 2026 22:53:51 GMT

This article applies to:

MailMarshal SPE 4.X - Systems with TLS 1.0 disabled
Marshal Reporting Console - email TLS

Question:

How do I enable use of TLS 1.1 and 1.2 by .NET components in SPE 4.X?
How do I fix TLS related errors connecting from SPE to the SEG Array Manager?
How do I update the TLS version used for email connectivity in MRC?

Procedure:

To allow use of "Strong" TLS (1.1 and 1.2) by .NET, you must enable system settings and .NET specific settings on affected systems.

For SPE this is the Marshal Interface Agent server.
For MRC this is the server where the software is installed.

This article covers .NET specific settings.

Update the following Registry entries (see also the attached Powershell script):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001

Notes:

SPE 5.X and above uses newer versions of .NET and does not require these settings.
The SchUseStrongCrypto setting allows .NET to use TLS 1.1 and TLS 1.2.
The SystemDefaultTlsVersions setting allows .NET to use the OS configuration.
For further information see Microsoft documentation.
These settings apply immediately. System or service restart is not required.

What versions of MailMarshal SPE are currently supported by LevelBlue Technical Support?

Charles — Sun, 15 Mar 2026 18:54:48 GMT

This article applies to:

MailMarshal SEG Service Provider Edition (SPE)/MailMarshal SPE

Question:

What versions of MailMarshal SPE are currently supported by LevelBlue Technical Support?

Information:

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For "discontinued" versions, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

All versions earlier than those listed are discontinued.

Threat Protection for SEG includes SpamCensor, AMAX, and other malware detection scripts maintained by LevelBlue Spider Labs Research.

Software Version

Release Date

Support Status
End of Support End of SEG Threat Protection Updates

SPE Version
5.3.0.22502
MailMarshal Version
11.3.0.7659 December 2, 2025 Active

SPE Version
5.2.0.22293
MailMarshal Version
11.2.0.7413 September 4, 2025 Active

SPE Version
4.3.5.20677
SEG Version
8.3.2.11492 April 9, 2024 Discontinued   January 31, 2026 December 31, 2025

SPE Version 4.3.4.20423
SEG Version 8.3.2.11492 October 4, 2023 Discontinued   January 31, 2026 December 31, 2025

SPE Version 4.3.3.20042
SEG Version 8.3.1.11439

July 11, 2023

Discontinued
  January 31, 2026 December 31, 2025

SPE Version 4.3.0.19124
SEG Version 8.3.0.11436

October 11, 2022

Discontinued
January 31, 2026 December 31, 2025

SPE Version 4.2.4.16662
SEG Version 8.2.6.11305

December 22, 2020

Discontinued
December 31, 2025 June 1, 2025

SPE Version 4.2.0.14203
SEG Version 8.2.4.11170

October 31, 2019

Discontinued
December 31, 2025 December 31, 2024

Notes:

For information about virus scanner plug-ins, see the Related Articles below.

Supported Operating Systems and Prerequisite Versions for MailMarshal SPE

Charles — Sun, 15 Mar 2026 18:52:49 GMT

This article applies to:

MailMarshal SEG Service Provider Edition

Question:

What are the supported operating systems for MailMarshal SPE?
What version of SQL Server can be used with MailMarshal SPE?
What versions of IIS and ASP.NET are supported by MailMarshal SPE?

Information:

The following table shows supported versions of operating systems and supporting software for MailMarshal SEG Service Provider Edition (SPE).

This article applies only to the latest released version (as noted in the table). For information about earlier versions, see the documentation provided with each version.

For more detailed information please see the MailMarshal SPE Administrator Guide.

Note: The operating system requirements apply to the main SPE server (Marshal Interface Agent server), Web Console servers, and all servers where SPE components are installed, including MailMarshal SEG servers managed by SPE. For information about supported operating systems for MailMarshal SEG, see the SEG Release Notes.

Key:

Symbol	Meaning
	Tested, Supported. No known issues
SPn	Minimum required service pack of the software
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds
	Not currently supported, obsolete, or known issues
	Not specifically tested, but LevelBlue plans to support the released version when it is available and has passed internal testing.
(blank)	Not applicable to this product

	MailMarshal SPE 5.3
Windows 2025
Windows 2022
Windows 2019
Windows 2016
Windows 2012 R2 Microsoft EOS October 2023
Windows 2012 Microsoft EOS October 2023
Windows 2008 R2 Microsoft terminated extended support on 14 January 2020.
Windows 2008 or below
Windows Core Edition
Windows XP Windows Vista Windows 7
SQL Express (Not supported in any version)
SQL 2025 (SQL Server Authentication or Mixed Mode is required)
SQL 2022 (SQL Server Authentication or Mixed Mode is required)
SQL 2019 (SQL Server Authentication or Mixed Mode is required)
SQL 2017 (SQL Server Authentication or Mixed Mode is required)
SQL 2016
SQL 2014
SQL 2012: Microsoft terminated support in July 2022
SQL 2008 R2: Microsoft terminated support on 9 July 2019.
SQL 2008 or below
Internet Explorer
Firefox, Chrome, Edge, Safari (supported versions) for all web interfaces
IIS (as provided on supported OS)
ASP.NET 6.0 (Required)
ADO/MDAC 2.5
ADO/MDAC 2.7 or above
MailMarshal SEG 11.e.0, build for SPE (This is the only version supported for SPE 5.3.0. For details of the SEG version allowed with each SPE release, see article Q20963.)

Upgrading MailMarshal Service Provider Edition to a newer version

Charles — Thu, 12 Mar 2026 23:35:24 GMT

This article applies to:

MailMarshal SPE supported versions

Question:

What is the safe method to upgrade MailMarshal SPE from an earlier version to the currently released version?

Procedure:

To upgrade SPE, the general procedure is to upgrade the MailMarshal (SEG) servers first, then upgrade the SPE Marshal Interface Agent or console server and the SPE agents.

Product names in the installers and interfaces depend on the product versions. MailMarshal SPE (Service Provider Edition) is also known as MailMarshal SPE. MailMarshal is also known as MailMarshal SEG or MailMarshal SMTP.
This article assumes you are familiar with SEG and SPE concepts.
Before starting, review the Release Notes for the new version of SPE and SEG. Release Notes include version specific upgrade notes, such as previous version supported for direct upgrade.

The following steps are suggested to upgrade SPE safely and with minimal disruption to email flow.

Upgrading to version 5.3 from 5.2:

Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the MailMarshal software.
- At this point you will have a fully working MailMarshal solution running on the new software. You may wish to take an additional snapshot of the MailMarshal database.
Repeat steps 3-7 for each MailMarshal array.
Start your IIS server.
Upgrade the Management Interface and/or MIA server: run the SPE installer and upgrade the Management Interface and Marshal Interface Agent. The database wizard will also run and upgrade your SPE database.
Upgrade any other standalone Management Interface servers.
Verify that email processing and Management Interface functions are working correctly.

Upgrading to version 5.2 from 4.3:

Stop the Marshal Agent services on all array managers and nodes.
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software (11.2). If necessary, first install version 8.3.3. This will upgrade your configuration from the earlier version.
Repeat steps 4-7 for each MailMarshal array.
Start your IIS server.
Identify the server where Marshal Interface Agent (MIA) is installed. This server might also include the Web Console/Management Interface. Run the SPE installer and upgrade MIA and any other components. The database wizard will also run and upgrade your SPE database.
If the Management Interface is not hosted on any of the servers already upgraded, then upgrade at least one Web Console/Management Interface server.
Open the Management Interface and log in. You may need to use CTRL-F5 to update client side scripts. Make sure the configuration appears correct.
Navigate to the Server Configuration/Arrays page:
- Replication will be paused. Resume replication.
- Force a configuration reload.
Upgrade the processing nodes with the MailMarshal software.
For each processing node, if you have not restarted the node after the upgrade, restart the Controller service. This step ensures a full configuration update for all the processing services. Notably the "loopback" delivery of messages between customers may not work until you do this.
Upgrade any additional Web Console/Management Interface servers.
On all servers that have only the MailMarshal components (Array Manager and/or Nodes), uninstall SPE 4.X. The only SPE component affected is the Marshal Agent, which is no longer used in version 5.X.

Upgrading to version 4.X:

Stop all SPE services on all array managers and nodes (Depending on version this may include Marshal Agent, Replication Agent, Status Agent, Maintenance Agent, Reporting Agent).
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the SEG Array Manager.
Take a snapshot of the SEG database.
Start the SEG Array Manager.
To ensure ability to roll back, create a backup of the SEG configuration by running the MMExportCfg in the SEG directory (typically in SEG version 8.X: C:\Program Files\Trustwave\Secure Email Gateway)
- For instance: MMExportCfg MMBackupOct2008.xml
- For details of locations for earlier SEG versions, see article Q10832.
- For SEG 8.0 if DKIM is in use, also ensure you have exported DKIM keys. They are not included in SEG 8.0 backups.
Upgrade the array manager with the supported version of SEG software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the SEG software.
- At this point you will have a fully working SEG solution running on the new software. Take a configuration backup (as in step 7) and a snapshot of the SEG database.
Repeat steps 4-9 for each SEG array.
Start your IIS server.
Upgrade the Web Console and/or MIA server: run the SPE installer and upgrade the web console and Marshal Interface Agent (Maintenance Agent in earlier versions). The database wizard will also run and upgrade your SPE database.
When the installer and database wizard completes successfully, log into the SPE console and make sure the configuration appears correct. Arrays will not be connected at this stage.
Run the SPE installer on all Array Managers to upgrade the Replication Agent or Marshal Agent (depending on version).
Force a configuration reload on the SPE web console (Arrays->Force Reload).
Monitor the Array Manager logs for any errors. If you encounter any problems, stop and disable the SPE agent on the Array Manager (Marshal Agent for 3.8 and above, Replication Agent for earlier versions). Restore the SEG configuration (from the backup you took in step 7 above), and restart the Array Manager. You will not need to restore the SQL database. Do not proceed further but contact LevelBlue Technical Support for assistance.
Upgrade the Marshal Agents on the nodes.
If upgrading to a version below 3.6, upgrade the reporting agent. (3.6 and above does not use a separate reporting agent.)
Restore any custom branding. The upgrade creates a dated backup of the website directory, including the branding subdirectory. Move required items to the production website\branding folder.
If you use custom themes for the Customer Console or SQM, you may need to update the themes to cover new features. See the linked article below for more information.
- Release 4.0 includes breaking changes to the SQM login page.
- Release 3.6.2 includes significant changes in the Customer Console themes from 3.6.1.

Notes:

For some versions, the Release Notes recommend stopping all Marshal services including all SEG services during upgrade. This recommendation was to ensure that some settings are updated when services start. Normally you can follow the steps above and SEG services can remain running during the SPE upgrade.

For upgrade from SEG 8.0 or below with DKIM keys, in the rare case that you must roll back the SEG upgrade, you might need to re-import DKIM keys on the nodes. Contact LevelBlue for assistance.

What are the Release Notes for MailMarshal SPE 5.3?

Charles Creegan — Tue, 02 Dec 2025 01:38:34 GMT

This article applies to:

MailMarshal SPE 5.3

Question:

What are the Release Notes for MailMarshal SPE 5.3?

Information:

The Release Notes included with MailMarshal SPE 5.3 are accurate as of the date of publication.

Build 5.3.0.22502 was published on December 2, 2025.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 5.3 from 5.2.0 only

To upgrade from 4.3.x you must first upgrade to 5.2.0.

SQL Prerequisite Change

The minimum SQL version supported is SQL 2017.

Provisioning customer-maintained blacklists in SPE

Charles — Tue, 14 Oct 2025 20:56:28 GMT

This article applies to:

MailMarshal SPE

Question:

How can I allow Managed customers in SPE to maintain their own blacklists of senders?
Each customer should be able to maintain their own unique blacklist through the Customer Console

Procedure:

To allow a customer maintained blacklist in a package policy rule that is enabled by default, use "Preset User Groups". Preset groups in rules will apply a separate list for each customer.

In the SPE Management Interface provier view, create a Preset User Group as shown.
Create a customer package policy. Ensure the package that contains this policy is active for all the desired customers.
Create a rule using the Preset User Group.
In the SPE Management Interface Customer view, the rule is visible to the customer. The rule has no effect until addresses are added to the Preset Group.
To add members to the group, the customer simply clicks the Preset Group link. The customer can add
- Individual addresses (including wildcarded addresses if permitted)
- A list of addresses imported from a file

Other user groups that they maintain in SPE

How to use the Support Tool for MailMarshal SPE

Charles Creegan — Tue, 14 Oct 2025 18:40:15 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use the Support Tool for MailMarshal SPE?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about a MailMarshal SPE installation. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about MailMarshal SPE, MailMarshal SEG, IIS, Marshal virus scanners, and the Connector Agent.

Note: For help with the Support Tool for other LevelBlue email products (MailMarshal SEG, LevelBlue ECM, WebMarshal, and MRC), see Q15024.

Installation

Download the latest version of the tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool (1.14 and above) is packaged with .NET 7 runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

Copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect to check for updates, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool appears as shown below.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Click GO to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include the SPE database statistics data. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

System Information

Includes a listing of the system hardware and operating system information.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

If this is a SEG processing node, optionally select Include Quarantine directory listing to list all messages in quarantine and archive (only if required, as the file will be much larger and take longer to generate).

Event logs

Includes Windows Event Log information. If you include the event logs, choose to include Application and/or System logs by checking the boxes.

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a SEG processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.

Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

SPE database

Include the SPE configuration and logging data as CSV files.

Include statistics data

Also include dashboard statistics from the SPE database.

Warning: Select these options only when directed. Including the SPE database (particularly the statistics data) can result in a very large file. In some cases it could consume all available disk space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Version: The installed version of the Support Tool.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
The tool is able to gather information for MailMarshal SPE (MailMarshal SPE) 3.0 and above.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.

Using externally generated certificates for Marshal Interface Agent

Charles — Tue, 14 Oct 2025 01:36:56 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use my own certificate for the Marshal Interface Agent connection to other components?
Using a certificate from a Certificate Authority for MIA

Procedure:

Stop the MIA service and all services that connect to it
Delete the binding of the existing certificate with the MIA port
1. Run netsh (Make sure that you have administrator privileges, for instance by using runas or starting netsh from an elevated command prompt).
2. At the netsh> prompt, change to http context by entering http
3. (Optional) At the netsh http> prompt, you can verify that the MIA port is bound by entering
  show sslcert
4. Remove the MIA port binding by entering
  delete sslcert ip=0.0.0.0:19200
  
  The utility should confirm that the delete was successful.
Manage certificates:
1. Run MMC from Start>Run
2. Add the Certificate snap-in for the local computer account
3. Navigate to Certificates (Local Computer)\Personal\Certificates
(Optional) Delete the default MIA certificate from the certificate store.
- Note: You may wish to leave this certificate in the store as a backup. The certificate cannot be fully exported for backup, because the private key cannot be exported.
1. Locate a certificate that is issued to computer_name by computer_name (where computer_name is the name of the server) and the Subject contains the following properties:
  - OU = Marshal Dev
  - O = LevelBlue
  - CN = computer_name
2. Remove that certificate.
Insert your own certificate into the computer account certificate store, under the Personal store. The certificate can be a standard web server certificate ordered from a Certificate Authority. If you are creating your own certificate, it must meet the following criteria:
- Certificate needs to contain a private key
- Certificate subject: CN attribute must be the resolveable name of the computer where MIA is installed (DNS name or computer name). This is the server name you will enter when connecting.
- Key usage: Digital Signature, Key Encipherment, Data Encipherment
- Intended purpose: Server Authentication
Copy the certificate hash (Thumbprint) formatted without spaces in between values
for example: 035c49f034ee505b8d1cad1f3485fb642b470607
Add the binding for the MIA port
1. Run netsh as administrator
2. At the netsh> prompt, change to http context by entering http
3. At the netsh http> prompt, enter following command:
  add sslcert ip=0.0.0.0:19200 certhash=paste the hash from the step above appid={f0bd00f1-a9f0-4466-bd36-ee495fa9cc25}
  - For example:
    add sslcert ip=0.0.0.0:19200 certhash=035c49f034ee505b8d1cad1f3485fb642b470607 appid={f0bd00f1-a9f0-4466-bd36-ee495fa9cc25}
Verify that the binding exists (at the netsh http> prompt, enter show sslcert)
Start the MIA service
Re-register all of the client services using the Marshal Client Settings application (found on the Start Menu of each server).
- In the URL field, be sure to specify the CN used in the new certificate.
Start all client services.

Creating an Application Registration for Entra ID

Charles — Tue, 14 Oct 2025 01:34:26 GMT

This article applies to:

MailMarshal 11.2 and above
MailMarshal SPE 4.4 and above
Entra ID Group Import

Question:

How do I register an application in Azure/Entra to allow group import to MailMarshal?
What are the options and requirements for use of imported Entra groups?

Background:

MailMarshal allows you to retrieve user group information directly from Microsoft Entra ID (formerly known as Azure Active Directory). To connect, you must create an "application" in Entra.

You will enter the Client ID, Tenant ID, and Secret from Entra in the MailMarshal Management Console or the MailMarshal SPE Customer Console

Procedure:

Note common missed items in this procedure:

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Be sure you grant Application permissions (not "delegated")
Be sure to grant admin consent

Log in to the Microsoft Entra Admin Center (entra.microsoft.com). The minimum required permission is "Cloud Application Administrator"
If you have access to more than one tenant, use the Settings menu (gear icon in the top bar) to switch to the specific tenant.
From the left menu browse to Identity > Applications > App registrations. Click New registration.
Enter a name.
For "supported account types" accept the default (single tenant).
Click Register.
From the overview page of the application, note the following values:
- Application (client) ID
- Directory (tenant) ID
From the API Permissions page of the application, grant the following Microsoft Graph permissions (Application permissions):
- Group.Read.All
- Member.Read.Hidden
- OrgContact.Read.All
- User.Read.All
After updating the above permissions, click Grant admin consent (above the list of permissions)
From the Certificates & Secrets page of the application, create a new client secret. Note the value (it is only available immediately after creation).

Use the Client ID, Tenant ID, and client secret on the Entra Properties tab of the Connector page in the MailMarshal Management Console, or the Entra Connector Properties page in the SPE Customer Console.

Group usage:

After creating the connector you can select groups to import using the Import Connector Group or Import Entra Groups button on the User Groups page.

Groups are populated immediately. Group membership is queried and updated hourly.

Using the SPE Connector Agent with Azure AD

Charles — Tue, 14 Oct 2025 01:30:12 GMT

This article applies to:

MailMarshal SEG Service Provider Edition
Microsoft Azure Active Directory

Question:

How can SPE user information be imported from Azure AD?

Procedure:

The Connector Agent is an optional module of SPE that allows you to retrieve information about local user groups and email addresses from an Active Directory server or LDAP server, for use in email filtering policy.

You can use the Connector Agent with Azure AD.

Note: In current versions of SPE, customers can retrieve Azure/Entra directory information directly, using the Entra Connector. This is a much quicker and more robust option. See customer facing documentation. Basic information on the required setup in Entra is found in LevelBlue Knowledgebase article Q21246.

If a customer has a workstation or server available on premises that is a domain member, they can install and configure the Connector Agent for Azure AD in the same way as for a premises AD installation.

Note: For customer-focused basic instructions about how to download, install, and configure the Connector Agent, refer to the End User Guide provided with SPE.

The customer or Service Provider can also use the Connector Agent to synchronize information from Azure AD using LDAPS.

Note: The Service Provider can host Connector Agent service for multiple customers with a single installation. See article Q14972.

To use the Connector Agent with Azure AD LDAPS:

Configure Secure LDAP (LDAPS) in Azure AD Domain Services. See the Microsoft documentation for this task.
Once secure LDAP access to a managed domain over the internet is successfully enabled, the Azure AD Domain Services management site shows the external IP address that can be used to access the directory over LDAPS in the field EXTERNAL IP ADDRESS FOR LDAPS ACCESS.
Install the Connector Agent on any computer that has Internet access (HTTPS access to the SPE Customer Console, and port 636 for LDAPS access to the Azure LDAPS IP address).
Create a new connector, and specify a LDAP directory of type “Microsoft Active Directory”.
Enter the Azure LDAPS IP address. Specify port 636 and select Connect using SSL. Enter logon credentials.
Click Next. The Agent tests the connection.
When the connection is successfully tested, continue the Wizard as described in the End User Guide.
When the connector has been successfully created, you can proceed to select groups for synchronization.

Configuring Syslog delivery over TCP with TLS

Charles — Tue, 14 Oct 2025 01:14:00 GMT

This article applies to:

MailMarshal SPE 4.3.4 and above
Syslog Configuration

Question:

What are the required actions to allow use of Syslog TCP with TLS?

Procedure:

SPE 4.3.4 introduced the ability to use TCP transport with TLS.

This feature has the following prerequisites and setup requirements:

Syslog Server Certificate

The client certificate configured in the Syslog server must be a CA signed certificate. Self signed certificates are not accepted.

MailMarshal Syslog setup

Certificate configuration depends on the version of the software.

MailMarshal SPE 5.X/MailMarshal SMTP 11.X and above

In these releases, Syslog uses the certificate configured for the MailMarshal REST API on each Array Manager. Use the MailMarshal Server Tool to configure this certificate.

All other configuration of Syslog is through the SPE Management Interface.

MailMarshal SPE 4.X/MailMarshal SMTP 8.3.X

You must import a certificate in the MailMarshal Configurator (MailMarshal SEG Properties > Syslog).

To make this page accessible you must first add Registry keys that are not generated in SPE installations:

On the Array Manager, open Regedit.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Syslog
Add the following keys (not values):
- Message
- Content
- RejectedMessage
- QuarantineAudit
You can now view this dialog and use the certificate wizard to upload a certificate.

Once this information is entered and committed, use the SPE Management Interface to configure Syslog global and customer settings.

SQM or Customer Console "Remember Me" not working

Charles — Tue, 14 Oct 2025 00:32:28 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Spam/Quarantine Management website

MailMarshal SPE Customer Console and SQM (4.2 and below)
Forms authentication
This article does not apply to the MailMarshal Management Console (10.X and above) or SPE 4.3.5 and above

Symptoms:

Remember Me is selected on the site login page
User credentials are only remembered for a short time of inactivity. Users are asked to enter credentials after about 20 minutes.
With SPE, the "Default Session Timeout" setting in the Admin Console cannot be used to extend the Customer Console timeout to more than 20 minutes.

Causes:

The Remember Me function uses ASP.NET authentication cookies. By default the cookies time out after 20 or 30 minutes, depending on the version of ASP.NET originally installed.
LevelBlue recommends you maintain the default timeout for security reasons.

Resolution:

To extend the timeout, change the forms authentication configuration settings for the affected web sites or virtual directories.

Notes:

If you have more than one SQM web server or SPE Customer Console server, you must perform these steps on each web server.
For SPE, you must configure the SQM virtual directory as well as the Customer Console site. The site setting is not inherited by the SQM directory/application.

On the web server, open IIS Manager.
Navigate to the properties of the virtual directory or website you want to configure.
- For SEG SQM, by default, this is Default Web Site/SpamConsole
- For ECM quarantine management, by default, this is MailMarshal Exchange Web Components/QuarantineConsole
- For SPE Customer Console, by default, this is the website Customer Console
- For SPE SQM, by default, this is Customer Console/SQM
In the IIS section, double-click Authentication.
On the Authentication page, select Forms Authentication and then click Edit (from the right pane Actions list).
On the Forms Authentication Settings window, set the authentication cookie time-out to a longer value (in minutes). Ensure that Extend cookie expiration is checked.
Click OK.
When you have changed all required settings, exit IIS manager.
For SPE, remember to change the "Default Session Timeout" setting in the Admin Console.

Notes:

This problem does not affect Windows authentication.

Required URLs for Web Updates

Charles — Fri, 19 Sep 2025 02:21:41 GMT

This article applies to:

MailMarshal SEG
MailMarshal SPE

Question:

What URLs are required for product feature updates?
What URLs are required for product licensing updates?

Information:

The following URLs are used by MailMarshal SEG (MailMarshal) and MailMarshal SPE (Service Provider Edition).

You must allow access through your firewall from the servers as noted.

Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

The SEG requirements also apply to the processing arrays in a SPE installation.

URL	From Server	Purpose	More Info
HTTP (port 80) to all locations, including (but not limited to) HTTP://crl3.digicert.com HTTP://crl4.digicert.com HTTP://o.lencr.org Note: For correct operation of TLS, the Controller service on all processing nodes must have access to HTTP port 80 without restriction. TLS certificate revocation lists are published over HTTP and there is no definite list of URLs.	All	HTTPS Certificate Checking	Q12992
HTTPS://mailmarshal.licensing.marshal.com	Array Manager	Licensing IP Reputation Service credential	Q12992
HTTP://www.marshal.com HTTPS://www.marshal.com	Array Manager	SpamCensor and processing module updates	Q12992
HTTPS://cdn-updates.marshal.com This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.	Array Manager	SpamCensor and processing module updates (Azure CDN)	Q12992
HTTP://sigupdates.marshal.com HTTPS://sigupdates.marshal.com HTTP://pki.cloudmark.com/ HTTPS://pki.cloudmark.com/ HTTP://lvc.cloudmark.com/ HTTPS://lvc.cloudmark.com/ HTTP://tracks.cloudmark.com/ HTTPS://tracks.cloudmark.com/ HTTP and HTTPS access to the following network range: 208.83.136.0/22	Processing Nodes	SpamProfiler Note: As of February 2024, HTTPS is the default protocol. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for these URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.	Q12992
HTTP://scanmail.trustwave.com HTTPS://scanmail.trustwave.com HTTP(S)://urlscanner.mailmarshal.cloud (11.2 and above) (These URLs may redirect or resolve to different IP addresses)	User's workstation	Blended Threat Service URL check	Q12992
HTTPS://stats.scanmail.trustwave.com HTTPS://stats.btm.protection.mailmarshal.cloud (11.2 and above)	Array Manager	Blended Threat Service statistics retrieval	Q12992
HTTP://urlcategorizer.seg.trustwave.com	Processing Nodes	URL Categorizer URL check Note: this service has multiple geographically distributed instances. MailMarshal installations use the best instance based on geography and latency.	Q12992
HTTP://sophos.marshal.com HTTPS://sophos.marshal.com	Processing Nodes	Sophos for Marshal Engine and IDE updates (if installed). HTTPS required from SfM version 1.1. Note that the LiveProtection service (present in version 1.1 and above) performs DNS-based queries and must have access to a DNS server that can query the Sophos DNS servers.	Q11906
HTTP://mcafee.marshal.com HTTPS://mcafee.marshal.com	Processing Nodes	McAfee for Marshal Engine updates (if installed). HTTPS required from MfM version 1.1.	Q11360
HTTP://update.nai.com/	Processing Nodes	McAfee for Marshal definition file updates (if installed)	Q11360
HTTPS://bitdefender.marshal.com HTTPS://agent-av-mirror.trustwave.com	Processing Nodes	Bitdefender for Marshal Engine and signature updates (if installed)	Q20561
HTTP://activations.marshal.com/ HTTPS://activations.marshal.com/	SPE MIA server or Maintenance Agent/Web Console server	SPE licensing and Connector Agent updates	Q12161
HTTPS://login.microsoftonline.com/ HTTPS://graph.microsoft.com/	Array Manager	Entra Connector NEW	Q21252

Note:

You can set a web proxy for these requests.

In SEG, see the Configurator, Tools > SEG Properties > Internet Access
- For the Entra Connector, see the Knowledgbase article linked above.
In SPE:
- For licensing, see the Web Admin Console, System Settings > Proxy
- For SEG arrays, see the properties of each array in the Web Admin Console.

What are the Release Notes for MailMarshal SPE 5.2?

Charles — Wed, 03 Sep 2025 23:14:29 GMT

This article applies to:

MailMarshal SPE 5.2

Question:

What are the Release Notes for MailMarshal SPE 5.2?

Information:

The Release Notes included with MailMarshal SPE 5.2 are accurate as of the date of publication.

Build 5.2.0.22293 was published on September 4, 2025.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 5.2 from 4.3.5 only

To upgrade from earlier versions, you must first upgrade to 4.3.5.

MailMarshal service restarts required

After upgrading all MailMarshal and SPE components and reloading configuration, to ensure the configuration is fully applied you must restart all MailMarshal services.

What are the Release Notes for MailMarshal SPE 4.3?

Charles Creegan — Mon, 08 Apr 2024 23:11:27 GMT

This article applies to:

MailMarshal SPE 4.3.X

Question:

What are the Release Notes for MailMarshal SPE 4.3.X?

Information:

The Release Notes included with MailMarshal SPE 4.3 are accurate as of the date of publication.

Build 4.3.5.20677 was published on April 9, 2024.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 4.3.5 from 4.3.0 only

To upgrade from 4.2.X you must first upgrade to 4.3.0.

Upgrade - New SQM

Installation of version 4.3.3 or above installs the new SQM website.

With the new Management Interface introduced in 4.3.0 (see Knowledgebase Article Q21188), the update to web interfaces is complete.

Issues Fixed in This Release

Security vulnerability: The Telerik web controls used in the legacy Customer Console have a known security vulnerability. For more information see the related link below from Telerik.

In version 4.3, Customer Console functions are available in the Management Interface. This interface does not use the problem DLL.
LevelBlue strongly recommends that SPE installations redirect to the Management Interface for all Customer Console functions.

Customer move issue:

In release 4.3.0, moving a customer between resellers could cause all Customer Package selections to be lost. Validation of the packages authorized for the new reseller was not correct. These issues are fixed in current releases.

Cannot create remote view when updating an array

Charles — Sun, 14 Jan 2024 18:45:58 GMT

This article applies to:

MailMarshal SPE

Symptoms:

After adding or editing an array, the Management Interface returns a toast error indicating one or more items could not be added to SQL Server
Logs show similar to:

Could not add view to Remote SQL Server.
See KB article 11600 in the LevelBlue Knowledgebase for more information

Cause:

SPE could not add the required views, tables, and stored procedures on the remote MailMarshal database.

The SQL credential used to connect to the MailMarshal database does not have sufficient permissions.

Fix:

To correct this issue:

In the Management Interface navigate to the Server Configuration > Arrays > (array name) > General > Database page.
Set the database credential for each MailMarshal array to a credential with permission to add items, select data, and execute stored procedures on the MailMarshal database.
Click Save.
Once the credential is saved and accepted, click Deploy SQL Scripts.

For earlier releases, similar functionality is available in the Admin Console.

Limiting permissions:

After successfully creating the objects, you could revert to a database credential with lower permissions.

You must ensure that the credential has the following permissions:

Execute permission on all stored procedures in the MailMarshal database that have names starting "SPE".
Insert, Select, Update, Delete permission on all tables and views in the MailMarshal database that have names starting "SPE".
Select permission on all other tables in the MailMarshal database.
- To grant appropriate permissions on the native MailMarshal items, make the credential a member of the @ArrayManager database role.

What versions of Marshal Security products are currently supported by LevelBlue Technical Support?

Charles Creegan — Sun, 26 Nov 2023 18:02:27 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal SPE
MailMarshal SES
Marshal Reporting Console
WebMarshal
Bitdefender for Marshal
McAfee for Marshal
Sophos for Marshal
Other Products
- MailMarshal Appliance e10000
- MailMarshal Management Pack for MOM
- MailMarshal Management Pack for SCOM
- Marshal EndPoint Security
- Security Reporting Center
- Firewall Suite
- imMarshal for MSN
- Counterspy for Marshal
- Kaspersky for Marshal
- PestPatrol for Marshal

Question:

What versions of Content Security (Marshal) products are currently supported by LevelBlue Technical Support?

Information:

For full details about supported versions of current products, see the articles linked below:

Premises Email Security

Article Q20961 covers the following products:
- MailMarshal (SEG)
- MailMarshal ECM/MailMarshal Exchange
- Secure Email Server (SES)

Web Content Security

Article Q20962 covers WebMarshal.

Service Provider Email Security

Article Q20963 covers MailMarshal SPE.

Anti-Virus and Reporting

Article Q20964 covers the following products:
- Bitdefender for Marshal
- McAfee for Marshal
- Sophos for Marshal
- Marshal Reporting Console

Deprecated and Discontinued Products

e10000 (MailMarshal Node Appliance): End of support: March 31, 2011
EndPoint Security: End of support: May 1, 2013
MailMarshal Management Pack for MOM: End of support: May 1, 2013
MailMarshal Management Pack for SCOM: End of support: May 1, 2013
Security Reporting Center (Windows Version): End of support: December 31, 2009
Security Reporting Center (Solaris Version): Withdrawn
Firewall Suite: Withdrawn
imMarshal for MSN: Withdrawn
Counterspy for Marshal: End of support: January 1, 2014
Kaspersky for Marshal: End of support: November 22, 2023
PestPatrol for Marshal: End of support: January 1, 2014

This article was previously published as:: NETIQKB33882

Additions to Release Notes for MailMarshal SEG 8.3

Charles Creegan — Wed, 04 Oct 2023 21:29:16 GMT

This article applies to:

MailMarshal/SEG 8.3
MailMarshal SPE 4.3

Question:

What are the Release Notes for MailMarshal SEG 8.3?

Information:

MailMarshal SEG version 8.3.2 (8.3.2.11492) was released on September 29, 2023.

NOTE:
- This release is primarily intended to support MailMarshal SPE 4.3.4.
- This release is available to MailMarshal SMTP 8.X customers. However LevelBlue strongly recommends that MailMarshal SMTP customers upgrade to the latest supported version.

The Release Notes included with the product are accurate as of the date of publication.

This article provides any additional information or corrections generated after that date.

TLS Custom Cipher List changes for MailMarshal Q3 2023 versions

Charles Creegan — Thu, 28 Sep 2023 23:38:30 GMT

This article applies to:

MailMarshal 10.0.7 and above
MailMarshal 8.3.2 and later 8.X
MailMarshal SPE 4.3.4 and above

Question:

What changes are required in custom Cipher Lists for MailMarshal versions released in September 2023 (or later)?
Why does MailMarshal not negotiate TLS 1.0 or 1.1 after upgrade to 10.0.7 or 8.3.2?

Information:

Customers can enter custom TLS Cipher lists using the Registry setting or Advanced Setting TLSCipherList. This setting can be present for the Sender and for each Server.

Security settings in the updated TLS/SSL library have changed the default behavior of the cipher lists. These changes affect the library used in MailMarshal 10.0.7 and above, and in 8.X releases 8.3.2 and above.

To preserve the behavior of previous versions, add the following entry in the Cipher Lists:

@SECLEVEL=0

For example:

ALL:!aNULL:@SECLEVEL=0:@STRENGTH

Notes:

This issue only applies for installations where a custom setting was created.

Customers who have selected one of the options available in the configuration interfaces do not need to take any action. The cipher lists used for these selections are automatically updated.

Configuring SAML Single Sign On for SQM

Charles Creegan — Mon, 24 Jul 2023 02:46:41 GMT

This article applies to:

MailMarshal SPE
SQM

Question:

How do customers configure a SAML provider for SSO?

Procedure:

SPE 4.3.3 and above supports Single Sign On for both the SQM and the Customer view of the Management Interface.

When SSO is enabled for a customer, the Customer view includes one or more configuration pages (see Configuration > Security Configuration > Single Sign On). These pages allow the customer to configure one or more providers as required.

SSO works with SAML 2.0 compliant providers such as Google, Azure AD, and Microsoft ADFS.
- Note: For ADFS, the Certificate to be used is the Token Signing certificate from the ADFS server.

Click Provider Metadata to download an XML file containing the metadata definitions for the SPE installation. This file can be imported to the provider.
Click Add to create a new provider.
- This window displays the Entity ID and ACS URL for the SPE installation. You can use this information to configure the provider. If you import the metadata file to the provider, these items will be populated automatically.
Complete configuration of SSO on the provider side.
- Ensure that you have enabled at least one user for SSO on the provider side.
After SSO is configured on the provider side, enter the details given by the provider in the Identity Providers window: the Entity ID, the SSO URL, and the SSL certificate, if required.
After saving the provider data, for SQM you can further select the default provider (using the button above the list).
- You can also select different providers for each domain (see Server Configuration > Domains).
- Console SSO only allows one provider.
Test SSO with the user name that is enabled on the provider side.
When ready to deploy SSO, enable all required groups or users for SSO on the provider side.

User Management - Management Console Customer view

SSO for the Customer view only authenticates existing user logins. The customer (or service provider) must create users and set permissions explicitly. Self provisioning is not supported.

Caution: If the provider data is incorrect, no users in the organization will be allowed to log in. Before logging out of the session where SSO was configured, the customer should test using a different account from another browser.
If a customer is unable to log in due to incorrect SSO settings, you can log on to the customer console using a Support login and disable SSO. Support logins always use the local password, not SSO.

User Management - SQM

When a SQM user is authenticated with SAML SSO for the first time, a user record is created and the user name/email address is added as the alias managed by this login.

If the email address is already managed as an alias by an existing SQM user, then a SQM user is not created.

If the provider delivers additional alias information (multiple email addresses), then the additional aliases are added to the list of aliases managed by the user (unless they are already managed by another user).

New aliases, if any, are added each time the user is authenticated via SSO.
Aliases are not removed from SQM by the SSO process even if they are no longer listed by the provider.

Field mapping

When configuring SSO on the Provider site you might be required to enter the names of attributes. SQM uses the following attributes (note that all attributes are case INsensitive, and spaces are ignored):

FullName, Name
- The personal name or friendly name of the user.
User, UserName
- The primary email address for the user, and their login username. This value is only used if the username is not provided directly by the IDP.
FirstName, GivenName
- Used to create Fullname if Fullname not present
Surname, LastName
- Used to create Fullname if Fullname not present
Email, EmailAddress, EmailAddresses, Alias, Aliases, Emails
- Any and all of these values will be added as alias email addresses. Some providers do not allow these attributes to be mapped.

What are the Release Notes for MailMarshal SPE 4.2?

Charles — Tue, 09 May 2023 04:19:55 GMT

This article applies to:

LevelBlue SPE 4.2.X

Question:

What are the Release Notes for MailMarshal SPE 4.2.X?

Information:

The Release Notes included with MailMarshal SPE 4.2 are accurate as of the date of publication.

Build 4.2.4.16662 was published on December 22, 2020.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Known Issues

Security vulnerability: The Telerik web controls used in the Customer Console have a known security vulnerability. For more information see the related link below from Telerik.

LevelBlue strongly recommends that customers upgrade to MailMarshal SPE 4.3. In version 4.3, Customer Console functions are available in the Management Interface. This interface does not use the problem DLL.

Windows and SQL versions supported

SPE supports Windows 2019 and SQL 2019.

SQL procedure upgrade scripts for SEG - Not required

Some versions of the Release Notes mention a requirement to manually upgrade SQL stored procedures in the MailMarshal SEG database.

These scripts are now upgraded automatically. No manual action is required.

What are the Release Notes for MailMarshal SPE 4.0.X?

Charles Creegan — Tue, 09 May 2023 04:19:55 GMT

This article applies to:

MailMarshal SPE 4.0.X

Question:

What are the Release Notes for MailMarshal SPE 4.0.X?

Information:

The Release Notes included with MailMarshal SPE 4.0 are accurate as of the date of publication.

Build 4.0.3.20390 was published on February 12, 2019.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Known Issues

Security vulnerability: The Telerik web controls used in the Customer Console have a known security vulnerability. For more information see the related link below from Telerik.

LevelBlue strongly recommends that customers upgrade to MailMarshal SPE 4.3. In version 4.3, Customer Console functions are available in the Management Interface. This interface does not use the problem DLL.

Upgrade Notes

When the SPE Database Wizard runs as part of upgrade of the SPE Web Console server or MIA server, TextCensor upgrade may fail with a blank error dialog. The following error is logged (in the SPEDBWizard log file): Could not load file or assembly 'TextCensor2.NET.dll' or one of its dependencies.
- To resolve this issue, install the Microsoft Visual C++ 2010 Redistributable Package on the affected server.
The SQM login page has been updated to support SAML authentication. If you use a custom theme for SQM you must update the theme.
Minor additions have been made to the Customer Console theme to support new features. If you use a custom theme for the Customer Console, you should review changes in the theme.

Service Account Permissions

SPE services use the REST API provided by SEG. If the services are running as a custom account that is not in the Local Administrators group, you must give this account the "log on as a batch job" permission.

MailMarshal SEG Support

SEG 8.0.7 (8.0.7.11235, released June 14, 2018) is the minimum supported version for use with SPE 4.0.3.
For details of the SEG version allowed with each SPE release, see article Q20963.

Internet Explorer Settings

With IE 11 on some releases of Windows 10, some buttons in the Admin Console may not function correctly. If you encounter this issue, add the Admin Console to the Trusted Sites zone.

Best practices to secure product related websites

Charles — Tue, 28 Feb 2023 21:47:03 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
SEG Service Provider Edition/MailMarshal SPE
Marshal Reporting Console
All web sites created by the products

Question:

What are the recommended practices for secure (HTTPS) access to product websites?

Information:

LevelBlue recommends that SSLv2 and SSLv3 should be disabled on all web servers that provide service for the named products (such as SQM/End user spam and quarantine management, remote consoles, and reporting consoles), if the sites are secured with HTTPS. These protocol versions are older and have known vulnerabilities. For example, CVE-2014-3566 ("Poodle") is a vulnerability in the SSLv3 protocol that potentially allows an attacker to view the plain text of encrypted material.

Some regulatory frameworks and companies are recommending and even requiring that TLSv1.0 and TLSv1.1 be disabled as well.

Notes:

For technical details of how to disable SSLv2 and SSLv3 on Windows servers, refer to Microsoft documentation.

See Microsoft Knowledge Base article 245030.
A more detailed explanation can be found in this TechNet blog post.
A free third party tool that might be of use to simplify the process, for any version of TLS/SSL, is IISCrypto from Nartac Software.

Management Interface website for SPE 4.3

Charles Creegan — Tue, 14 Feb 2023 18:27:06 GMT

This article applies to:

MailMarshal SPE 4.3.X
Admin and Customer websites

Question:

What do I need to know about website changes in SPE 4.3?

Information:

SPE 4.3 includes a new Management Interface website. This modern, mobile friendly site includes all functions of the legacy Admin Console and Customer Console.

Upgrade considerations

Upgrade of an Admin Console server installs the new Management Interface website. Upgrade disables the legacy Admin Console website that depends on Internet Explorer.

In the upgrade installer you can specify a host header for the Management Interface. This cannot be the same as the existing host header entry for the Admin Console. You will probably want to change the host header and binding later, to apply the legacy URL to the new site.

After completing the software upgrade you must update website bindings and DNS entries so that the Management Interface is available from the appropriate locations to give access to the Provider and any Distributors or Resellers.

Standard Logins to the Management interface have additional security roles (Rule Summary, Groups, Digests, Relays). Access to these roles is not set by default. You must review access for each standard login and grant access to these roles as appropriate.

Upgrade of a Customer Console server installs the Management Interface as well as upgrading the familiar Customer Console. In the upgrade installer you can specify a host header for the Management Interface. This cannot be the same as the existing host header entry for the Customer Console. If you plan to remove the Customer Console, you can change the host header and binding later.

All login credentials continue to work with the new interface.

If you choose to retain the familiar Customer Web Console, customers can continue to use this interface for most functions. The following items now require the new interface:

Report generation and Scheduled Reports configuration
Keywords Detection and TextCensor editing

The end user Spam Quarantine Management view is available from either the pre-existing Customer Console or the new site, with the path /SQM

Controlling access to views

If you want to maintain separate servers for the Customer Console and Admin Console, you can limit the available views using Registry entries on each server.

To limit access, add one or more of the following DWORD values in the root of the MailMarshalSPE registry key HKLM\SOFTWARE\Wow6432Node\Marshal\MailMarshalSPE

AllowAdminConsole
AllowResellerConsole
AllowCustomerConsole

A value of 0 (zero) denies access. The default for all items is to allow access. AllowResellerConsole also controls the Distributor view.

The entries may take up to a minute to apply, due to caching in the services.

Disaster Recovery for MailMarshal SPE

Charles Creegan — Thu, 01 Jul 2021 19:39:15 GMT

This article applies to:

MailMarshal SPE

Question:

What is required to allow disaster recovery of a SPE installation?
What are best practices to move a SPE installation?

Procedure:

Disaster recovery of a SPE installation involves two parts: preparedness (backups), and re-installation.

This article assumes you are familiar with MailMarshal SPE and SEG (MailMarshal SMTP) concepts.

Note: Similar steps can be used to move an existing installation to a new environment (new machine names and IP addresses).

Preparedness

To be prepared for recovery, ensure that you have backed up all applicable items. Items to back up include:

The SPE configuration database.
The SEG databases from each array.
The SEG configuration from each array (using MMExportCfg).
- For versions below SPE 4.2 (below SEG 8.2), you must separately back up DKIM keys if any from SEG
The Quarantine folder contents from each Node of each array.
(If custom filetypes are used) The Filetype.cfg file from the SEG Array Manager server (this is also covered in the SPE database).
(MailMarshal SPE 2.X only) The website\branding folder. (In version 3.X, branding items are stored in the database.)
Ensure you have a record of which components are installed on which servers.

You could also use VM snapshots, particularly to move an installation.

Re-installation

To restore email flow most quickly, restore SEG arrays first.

For each SEG array:

Note: Do not install the SPE Agents at this stage (the Marshal Agent, and the Replication Agent for earlier versions).
- If you are using VM snapshots, stop the Agents and set to manual start before restoring the SPE Web Console server or Marshal Interface Agent server.
- To ensure array configuration and replication work as expected, the SPE Array settings must be updated before the Agents connect.

Install SEG software on the Array Manager. Use a temporary database to avoid unwanted changes from configuration import.
Import the configuration from backup.
Add a Registry entry as follows (assumes SEG 8.x):
- In Regedit, navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\
- Add a new DWORD named: inSPE
- Set the value to 1
- Commit configuration and restart services.
Request a new license key. Provide your customer ID in the request for automatic response. Using a license key associated with your account ensures that licensed features such as BTM are correctly configured.
Restore the production SEG database.
Use the Server Tool to connect to the restored production database.
Install SEG software on the Nodes and re-connect to Array Manager.
On each Node, restore Quarantine folders.
Restore Filetype.cfg (if required). Note that SPE will also restore this file when configuration is reloaded.
For SEG 8.0 with DKIM keys, if nodes were re-created, you must import DKIM keys on the nodes. Contact LevelBlue for assistance.

At this stage email flow should be restored.

To restore SPE:

Restore the SPE Configuration database.
Install the core SPE server components using the restored database.
- For version 3.6 and above, this includes the Marshal Interface Agent and the Admin Console web server. If these are on separate servers, install MIA first.
- For version 3.5 and below, this is the Web Console server, which includes the Admin Console and core components on one server.
When the installer and database wizard completes successfully (including client configuration for version 3.6 and above), log into the SPE Admin Console and make sure the configuration appears correct. Arrays will not be connected at this stage.
- If IP addresses or server names have changed be sure to update all Array and Server settings in the SPE Web Console before proceeding to the next step.
Install SPE components on the SEG servers.
- For version 3.8, the Marshal Agent on Array Managers and nodes.
- For earlier versions, the Replication Agent on Array Managers and Marshal Agent or Status Agent on nodes.
- If the SEG servers were restored from VM snapshots, run the SPE Client Settings application on each SEG server, and then start the Agents and set to automatic start.
Force a configuration reload from the Admin Web Console (Arrays->Reload). Monitor the Array Manager logs for any errors.
Install any other SPE website servers (3.X only) and the Reporting Agent (Reporting Agent is for versions prior to 3.6).
(For version 2.X only) Restore any custom branding to the website\branding folder.

Notes:

Also consider backup/recovery of DNS and other infrastructure settings.
Advanced installations may need to preserve customizations to IIS. You could use Microsoft WebDeploy to back up IIS items.

Software Version	Release Date	Support Status	End of Support	End of SEG Threat Protection Updates
SPE Version 5.3.0.22502 MailMarshal Version 11.3.0.7659	December 2, 2025	Active
SPE Version 5.2.0.22293 MailMarshal Version 11.2.0.7413	September 4, 2025	Active
SPE Version 4.3.5.20677 SEG Version 8.3.2.11492	April 9, 2024	Discontinued	January 31, 2026	December 31, 2025
SPE Version 4.3.4.20423 SEG Version 8.3.2.11492	October 4, 2023	Discontinued	January 31, 2026	December 31, 2025
SPE Version 4.3.3.20042 SEG Version 8.3.1.11439	July 11, 2023	Discontinued	January 31, 2026	December 31, 2025
SPE Version 4.3.0.19124 SEG Version 8.3.0.11436	October 11, 2022	Discontinued	January 31, 2026	December 31, 2025
SPE Version 4.2.4.16662 SEG Version 8.2.6.11305	December 22, 2020	Discontinued	December 31, 2025	June 1, 2025
SPE Version 4.2.0.14203 SEG Version 8.2.4.11170	October 31, 2019	Discontinued	December 31, 2025	December 31, 2024