LevelBlue Knowledge Base » Knowledgebase » MailMarshal (SEG)

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

Charles — Tue, 24 Feb 2026 21:13:18 GMT

This article applies to:

MailMarshal (SEG) 7.X and above
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

What is the version of the Unpacker and File Type DLLs for my version of SEG or ECM?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function (SpamCensor updater) for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file. Files that can be automatically updated are found on the Array Manager, in the Config subfolder of the SEG installation.

Latest File Versions

Notes:

From May 2024, Unpacker and File Type releases are combined.
Available Release Notes for each release are linked in the tables below.
Updates are no longer published for SEG versions 8.2.6 and below, or for MailMarshal 10.0.0 through 10.0.6 Product support for these releases has ended.

MailMarshal (SEG) Supported Versions

Product Version File Type and Unpacker Version

10.0.7 through 11.3.0

2025.04.03
(Filetype DLL version 2025.04.02)
February 24, 2026

Product Version	File Type and Unpacker Version
10.0.7 through 11.3.0	2025.04.03 (Filetype DLL version 2025.04.02) February 24, 2026

MailMarshal (SEG) Older Versions

Product Version File Type and Unpacker Version

8.3.2

2025.02.01
July 7, 2025

8.2.6
10.0.4 through 10.0.6

2024.04.01
December 5, 2024

10.0.3

2024.02.01
May 7, 2024

Product Version	File Type and Unpacker Version
8.3.2	2025.02.01 July 7, 2025
8.2.6 10.0.4 through 10.0.6	2024.04.01 December 5, 2024
10.0.3	2024.02.01 May 7, 2024

Product Version Unpacker Version File Type Version

8.2.0 through 8.2.4
10.0.0 through 10.0.2

2023.03.01
September 26, 2023 2023.03.01
September 26, 2023

8.1.0 through 8.1.3 8.1.11
October 4, 2021 8.1.6
October 4, 2021

8.0.1 through 8.0.7 8.0.10.556
October 20, 2020 8.0.6
October 6, 2020

8.0.0
8.0.0
July 18, 2017 8.0.0
July 18, 2017

7.5.8
7.5.7
7.5.6
7.5.5 2.5.5
February 26, 2019 7.14.6
January 24, 2019

7.5.1 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.5.0 2.3.3
December 1, 2015 7.13.2

7.3.6 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.3.5 2.5.1
October 4, 2017 7.14.0.317
July 20, 2017

7.3.0 2.1.5
May 3, 2015

7.2.3 2.0.8
February 17, 2015

7.2.2 2.0.3
May 16, 2015

7.2.1
7.2.0 2.0.3
January 8, 2014

7.1.2 1.0.0
December 8, 2014

Product Version	Unpacker Version	File Type Version
8.2.0 through 8.2.4 10.0.0 through 10.0.2	2023.03.01 September 26, 2023	2023.03.01 September 26, 2023
8.1.0 through 8.1.3	8.1.11 October 4, 2021	8.1.6 October 4, 2021
8.0.1 through 8.0.7	8.0.10.556 October 20, 2020	8.0.6 October 6, 2020
8.0.0	8.0.0 July 18, 2017	8.0.0 July 18, 2017
7.5.8 7.5.7 7.5.6 7.5.5	2.5.5 February 26, 2019	7.14.6 January 24, 2019
7.5.1	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.5.0	2.3.3 December 1, 2015	7.13.2
7.3.6	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.3.5	2.5.1 October 4, 2017	7.14.0.317 July 20, 2017
7.3.0	2.1.5 May 3, 2015
7.2.3	2.0.8 February 17, 2015
7.2.2	2.0.3 May 16, 2015
7.2.1 7.2.0	2.0.3 January 8, 2014
7.1.2	1.0.0 December 8, 2014

ECM

Product Version Unpacker Version

7.2.0
7.1.7
7.1.6
7.1.5 1.0.5
February 28, 2019

Product Version	Unpacker Version
7.2.0 7.1.7 7.1.6 7.1.5	1.0.5 February 28, 2019

Failed to fetch server details: The server has not been configured yet - required security data not available

Charles — Sun, 22 Feb 2026 20:56:49 GMT

This article applies to:

MailMarshal

Symptoms:

Error seen as "toast" pop-up in Console, and in Console log files.
Failed to fetch server details: The server has not been configured yet - required security data not available
Some parts of the Console do not load.
The Controller service log (configuration check) may also indicate that no valid configuration is available.

Causes:

This error is caused by incomplete loading of configuration in the Array Manager service.
Because configuration is not fully loaded, the MailMarshal REST API is not available to other components including the Console website.
The most common reason for this issue is that a Syslog database is configured but not accessible.

Resolution:

For the Syslog related issue:

Use the MailMarshal Server Tool to verify the configuration and existence of the Syslog database. If necessary update the configuration or create a new database.

Notes:

To check for other possible causes of this error, see the Array Manager text log for a time when the service is restarted.

ACTION REQUIRED: TLS "Client Authentication" usage sunset

Charles — Mon, 16 Feb 2026 22:27:08 GMT

This article applies to:

MailMarshal
TLS validation rules

Background:

TLS Certificates issued by public Certificate Authorities will no longer enable the Extended Key Usage (EKU) "Client Authentication". This is an industry-wide initiative to enhance security.

Most CAs have already stopped including this EKU in certificates by default. Most CAs will fully remove the EKU from all certificates issued after May 1, 2026. For example see this information from Digicert (external link).

To ensure that you can continue to receive email via TLS, you must allow SMTP Client Certificates that do not contain the "Client Authentication" EKU.

MailMarshal Rule Update Required:

MailMarshal TLS Client Certificate rules must be updated to not enforce the requirement "Intention: Client Authentication".
Most MailMarshal versions have a default enabled Connection rule that applies this requirement.
- The rule is "TLS Connection Properties > Reject non-client TLS Certificates"
Customers could also have enforced this condition in a Content Analysis rule.
Disable the default rule and any rules that only contain "Intention: Client Authentication". If you have a rule that checks for multiple conditions, set the "Intention" to "Not Checked".

Notes:

The change to the EKU could also affect outbound connections, if the remote server is enforcing the requirement for the "Client Authentication" EKU.

After updating your server TLS certificate to a certificate that does not contain the EKU, you should monitor mail history for TLS related delivery failures.
If you find your certificate is being rejected, you may need to contact the owner of the remote server.

Additions to Release Notes for MailMarshal 11.3

Charles — Wed, 11 Feb 2026 21:58:30 GMT

This article applies to:

MailMarshal 11.3

Question:

What are the Release Notes for MailMarshal 11.3?

Information:

MailMarshal version 11.3 (11.3.0.7659) was released on December 2, 2025. The Release Notes included with the product are generally accurate as of the date of publication.

This article provides any additional information or corrections generated after that date.

See also article Q21135 for information about Known and Fixed Issues.

For current updates and information, customers should subscribe to the Notifications forum.

SQL Server version requirement

Take note that MailMarshal 11.3 requires SQL 2017 or above, as mentioned in system requirements.

If upgrade is attempted with databases hosted on an earlier SQL version, you may see a credential request early in the installation process (even though correct credentials were entered or not required).
To resolve this issue, upgrade SQL or SQL Express to a supported version such as SQL 2022.

Update from 11.2 with multiple servers

If you have an installation with separate email processing servers and Array Manager:

Ensure you upgrade all processing servers before making any changes to rules.

The configuration written by version 11.3 will be loaded and used by the version 11.2 nodes.

However, any use of the new "is not" options in rule conditions may cause services to stop.

This issue only relates to the new options introduced in 11.3. Rules with the pre-existing "is not" conditions continue to function as before (for example, "file is not of type").

Supported Operating Systems and Prerequisite Versions

Charles Creegan — Tue, 02 Dec 2025 01:43:09 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM		RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is not supported.	SQM works with current versions of Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer may be usable but is not recommended.	MRC works with Edge, and with Firefox and Chrome current versions. Internet Explorer may be usable but is not recommended.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Known issues for Current MailMarshal versions

Charles — Tue, 02 Dec 2025 01:25:15 GMT

This article applies to:

MailMarshal (SEG) 10.X and 11.X

Question:

What are the known issues and limitations for MailMarshal?

Information:

This article highlights differences between major versions of MailMarshal, as well as any known issues and major fixed issues.

SQL version requirement for upgrade to 11.3

SQL 2017 is the minimum version required for successful upgrade to 11.3. SQL 2016 will be blocked by the installer.

Known issue with upgrade to 11.1 or 11.2 using SQL 2014

SQL 2016 is the minimum version required for successful upgrade to 11.1 or 11.2. SQL 2014 is allowed by the installer but the upgrade will not fully succeed. For details and remediation, see article Q21223.

Known issues with the Entra Connector (11.2)

These issues are corrected in release 11.3.

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, connections to Entra will fail. Use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Import of a group can fail if the group "description" is blank or the group has a large number of members. A hotfix is available - contact Support.

Known issues with upgrade from 8.3.2 to 10.2.X

For installations with separate processing nodes, after upgrading a processing node the MailMarshal Controller service will not start.

A new release 10.2.5.7024 has been issued to correct this problem. Customers upgrading from 8.3.2 with node only servers MUST use this new release. See the MailMarshal Previous Version Downloads page.
A workaround is available for systems actually in the problem state. Contact LevelBlue Support.

For installations using Image Analyzer, after upgrade the MailMarshal Engine may stop when processing images.

Check the Config folder on Array Manager for the file "plugins.xml".
Remove the file "plugins.xml" from the Config folder. Then, on each processing node, remove the file from the NodeConfig folder.
This issue only affects upgrades from 8.X to 10.2 (not earlier 10.X releases).

Updates released in MailMarshal 10.2.5:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.5.

The Console now validates moved rules to prevent moving a target rule above a rule that refers to it (circular policy).
Moving or copying rules between Policy Groups is supported.
Policy printing is supported.
Connector user groups selected for some uses did not display in the user interface. This display issue is fixed. Note that LevelBlue recommends using local groups in these settings (Digests, SpamProfiler exclusions, and DHA settings) with the connector groups as members.

Known issues in 10.2.X:

Some customers have reported an issue in release 10.2.5 with the Array Manager service halting at 0100 local time.
- The issue affects installations in non-default locations (such as D drive).
- The source of this issue has been identified and an update has been published through Automatic Updates.
- If your installation cannot receive the automatic updates, you can request this file through a support case.
- Customers are also encouraged to set the service recovery action to restart the Array Manager automatically.

For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal 10.2.0:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.0.

In rare cases, deletion of deeply nested unpacked files could fail.
In version 10.1, in rare cases, child user groups were not correctly loaded on processing nodes.
A new version of the third party SSL library is included. This version addresses performance issues identified in 10.0.7 and 10.1.0
Performance of Image Analyzer has been adjusted. Some scanning issues have been addressed.

Known performance issue in 10.0.7 and 10.1.0

The third party SSL library used in these versions of MailMarshal has been found to use more system resource than earlier releases when under load. It may also initialize more slowly for each connection. In some cases, email throughput can be affected.
A new version of the library is provided in version 10.2.0 and above.

Known issues in 10.1.0:

LevelBlue identified an issue with database insertion in the original release 10.1.0.5089. This issue could affect the display of data in Mail History and the ability to manage processed messages. The issue is resolved in 10.1.0.5102.
- Release 10.1.0.5089 has been withdrawn. Customers must upgrade to the current release 10.1.0.5102.
For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal (SEG) 10.1.0:

The following issues or limitations present in MailMarshal (SEG) 10.0.7 and below have been resolved in version 10.1.0.

"Unsafe legacy renegotiation" can be enabled with a configuration setting. See LevelBlue Knowledgebase article Q21216.
DKIM record status is correctly displayed in the Management Console Local Domains detail.
The installer does not exit without warning after checking for Visual Studio updates.
See Release Notes for additional updates.

Known issues in 10.0.7:

Unsafe legacy renegotiation disabled: The TLS/SSL library included in release 10.0.7 (and above) does not negotiate outbound (sender) TLS connections where the remote server only supports legacy renegotiation of TLS. The risk in legacy renegotiation is described in CVE-2009-3555. Servers that still use this legacy method are very rare. A hotfix is available for customers who have a business need to allow this risk.
The original 10.0.7 release (3969) caused unexpected changes in TLS behavior. This release has been withdrawn from download pages. The currently available release 10.0.7.3979 corrects this issue. Any customers who installed the earlier release should upgrade immediately.
On some systems the installer will exit with no warning after checking for Visual Studio updates. To continue, simply run the installer again.
Restoring a backup created in an earlier version will cause processing services to stop, because the SSL libraries will be overwritten with the earlier and incompatible versions. For more information and resolution steps, see LevelBlue Knowledgebase article Q21209.

Important Known Issues in 10.0.4:

Folder changes cause quarantine problem: If you edit properties of a Folder, the physical path location information is lost. Message files are stored in an incorrect location. Message details and release for earlier quarantined messages do not work.
Folder editing is corrected in later releases. However, any changes made in 10.0.4 are not automatically fixed.
For customers who encounter this issue, a tool is available to detect incorrectly configured folders and move the incorrectly stored files. Contact LevelBlue support.

Updates released in MailMarshal (SEG) 10.0.7:

The following issues or limitations present in MailMarshal (SEG) 10.0.6 and below have been resolved in version 10.0.7.

Node servers can now be deleted from the installation in the Console.
Import of configurations could fail due to an issue with parsing of XML. This issue is corrected.
See Release Notes for additional updates.

Updates released in MailMarshal (SEG) 10.0.6:

The following issues or limitations present in MailMarshal (SEG) 10.0.5 and below have been resolved in version 10.0.6.

Upgraded installations that have custom Relay or Routing tables did not show the correct values in the website editor initially and other settings for a server could not be changed, with error "The Name field is required". This issue is corrected for new upgrades from version 8.X. To resolve the issue manually, select and save the desired settings for these tables.
Connector group members are not preserved in the upgrade from 8.2 to 10.0, or on restore of a configuration backup. Upgrade and restore now initiate an immediate refresh of these groups.
Console folder date issues related to Daylight Saving Time changes have been resolved.

Updates released in earlier releases:

This section highlights significant fixes that are included in releases 10.0.1 through 10.0.5. See release notes for full information.

In release 10.0.4, editing of folder properties caused messages to be stored in an incorrect location.
In release 10.0.4, for Windows authentication users, the "light" theme was not applied when selected.
In release 10.0.4, the rule condition "sender authenticated successfully" was no evaluated as expected.

Installation/Upgrade:

Prerequisite check on nodes now correct handles the case where IIS was previously installed then uninstalled.
The Configuration Service now accepts passwords that contain the characters: ; = '
Upgrade correctly determines the database location if the location was changed.
Validation of group names is improved.
Detection of WebDAV by the installer is corrected.
Issues with folder and history display when installing the Array Manager on non-English Windows distributions are corrected.
The installer detects port conflict issues (most likely where Exchange or another mail server is installed on the same server). For more discussion of steps required when installing on Exchange Server, see LevelBlue Knowledgebase article Q21146.
The installer prompts for an Operational User for the Configuration Service database if required.
Upgrade handles additional cases where rules (including disabled rules) contain references to templates, folders, or other rules that no longer exist or where the reference was malformed.

Policy elements and settings:

The retention setting shown on the Management Console Reporting page is correctly applied.
On upgraded installations, all Connector groups synchronize as scheduled.
Issues with incorrect selection of items in list views are corrected.
Message Templates and Message Stamps will now use the HTML formatting created using the WYSIWYG editor. You can also continue to use the stylesheet method described in Help.
Timezone offsets are correctly applied to all items in the Dashboard.
Unicode characters in subjects are handled correctly.
Folder permissions using Windows accounts are correctly retained.
In 10.0.2, changing Reporting Groups in the Management Console prevented further configuration changes. This issue is fixed.
Re-commit of the current configuration can be requested from the system configuration > General page.
Reporting Groups configuration is present.
- Caution: An issue has been identified in the Reporting Group interface 10.0.2. Upgrade to 10.0.3.
The Variables list on the HTML message stamp editor is corrected.
Rules can be enabled or disabled from the list view.
Entry of service names/keys in Advanced Settings is no longer case sensitive.
When restore takes a long time, the Management Console correctly shows the status.
Automatic backups are performed only if selected.
Maintenance expiry is correctly shown on the License page.
Configuration can be committed as prompted after entering a license key.

Mail View

Raw HTML source of email can be viewed.
Large lists load with acceptable speed.
Selecting an item no longer causes display issues on smaller resolution displays.
Deleting or forwarding from a filtered list selects the correct item.
Sorting is case-insensitive (as in 8.X).
Issues with folder display in certain timezones are corrected.
Filtering on the Message History pages is corrected. Note that filtering applies only to the displayed page, by design. To search over all available items, use Search instead.

Functionality first added in MailMarshal (SEG) 10.0.1:

The following features (present in SEG 8.X but not in 10.0.0) are included in current releases:

Folder physical path setting for individual folders
Folder security for individual folders
Authorization for configuration and email management by Windows accounts
Granular folder access authorization
Configuration commit scheduling

Known Issues in MailMarshal (SEG) 10.0 and above

Installation/Upgrade

Configuration import error
- Configuration import will fail if services are not listening on the default IP and port. To import manually (using MMExportCFG), use the -a and -c parameters to set the correct server and port information.
Database Collation:
- The MailMarshal databases MUST use a Case Insensitive collation. Installation of SQL sets collation based on the server locale. Most locales use Case Insensitive collation. If in doubt set the database collations to the default SQL_Latin1_General_CP1_CI_AS. Note that the collation MUST NOT be Turkish_CI_AS due to special treatment of the letter "i" in Turkish.
Azure Databases:
- The Installer and Server Tool cannot currently create Azure SQL managed instance databases. SEG can use Azure databases if they are created in advance.
Upgrade - TLS 1.3 and Elliptic Curves:
- LevelBlue previously suggested use of the secp521r1 Elliptic Curve for key exchange. Customers should be aware that if this is the only curve enabled, email delivery from Gmail may not succeed. This change is due to TLS1.3 behaviors and Google's decision not to use the secp521r1 curve.
- The X25519 curve is widely used and this is the default in both SEG 8.2 and MailMarshal (SEG) 10.0 and above.
- To check settings see the Inbound Security - TLS page for each mail server.
Array Join credentials:
- Adding an "Array Join" credential in the SEG Server Tool (used to join a processing server to an array) requires a restart of the Array Manager. The tool does not prompt you for this restart.

Policy Elements and Settings

Configuration restore:
- A restored configuration is committed with no confirmation or possibility of review in some cases.
- Restoring a configuration from a previous version that has rules referencing SpamZeroDay.xml and KnownThreats.xml causes the Engine to stop. (The upgrade process blocks upgrade of these configurations, but restore does not.)
- Restoring a configuration fails if any local MailMarshal user group name contains a fullstop character ( . ) . The error reported in logs may not identify the specific group. Older MailMarshal versions did not validate names. Upgrade validation does not allow these characters when upgrading from 8.X to versions 10.0.4 thorugh 10.2.5.
Configuration backup:
- The retention setting applies to manual as well as automatic backups, since the files are created in the same location. To save manual backups, copy them to another location.
- Backups and restores do not include DKIM keys unless a password is explicitly entered either as default or as override. No warning about missing passwords or unsaved keys is provided.
- A custom backup location set in SEG 8.X will apply in MailMarshal (SEG) 10.0 and above. This setting currently cannot be edited in the new versions.
Licensing:
- Blended Threat licensing status is not shown on the License page.
- Maintenance expiry shows today's date if the key cannot be validated through the LevelBlue website (it should display "unknown").
- Reminders about license status (seen in earlier versions) are not provided when you enter a new key.
- Entering a key that has a Marshal RBL credential forces configuration commit with no notice.
- Upgrading with an expired key results in no key being displayed on the License page. This behavior will not be changed.
Mail Server settings:
- If custom settings have been configured, reverting to the default settings and saving does not update the display in the console. The settings have actually been updated correctly.
Policy Elements:
- Dead Letter folders are not configurable in the Folders list.
Rules
- Enabling default virus scanner rules does not validate that a scanner is present and working.
Users
- Setting a user to "blocked" or "deleted" is only effective after a restart of the Management Console website.

Mail View

Message History:
- The default view of message history only shows items from "today". To see all items, use Search. The default should be to return all items up to the configured row count.

API

Some REST API calls listed in the automatically generated "handler listing" are not available. This includes TextCensor addition, edit, and deletion

Limitations in MailMarshal (SEG) 10.0 and above

The following functionality that was present in previous versions is not currently available in 10.0 and above.

Finding items in User Groups and IP Groups
Restore from Mail Recycle Bin (this does not affect retention of messages)
RSS news feeds
- Alternative: subscribe to the Notifications forum on the LevelBlue support site

Retired Features

The DMARC Dashboard has been retired. Customers must use third party services for this functionality.

The "Do not log to SQL" option when deleting a message is not available in this version of MailMarshal.

Restarting Processing Services for one node at a time

Charles — Tue, 02 Dec 2025 00:51:15 GMT

This article applies to:

MailMarshal 11.3 and above

Question:

How can I keep at least one node running when service restart is required?

Background:

Some changes to MailMarshal configuration require restart of the processing services. This includes some automatic updates that may occur with no user input.

By default all nodes update the running configuration, including service restarts, as soon as the new configuration is received.

For installations with more than one processing node server, it is possible to make the restart happen for only one node at a time.

Procedure:

To enable restart management, in the Management Console add the following Advanced Setting:

Name: RestartOneNodeAtATime
- Type: Boolean
- Value: True (selected) to enable the feature.

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

Charles Creegan — Tue, 02 Dec 2025 00:47:16 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal Secure Email Server/MailMarshal SES

Question:

What versions of MailMarshal (SEG) are currently supported by LevelBlue Technical Support?
What versions of MailMarshal ECM/MailMarshal Exchange are currently supported by LevelBlue Technical Support?
What versions of MailMarshal Secure Email Server are currently supported by LevelBlue Technical Support?

Information:

Important: End of Support and End of Threat Protection dates for many earlier versions have now passed.

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For versions that have passed the end of support, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

Versions out of support do not receive component updates such as file type and unpacking updates.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Automatic updates to LevelBlue threat protection technologies for SEG (such as SpamCensor, Known Threats, YAE scripts) may be provided to some versions that are out of support. The table below lists this date separately.

All versions earlier than those listed are out of support and do not receive threat protection updates.

This includes MailMarshal 8.0.X and 8.1.X.

MailMarshal (SEG)

Software Version

Release Date
Support Status
End of Support

End of Threat
Protection Updates

11.3.0.7659 December 2, 2025 Active

11.2.0.7413 September 4, 2025 Active

11.1.0.6958 May 29, 2025 Active

10.2.5.7024 June 5, 2025 Active

10.2.5.6043 September 10. 2024 Active

10.2.0.5718 July 2, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5102 April 3, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5089 March 28, 2024 Withdrawn April 3, 2024

10.0.7.3979 September 29, 2023 Active June 1, 2026   June 1, 2026

10.0.7.3969

September 12, 2023

Withdrawn

September 29, 2023

10.0.6.3739

February 28, 2023
Discontinued February 1, 2025 June 1, 2025

10.0.5.3470

August 31, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.4.3361

May 16, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.3.2387

July 6, 2021
Discontinued
February 1, 2024
December 31, 2024

10.0.2.2230

April 28, 2021

Deprecated

July 6, 2021
December 31, 2024

10.0.1.2030

November 3, 2020
Discontinued
September 1, 2022
December 31, 2024

10.0.0.1428

April 14, 2020

Deprecated

November 3, 2020
December 31, 2024

8.3.2.11492 September 29, 2023 Active August 1, 2025 December 31, 2025

8.2.6.11305

December 22, 2020
Discontinued February 1, 2025 June 1, 2025

8.2.4.11170

October 31, 2019
Discontinued
March 31, 2022
December 31, 2024

8.2.3.11111

July 2, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.2.11949

February 14, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.1.11863

December 14, 2018
Discontinued
March 31, 2021
December 31, 2024

8.2.0.11849

December 6, 2018

Withdrawn

December 14, 2018
December 31, 2024

MailMarshal ECM (formerly MailMarshal Exchange)

Software Version

Release Date
Support Status
Discontinued Date

7.2.0.9773

March 7, 2017

Active

7.1.7.7380

January 12, 2015
Discontinued
February 1, 2019

MailMarshal Secure Email Server (SES)

Software Version

Release Date
Support Status
Discontinued Date

5.8.1.398

July 24, 2017
By special arrangement only

5.8.0.361

May 30, 2016
By special arrangement only

5.7.2.9723

May 1, 2013

December 31, 2012

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

Configuring MailMarshal (SEG) with Exchange 2019/SE or 2016 as internal mail server

Charles — Sun, 19 Oct 2025 18:58:15 GMT

This article applies to:

MailMarshal (SEG)
- Note for MailMarshal (SEG) 10.0 and above additional steps are required for same-server installation and some restrictions may apply
Microsoft Exchange Server 2019, 2016, 2013 and "Subscription Edition"
- For Exchange Online, see the document "Using MailMarshal with Exchage Online", available on the MailMarshal documentation page.

Question:

How to configure MailMarshal (SEG) to forward mail to Microsoft Exchange Server
How to configure Microsoft Exchange Server to forward and receive email from MailMarshal (SEG)

Procedure:

To configure MailMarshal as gateway with Microsoft Exchange Server (current versions) as the internal email server, follow the steps in this article.

MailMarshal (SEG) 8.X interfaces differ, but the information required is the same.

Please read through and understand the details, particularly about port assignments, before starting.

NOTES:

It is possible to install MailMarshal with Exchange Server on the same machine and this article covers this scenario. However, you should carefully consider the resources required for same-server installation.

For installations of significant size, LevelBlue recommends you install MailMarshal separately. This article also covers installation of MailMarshal on a separate machine with email flow between the servers.

The MailMarshal Array Manager includes a default HTTPS website that conflicts with Exchange. To install MailMarshal on the same server as Exchange you must change the binding of the MailMarshal Management Console. The Exchange ECP and OWA websites will not run until you make this change. Current MailMarshal installers detect conflicts and prompt you to select a different port.

For additional steps to allow the co-existence of MailMarshal and Exchange websites, see article Q12671.

Port 25 assignment: When installing MailMarshal and Exchange server on the same computer, you will most likely find that both attempt to use port 25 for SMTP email. Generally you should allow MailMarshal to use this port (to accept email from external locations) and configure Exchange to use another port. Port 97 is usually available for this purpose.

Exchange connectors by default use TLS. To learn about configuring TLS in MailMarshal, see article Q11636.

This article describes the simplest un-authenticated configuration for incoming email. Many other security options are available.

For example, you may want to limit access by IP address, and/or use Basic authentication over TLS to control access.

Two procedures are given for configuring MailMarshal delivery. The first is for the configuration of MailMarshal if it has not already been installed. The second can be used to change the settings after MailMarshal is already installed.

Configuring MailMarshal Delivery During Initial Installation

In the Configuration Wizard, on the Delivery window Specify the Server... field, enter the IP Address or Server Name and the Port of your Microsoft Exchange Server.
- If Exchange and MailMarshal are on the same server, be sure to configure and use a unique port for Exchange, as mentioned above.
Select Deliver external email using DNS resolution. See below.

Configuring MailMarshal Delivery After Installation:

In the Management Console, expand System Configuration > Array Properties and select Routes.
Edit the Default Routing Table.
Edit the Local Domain you would like to forward to Microsoft Exchange Server.
On the Domain Routing window double click the IP Address you are currently using to route mail.
On the Route Entry Properties window, change the IP address to the IP Address of your Microsoft Exchange Server installation.
On the Advanced tab of Route Entry Properties, make any changes to the Port and Priority for the route. For more information see Help.
- If Exchange and MailMarshal are on the same server, be sure to configure and use a unique port for Exchange. See the section about configuring Exchange below.
You can also configure MailMarshal to make authenticated connections to Exchange. See the Authentication tab of Route Entry Properties. Details are beyond the scope of this article.
Save the changes and commit the configuration.

Configuring MailMarshal Relaying Permissions:

In most cases the above steps will also allow Exchange Server to relay outgoing email through MailMarshal. However, if you find that relaying from the Exchange Server is denied by MailMarshal, you can allow relaying using the following steps:

In the Management Console, expand System Configuration > Array Properties, and select Relaying.
Edit the Default Relay Table.
Add an entry with the IP Address of the Microsoft Exchange Server you want to allow to forward email to SEG.
Save the changes and commit the configuration.

Configuring Exchange Server

Follow the steps below to configure Microsoft Exchange Server to receive email from MailMarshal:

In the Exchange Admin Center website, select mail flow from the left menu, and then select receive connectors from the top menu.
From the Select server menu, select the server you want to use to receive incoming mail from MailMarshal.
You may be able to use an existing receive connector such as the "Default Frontend" connector, or you may need to create a new connector.
- If you want to use an existing connector, double-click to edit it, and verify the network and permission settings are as described below.
- If you want to create a new connector, click + to create a new receive connector.
Enter a Name for the connector.
Select Role: Frontend Transport
Select Type: Internet
- Note: This setting enables connections from all locations. If you want to limit connections by IP address, after creating the connector edit the setting on the Scoping tab.
On the Network adapter bindings window, ensure the IP addresses field includes All Available IPv4. (You can also use IPv6 with current MailMarshal versions.)
For the Port:
- If Exchange and MailMarshal are on the same server, DO NOT use port 25. Instead, edit the line and select an unused port. Port 97 is often available.
- If Exchange and MailMarshal are on separate servers, generally you should use port 25.
Click Finish.
Verify anonymous access:
- Double click the name of the new connector.
- On the Security tab, ensure the Anonymous users box is checked. Click Save.
- You can also enable or require authenticated connections from MailMarshal with other options on the Security tab. Details are beyond the scope of this article.

Follow the steps below to forward mail from Microsoft Exchange Server to MailMarshal:

In the Exchange Admin Center website, select mail flow from the left menu, and then select send connectors from the top menu.
Click + to create a new send connector.
- A Send Connector may already be configured. If you want to use the existing connector, verify the network and security settings as described below.
Enter a Name for the connector and select Custom from the menu. Click Next.
On the Network Settings window, select Route mail through the following smart hosts. Click Add and enter the IP Address where MailMarshal accepts email. Click Save and then Next.
- For array installations, use the address of an email processing node or the external IP of a load balancer; for single servers, the address of the server.
Select an authentication method, or "none" if you do not want to require authentication. All current MailMarshal versions support Basic authentication and Basic over TLS.
- Before enabling authentication here, ensure you have set up the required account (and TLS if desired) in MailMarshal.
On the Address space window, click + to add an address space. In the FQDN field, enter * to signify all domains. Click OK and then click Next.
On the Source server window, click + to add one or more servers. Generally add all Mailbox servers in the Exchange installation. Click OK and then click Next.
Click Finish to create the connector.

What file types are recognized by MailMarshal (SEG) and ECM?

Charles — Wed, 15 Oct 2025 21:35:34 GMT

This article applies to:

MailMarshal (SEG) current versions
MailMarshal ECM/MailMarshal Exchange 5.2 and above

Question:

What file types are recognized by MailMarshal (SEG)?
What file types are recognized by MailMarshal ECM 5.2 and above?

Information:

The following formats are recognized by current MailMarshal (SEG) and ECM versions.

Notes:

Some types are recognized only with current product versions, as noted. Items marked "Current SEG" were added before 2023. These items are not recognized by ECM.
Additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each MailMarshal version, see article Q20446.
- File Type updates are distributed through the MailMarshal Automatic Updates to installations with current maintenance.
Items recognized with a specific MailMarshal/SEG or FileType update are not recognized in MailMarshal Exchange/ECM.

In the tables below, Type Name refers to the name seen in the Engine log and rule listings. Description is the name as seen when selecting types in the email policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by MailMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (Current SEG)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA (Current SEG)
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file (Current SEG)
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive (Current SEG)
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File (Current SEG)
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (Current SEG)
PBIX	Power BI Report (FileType 2024-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file (Current SEG)
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (Current SEG)
UUE	UUencoded Encoding
XZ	XZ archive (Current SEG)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items in MailMarshal/SEG 8.2.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document (Current SEG)
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLS	Excel document
XLSIRM	Excel document with IRM (Current SEG)
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB (Current SEG)
ONE	Microsoft OneNote (Current SEG)
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (Current SEG)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form (Current SEG)
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (Current SEG; see Q16666)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM (Current SEG)
PPTIRM	PowerPoint document with IRM (Current SEG)
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM (Current SEG)
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM (Current SEG)
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document (Current SEG)

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB (Current SEG)
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX (Current SEG - see note)
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (Current SEG)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (Current SEG)
STL	StereoLithography Drawing (Current SEG)

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (Current SEG)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data (Current SEG)
Switch	Egress Switch Encrypted Mail (Current SEG)
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLSIRM	Excel document with IRM (Current SEG)
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (Current SEG)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (Current SEG)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM (Current SEG)
PPTIRM	Powerpoint document with IRM (Current SEG)
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM (Current SEG)
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail (Current SEG)

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (Current SEG)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (Current SEG)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font (Current SEG)
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format (Current SEG)
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF) (Current SEG)

Image

Type Name	Description
PSD	Adobe Photoshop Image
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (Current SEG)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image (Current SEG)
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (Current SEG)
TIF	Tiff image
WEBP	WebP Image File (Current SEG)
HDPHOTO	Windows HD Photo (Current SEG)
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar) (Current SEG)
ICSDescription	Calendar Meeting Invitation Description (Current SEG)
ICSSummary	Calendar Meeting Invitation Summary (Current SEG)
TPS	Clarion TopSpeed File .TPS (Current SEG)
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF (Current SEG)
DBT	dBase Memo Field File (Current SEG)
MDXdbase	dBase Multiple Index File (Current SEG)
SYS	DOS device driver (Current SEG)
VCF	Electronic Business Card .VCF (Current SEG)
ICM	Independent Color Matching .ICM (Current SEG)
InfoSlip	Infoslips document (Current SEG)
JOS	Java Object Serialized Data (Current SEG)
DSStore	Mac OSX Finder Info (Current SEG)
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (Current SEG)
PDB	Microsoft Debugging Symbols (Current SEG)
LIB	Microsoft Program Library (Current SEG)
MSBLDCACHE	MS Build Cache File (Current SEG)
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File (Current SEG)
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture (Current SEG)
PCAPNG	Packet Capture NG (Current SEG)
PEMCert	PEM encoded certificate .PEM (Current SEG - see note)
PFX	PFX Certificate Archive (Current SEG)
PGPPublicKey	PGP Public Key (Current SEG)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (Current SEG)
PBIXMetadata	Power BI Data Metadata (Current SEG)
PBIXModel	Power BI Data Model (Current SEG)
PBIXBindings	Power BI Security Bindings (Current SEG)
PBIXSettings	Power BI Settings (FileType 2024-02-01 and above)
QBB	QuickBooks Backup .QBB (Current SEG)
QBW	QuickBooks Company file .QBW (Current SEG)
RTF Object	RTF Object
SHP	Shape file (.SHP) (Current SEG)
SHX	Shape Index file (.SHX) (Current SEG)
P7S	SMime Signed Data
SQLiteDB	SQLite Database (Current SEG)
EMC	Striata Encrypted Mail Communication (Current SEG)
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (Current SEG)
VSSSCC	Visual Source Safe Source Code Control (Current SEG)
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (Current SEG)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF (Current SEG)
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX (Current SEG)
XML	XML Document (Current SEG)

Sound

Type Name	Description
AAC	AAC audio
FLSA	Adobe Flash Audio (Current SEG)
AU	AU sound file
ENC	Encore Music Notation .ENC (Current SEG)
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video (Current SEG)
FLSV	Adobe Flash Video (Current SEG)
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (Current SEG)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (Current SEG)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (Current SEG)
WEBP	WebP Image File (Current SEG)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by MailMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

Word, Excel, and PowerPoint "2007" or "2007+" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
LevelBlue Knowledgebase articles for information about earlier versions have been withdrawn.

This article was previously published as:: NETIQKB40962

Creating an Application Registration for Entra ID

Charles — Tue, 14 Oct 2025 01:34:26 GMT

This article applies to:

MailMarshal 11.2 and above
MailMarshal SPE 4.4 and above
Entra ID Group Import

Question:

How do I register an application in Azure/Entra to allow group import to MailMarshal?
What are the options and requirements for use of imported Entra groups?

Background:

MailMarshal allows you to retrieve user group information directly from Microsoft Entra ID (formerly known as Azure Active Directory). To connect, you must create an "application" in Entra.

You will enter the Client ID, Tenant ID, and Secret from Entra in the MailMarshal Management Console or the MailMarshal SPE Customer Console

Procedure:

Note common missed items in this procedure:

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Be sure you grant Application permissions (not "delegated")
Be sure to grant admin consent

Log in to the Microsoft Entra Admin Center (entra.microsoft.com). The minimum required permission is "Cloud Application Administrator"
If you have access to more than one tenant, use the Settings menu (gear icon in the top bar) to switch to the specific tenant.
From the left menu browse to Identity > Applications > App registrations. Click New registration.
Enter a name.
For "supported account types" accept the default (single tenant).
Click Register.
From the overview page of the application, note the following values:
- Application (client) ID
- Directory (tenant) ID
From the API Permissions page of the application, grant the following Microsoft Graph permissions (Application permissions):
- Group.Read.All
- Member.Read.Hidden
- OrgContact.Read.All
- User.Read.All
After updating the above permissions, click Grant admin consent (above the list of permissions)
From the Certificates & Secrets page of the application, create a new client secret. Note the value (it is only available immediately after creation).

Use the Client ID, Tenant ID, and client secret on the Entra Properties tab of the Connector page in the MailMarshal Management Console, or the Entra Connector Properties page in the SPE Customer Console.

Group usage:

After creating the connector you can select groups to import using the Import Connector Group or Import Entra Groups button on the User Groups page.

Groups are populated immediately. Group membership is queried and updated hourly.

Reply to message release email fails to release the message

Charles — Tue, 14 Oct 2025 00:50:21 GMT

This article applies to:

MailMarshal (SEG)

Problem:

Sometimes when users immediately reply to a message release email, the reply fails to release the held email.
If they try again or wait a minute before replying to the message release email then it succeeds and releases the email.

Cause:

The original email record is not yet inserted to the database when the user reply is received and processed.
- Database record insertion is batched for efficiency, and may be delayed a few minutes.
- Each release request is processed instantly.

Workaround:

User education may be sufficient to resolve any complaints about this issue.
In current versions of MailMarshal, it is possible to delay the processing of the user release request. This can be done by adding a rule that uses the Hold action, above the "User Message Release" rule.
- Note that this delay will apply to ALL release requests and could cause equal or greater user confusion. Use the minimum possible delay.
The new rule can be named "Delay User Message Release" and it should look similar to the screenshot below.
Place the rule immediately above the existing rule that processes Message Release requests.
Remember to use the "addressed to" address that is used to submit your message release requests.

Excluding some users from digest notifications

Charles — Tue, 14 Oct 2025 00:42:20 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

How do you exclude addresses or users from digest notifications?

Procedure:

You can stop digest notifications for some users or email addresses, for each folder that is included in a MailMarshal digest.

In the Configurator or Management Console, expand Policy Elements.
In User Groups, create a new MailMarshal User Group with a descriptive name such as Exclude from Digest.
- Add to this group any email addresses that you don’t want to get the digest notification.
In Message Digests, view the properties of a specific digest.
1. Select the folders tab.
2. Select a particular folder and click Edit User Groups.
3. In the list of available groups, select the User Group created in the previous step and add it to the Excluded user groups list.
  - Note: If the Included user groups list is blank, the digest is sent to all users except the users in excluded groups.
4. Save the digest properties.
Commit configuration.

Any email address added to the group will not receive notifications. You can manage exclusions separately for each folder in each digest.

Note:

The advanced properties of a digest, such as the group functions, are not configurable when the digest is first created. These features are available when editing an existing digest.

SQM or Customer Console "Remember Me" not working

Charles — Tue, 14 Oct 2025 00:32:28 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Spam/Quarantine Management website

MailMarshal SPE Customer Console and SQM (4.2 and below)
Forms authentication
This article does not apply to the MailMarshal Management Console (10.X and above) or SPE 4.3.5 and above

Symptoms:

Remember Me is selected on the site login page
User credentials are only remembered for a short time of inactivity. Users are asked to enter credentials after about 20 minutes.
With SPE, the "Default Session Timeout" setting in the Admin Console cannot be used to extend the Customer Console timeout to more than 20 minutes.

Causes:

The Remember Me function uses ASP.NET authentication cookies. By default the cookies time out after 20 or 30 minutes, depending on the version of ASP.NET originally installed.
LevelBlue recommends you maintain the default timeout for security reasons.

Resolution:

To extend the timeout, change the forms authentication configuration settings for the affected web sites or virtual directories.

Notes:

If you have more than one SQM web server or SPE Customer Console server, you must perform these steps on each web server.
For SPE, you must configure the SQM virtual directory as well as the Customer Console site. The site setting is not inherited by the SQM directory/application.

On the web server, open IIS Manager.
Navigate to the properties of the virtual directory or website you want to configure.
- For SEG SQM, by default, this is Default Web Site/SpamConsole
- For ECM quarantine management, by default, this is MailMarshal Exchange Web Components/QuarantineConsole
- For SPE Customer Console, by default, this is the website Customer Console
- For SPE SQM, by default, this is Customer Console/SQM
In the IIS section, double-click Authentication.
On the Authentication page, select Forms Authentication and then click Edit (from the right pane Actions list).
On the Forms Authentication Settings window, set the authentication cookie time-out to a longer value (in minutes). Ensure that Extend cookie expiration is checked.
Click OK.
When you have changed all required settings, exit IIS manager.
For SPE, remember to change the "Default Session Timeout" setting in the Admin Console.

Notes:

This problem does not affect Windows authentication.

Why are message digests incorrectly being delivered to external addresses?

Charles — Tue, 14 Oct 2025 00:22:13 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

Why are message digests for spam being delivered to external addresses?

Information:

This problem can occurs when MailMarshal or ECM folders and rules are not correctly configured.

By default, digests are sent to the message recipient (unless you specify "send all digests to a single recipient"). If a folder contains both "inbound" and "outbound" messages (both messages with internal recipients, and messages with external recipients), then some digests could be sent to external addresses.

Curent versions of MailMarshal allow you to configure digests of outgoing mail, sent to the internal sender.

Procedure:

To ensure that message digests are only sent to internal email addresses, ensure that any folders that will be digested for the recipients contain only incoming messages. Rules that quarantine outbound messages should use other folders.

If you want to notify internal senders about blocked outgoing email, use a "notification message" rule action.

Self-Management option:

You can include folders with outbound messages in the folders visible through the Spam Quarantine Management website. For each folder that you want to include, edit the folder properties and choose "Enable end-user management for this folder."

For rules that apply to incoming messages, always use a folder that has the setting Folder is used to manage messages addressed to a user (or inbound messages).
For rules that apply to outgoing messages, always use a folder that has the setting Folder is used to manage messages addressed from a user (or outbound messages).

If you want to apply the same criteria to both inbound and outbound messages, use two rules and two folders.

Notes:

MailMarshal and ECM default rules are correctly configured and do not send message digests to external addresses. To send external digests in current versions of MailMarshal, you must create a new digest that applies to the appropriate folders.
Current versions of SEG/MailMarshal, and ECM/MailMarshal Exchange 7.X, allow you to select user groups when digesting, which provides additional flexibility.

What are some examples of creating header re-write rules?

Charles — Tue, 14 Oct 2025 00:11:45 GMT

This article applies to:

MailMarshal (SEG)

Question:

What are some examples of creating header re-write rules?

Information:

These examples have been compiled to assist with the creation of header re-write rules. They can be used as is or modified to suit, depending on individual needs.

Caution! Header Re-Write rules are extremely powerful. Test any rules thoroughly, as errors can cause all affected messages to be undeliverable.

For full documentation on the Regular Expression syntax see Knowledge Base article Q10520. Additional information is available in the User Guide.

User interfaces differ slightly in newer releases of MailMarshal, but the functionality described is identical.

Variables:

MailMarshal variables can be used in the substitution string. For example, you can insert the sender email address by using the variable {sender}

This function provides a limited ability to rewrite one header field based on the content of another field, particularly when used with map files. See the "Sender based routing" example below.

Re-write the domain information:

Select fields to match against: "Received"
Select "Entire Line" as the Field Parsing method

This rule will re-write

from test.marshalsoftware01.co.nz (not verified[172.28.1.1]) by marshalsoftware02.co.nz
to
from marshalsoftware01.co.nz (not verified[172.28.1.1]) by marshalsoftware02.co.nz

Re-write or delete the IP information:

Select the fields to match against: "Received"
Select the Field Parsing method "Entire Line"

This rule will re-write

from test.marshalsoftware01.co.nz (not verified[172.28.1.1]) by marshalsoftware02.co.nz
to
from test.marshalsoftware01.co.nz (not verified[127.0.0.1]) by marshalsoftware02.co.nz

Rewrite 'extra' to 'xtra':

(A common typographical or autocorrect error when entering this domain name)

Select the fields to match against: "Envelope Recipient" and "To"
Select Filed Parsing Method: "Email Address"

Rewrite Domain Literal Addresses:

"I believe the e-mail address (admin@[x.x.x.x] - where x.x.x.x is the IP address associated with the domain) is RFC compliant, but it is rejected by MailMarshal as being invalid."

Select the fields to match against: 'Envelope Recipient' and 'To'.
Select 'Entire Line' as the Field Parsing Method.

Usage of the MAP file option:

Mapping using a file allows a level of indirection in resolving what to substitute into the field. A map file must be plain text; each line of the file must contain a key and value pair separated by a comma. For example:

john@domain.co.uk,john@domain2.co.uk
peter@domain.co.uk,peter@host1.domain.co.uk

The first entry in the line is a lookup key. The second value is the result to be substituted in place of the original field when the key is matched (e.g. for a search expression of $1@domain.co.uk would, for the input string john@domain.co.uk, return john@domain2.co.uk). If the key value is not found in the map file then it is returned unchanged as the result.

If you enter a relative path in the filename field, MailMarshal evaluates the path relative to the install directory. LevelBlue recommends a relative path such as NodeConfig\theMapFile.txt

Note: When you first create the file you must manually place a copy in both the NodeConfig directory and the Config directory within the MailMarshal installation on the Array Manager. The Configurator interface checks the NodeConfig directory for the presence of the file and uses this location for testing, but replication to processing nodes uses the Config directory. To make changes, normally edit only the file in the Config directory.
If the Array Manager does not include processing services you must manually create the NodeConfig directory and in this case to test changes you must update the copy in that location manually.

Append the domain to a badly formatted email address:

Field substitution allows you to substitute into a matched field using a sed or perl-like syntax.

Select the fields to match against: 'Envelope return path'
Select Field parsing method: 'Entire Line'

The rule will re-write <username> to <username@example.com>

Sender based routing with variables and MAP file:

It is possible to route a message based on the sender, using two rules, variables and a map file. This is an advanced usage and the specific requirements will vary.

In the first rule, rewrite the Envelope Recipient (and the visible To: if desired), and set the value using the {Sender} variable
- For example use Substitute expression: {Sender}.rewrite.local
In the second rule, use a map file to rewrite the fields again and set the actual desired recipient based on the temporary value
- Search expression: (.*)\.rewrite\.local
- Map using file with lookup key $1

This article was previously published as:: NETIQKB29651; Marshal KB340

How do I delete an entire folder from the MailMarshal Console?

Charles — Mon, 13 Oct 2025 23:43:58 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I delete an entire folder from the MailMarshal Console or quarantine?

Procedure:

Sometimes there is a desire to purge an entire folder from the MailMarshal quarantine. Only mail messages can be deleted in Message History. Folders cannot be deleted in this way.

To remove a top level quarantine or archive folder from MailMarshal:

In version 10.0 and above, in the Management Console navigate to Policy Elements > Folders (note, NOT Management > Folders).
In version 8.X, use the Configurator navigate to Policy Elements > Folders.
To remove a folder select the folder from the list and delete it.

Note: If a folder is used in any Rules or Reporting Groups you cannot delete it. You might see a message like the following:

If you are sure you want to remove the folder, remove it from any rules that use it (see the Email Policy section of the Configurator or Management Console). Also remove it from any Reporting Groups (Classification Groups), found in advance system properties:

10.0 and above: System Configuration > Advanced System Properties > Reporting Groups

8.X: MailMarshal SEG Properties > Advanced System Properties > Reporting Groups

Note:

MailMarshal mail folders and message files correspond to actual Windows folders and files, and it is possible to manipulate the folders directly with Windows Explorer. The folder structure is stored, by default, in the Quarantine subfolder.
However, using the file system to remove quarantined e-mails or folders is HIGHLY DISCOURAGED. Data about messages and folders is synchronized in the database. Manually altering files will falsify the data shown in the Console. Therefore all e-mail and folder deletions should be done through the user interfaces only.
In version 10.0 and above, information about deleted folders is retained in the database to preserve auditability, and basic information about the deleted folders can be viewed in the Console.

This article was previously published as:: NETIQKB33822

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles Creegan — Mon, 13 Oct 2025 01:44:36 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about installed software and configuration. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal,ECM, or WebMarshal).

Otherwise, download the support tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool (1.14 and above) is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, downloaad or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool appears as shown below. The fields and selections differ depending on the installed software.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click GO to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

System Information

Includes a listing of the system hardware and operating system information.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

For MailMarshal, optionally select Include Quarantine directory listing to list all messages in quarantine and archive (only if required, as the file will be much larger and take longer to generate)

Event logs

Includes Windows Event Log information. If you include the event logs, choose to include Application and/or System logs by checking the boxes.

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a MailMarshal processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.
Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Version: The installed version of the Support tool.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.

Messages with Office Document attachments trigger "double extension" rule

Charles — Mon, 13 Oct 2025 00:47:53 GMT

This article applies to:

MailMarshal (SEG)
Current updates to file unpacking

Symptoms:

Email containing Microsoft Office documents is blocked by the default "double extension" rule

Causes:

Current versions of the MailMarshal file unpacker extract certain files from Microsoft Office docs with names that trigger this rule.
Due to the evolution of malware in Microsoft Office documents, LevelBlue believes it is important to present all extracted contents from these documents to the various layers of protection in MailMarshal.
Default rules in new installations of current versions of MailMarshal include the "double extension" rule, but it is disabled by default.

Resolution:

To avoid the rule triggering on Office documents, you can exclude the child files extracted from these documents from the double extension check.

Within the double extension rule, add a condition Where attachment parent is of type…
Select "Where parent container is not of type:"
Select any problem parent types such as Excel 2007+ or Word 2007+ document.
The rule description will then appear similar to the following:

When a message arrives
Where message is incoming
Where message contains attachments named '*.??.??' or '*.??.???' or '*.??.????' or '*.???.??' or '*.???.???' or '*.???.????'
And where attachment parent is not of type: 'DOCX' or 'XLSX'
Send a 'File Extension in' notification message
And move the message to 'Suspect' with release action "continue processing"
Remember to commit configuration.

Notes:

The "double extensions" check is designed to block files that try to hide their type from Windows users. Although this check can be valuable, it is also prone to false positives. Legitimate files can be named with multiple dots (for example a log file could be named application.jun25.log)

Rewriting email bodies with External Commands

Charles — Mon, 13 Oct 2025 00:41:09 GMT

This article applies to:

MailMarshal (SEG)

Question:

Can MailMarshal modify the email message body?
How can I remove active links or other material from an email message?

Reply:

MailMarshal does not provide a dedicated rule action to edit email message bodies. You can use an External Command to make changes.

Be aware that External Commands run slowly compared to other rule actions, because they require an external program to load for each usage.

You can minimize use of the external commands by identifying the bodies that require rewriting using TextCensor scripts or other rule conditions.
If you plan to use External Commands for a large number of items, carefully monitor email throughput.

You can use any executable that runs from the command line and accepts an absolute path for the file to be processed. To avoid unnecessary repacking of email messages, the executable should return different numeric exit codes for "change made" or "no change made".

The example in this article uses a simple open source text replacement tool, "Find And Replace Text" (FART). See the Related Links section below for download and documentation.

For a Regular Expression option see the Notes at the end of the article.

This article assumes familiarity with the SEG configuration interface.

The ideas and scripts in this article have been reviewed for accuracy. External executables and scripts are not covered by LevelBlue support. Customers use these items at their own discretion.

Procedure:

To set up a rule for text replacement:

Create an External Command (Policy Elements > External Commands)
- Command Path: Enter the tool location. The tool must exist in this location on all processing servers.
- Parameters:
  - -i indicates case insensitive
  - Use "{CmdfileName}" (including quotes) to refer to the file to be processed. SEG will update this variable with the file location.
  - The next two parameters are the string to find and the replacement. In the example, the URL http://microsoft.com is replaced with a space. (If you enter an empty string "" FART will not do any replacement.)
  - When choosing what to find and replace, be aware that the script will apply to HTML and plain text email bodies. HTML tags are part of the text. A Regular Expression search might be useful to ignore tags (see Notes below).
- Single Thread must be selected.
- Only execute once should NOT be selected. A message can have more than one body part.
- Set Command is triggered to >0 and Command is not triggered to <1
- Save the command.
Create a rule to apply the command
- Choose Message attachment type Mail Body (MBODY) to apply the command only to message body parts.
- Choose Run the external command and select the command you created. Be sure that Repack the message is selected.

Enable and save the rule, and test. The Content Analysis log will be similar to the below:

04532 13:34:33.083 001 Requesting Action <Content:Policy Management (Inbound):Text Replace:Text Replace,repack> be run04532 13:34:33.090 001 TRIGGERED command <"c:\tools\fart.exe" -i "C:\Program Files\Trustwave\Secure Email Gateway\Unpacking\T1\U2\Plain.txt" "http://www.microsoft.com" "">.  
                            Result= 1 after 7 millisecs04532 13:34:33.090 001 Repacking message after external command succeeded.

Notes:

LevelBlue is not currently aware of a simple executable that provides Regular Expression replacement. For advanced users, the attached zip file (replace-regex.zip) contains a sample Visual Basic script that can be used in an external command. Caution: This script executes somewhat more slowly than FART.

Command Path: Refers to CScript (the Windows VBS command line script interpreter).
Parameters: enter a string similar to
c:\tools\replace-regex.vbs "{CmdFileName}" "http.+://.*?\.microsoft\.com" ""
- Enter the path to the script. The script must exist in this location on all processing servers.
  - In the image it is assumed you have put the script in the "Config" subfolder of the MailMarshal installation on the Array Manager. It will be copied to "NodeConfig" on all servers.
  - The variable {Install} expands to the MailMarshal installation location.
- Use "{CmdfileName}" (including quotes) to refer to the file to be processed. MailMarshal will update this variable with the file location.
- The next two parameters are the Regular Expression string to find and the replacement. For example:
  http.+://.*?\.microsoft\.com matches http or https and any subdomain/server of microsoft.com
- You can use an empty replacement string to delete the value found.
This script as provided is case sensitive. You can edit the script and add the IgnoreCase flag for the VBS RegEx object.
Single Thread must be selected.
Only execute once should NOT be selected. A message can have more than one body part.
Set Command is triggered to 0 and Command is not triggered to >0

How do I automatically save a file or attachment from a mail message?

Charles — Sun, 21 Sep 2025 22:31:43 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I automatically save a file or attachment from a mail message?

Procedure:

MailMarshal can easily be configured to save email attachments to a local or network share, and optionally remove them from the email. These rules can be applied to specific attachment types or attachments greater than a certain size.

Create a windows batch file called "SaveAttachments.bat" that contains the following text. To ensure the file will be present on all processing nodes, you can save it in the Config subfolder of the MailMarshal installation directory and it will be copied to the NodeConfig folder on all processing servers each time configuration is committed.

mkdir "c:\SavedAttachments\%2\%3_%4"

xcopy %1 "c:\SavedAttachments\%2\%3_%4\"

The %n variables are as follows:
%1 = Full path of the attachment
%2 = Message recipient
%3 = Date/Time in this format: 04-26-2004_11.38AM
%4 = Message sender
The folder name c:\SavedAttachments\ should be changed to an appropriate location for each environment. The location must exist on all processing servers.
The MailMarshal Engine service must have write permissions to the location specified.
- By default the Engine runs as the Local System and will have access to any local folder.
- The location can also be a network share. In this case for the Engine to have reliable access it should be run as a real account with local administrator permissions. In a domain environment you may be able to grant access to the computer accounts of the processing servers.

Open the Management Interface (or ECM Configurator) and browse to External Commands. Add an External Command as below.
(Click to enlarge.The ECM Configurator has different appearance but the same fields)

The command line field should contain the full path to the file "SaveAttachments.bat." In the example the variable {install} expands to the location of the MailMarshal installation folder.
The parameters field contains this text:
"{CmdFileName}" {Recipient} {Date=%%m-%%d-%%Y_%%I.%%M%%p} {Sender}

Next create a new Content Analysis rule as below. This rule will call the External Command and save the email attachments to the location specified in the batch file.

Content Analysis Rule: Move Attachments to network Share
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Run the external command 'Save Attachments'
And continue processing.

When creating the rule, choose all attachment types you want to save. In most cases you should not include Mail Components.

To remove the attachments, create a second rule. This rule must come after the previous rule because it will actually remove the attachments from the email.

Content Analysis Rule: Strip Attachments from email
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER' or 'USER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Strip attachment
And continue processing.

The criteria of this rule should be the same as the first.

This article was previously published as:: NETIQKB29361; Marshal KB194

Configuring Proxy Access for the Entra Connector

Charles — Fri, 19 Sep 2025 02:22:41 GMT

This article applies to:

MailMarshal 11.2 and above
Entra Connector

Question:

How do I configure a proxy for the Entra Connector?

Procedure:

The Entra Connector uses the MailMarshal RPC Proxy service to connect to Entra ID. This service does not use the proxy settings configured in the MailMarshal Console.

To configure a proxy for the Entra Connector, use the https_proxy system environment variable.

You can provide a server name or IP address, port number, and optional authentication details.

The format is: setx https_proxy [protocol][<uid:pwd@>]<proxyserver>:<proxyport> /M

On the Array Manager server, open an elevated command prompt.
Enter a setx command similar to the following examples:
- setx https_proxy myproxyserver:8081 /M
- setx https_proxy https://myv2proxy.local:80 /M
- setx https_proxy mydomain\mmentrauser:supersecretpassword@10.10.10.10:8080 /M
The expected response is: SUCCESS: Specified value was saved.
Restart the MailMarshal RPC Proxy service. This will also restart the MailMarshal Array Manager service.
Test the Entra connector. Any issues display as a red "toast" pop-up message in the console, and also in the MMRPCProxy log file.

Notes:

Other applications on the server that make automated web requests might respect the https_proxy variable. You can use the no_proxy variable to exclude sites from proxying.

If you are using a proxy that inspects HTTPS content (for example WebMarshal), you must exclude the following sites from inspection:

https://login.microsoftonline.com
https://graph.microsoft.com

This exclusion is to avoid issues with certificate validation.

You only need to exclude the specific requests made by the Entra connector. For example:

Exclude the MailMarshal Array Manager IP address
If authenticating as a user, exclude the specific user configured

Required URLs for Web Updates

Charles — Fri, 19 Sep 2025 02:21:41 GMT

This article applies to:

MailMarshal SEG
MailMarshal SPE

Question:

What URLs are required for product feature updates?
What URLs are required for product licensing updates?

Information:

The following URLs are used by MailMarshal SEG (MailMarshal) and MailMarshal SPE (Service Provider Edition).

You must allow access through your firewall from the servers as noted.

Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

The SEG requirements also apply to the processing arrays in a SPE installation.

URL	From Server	Purpose	More Info
HTTP (port 80) to all locations, including (but not limited to) HTTP://crl3.digicert.com HTTP://crl4.digicert.com HTTP://o.lencr.org Note: For correct operation of TLS, the Controller service on all processing nodes must have access to HTTP port 80 without restriction. TLS certificate revocation lists are published over HTTP and there is no definite list of URLs.	All	HTTPS Certificate Checking	Q12992
HTTPS://mailmarshal.licensing.marshal.com	Array Manager	Licensing IP Reputation Service credential	Q12992
HTTP://www.marshal.com HTTPS://www.marshal.com	Array Manager	SpamCensor and processing module updates	Q12992
HTTPS://cdn-updates.marshal.com This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.	Array Manager	SpamCensor and processing module updates (Azure CDN)	Q12992
HTTP://sigupdates.marshal.com HTTPS://sigupdates.marshal.com HTTP://pki.cloudmark.com/ HTTPS://pki.cloudmark.com/ HTTP://lvc.cloudmark.com/ HTTPS://lvc.cloudmark.com/ HTTP://tracks.cloudmark.com/ HTTPS://tracks.cloudmark.com/ HTTP and HTTPS access to the following network range: 208.83.136.0/22	Processing Nodes	SpamProfiler Note: As of February 2024, HTTPS is the default protocol. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for these URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.	Q12992
HTTP://scanmail.trustwave.com HTTPS://scanmail.trustwave.com HTTP(S)://urlscanner.mailmarshal.cloud (11.2 and above) (These URLs may redirect or resolve to different IP addresses)	User's workstation	Blended Threat Service URL check	Q12992
HTTPS://stats.scanmail.trustwave.com HTTPS://stats.btm.protection.mailmarshal.cloud (11.2 and above)	Array Manager	Blended Threat Service statistics retrieval	Q12992
HTTP://urlcategorizer.seg.trustwave.com	Processing Nodes	URL Categorizer URL check Note: this service has multiple geographically distributed instances. MailMarshal installations use the best instance based on geography and latency.	Q12992
HTTP://sophos.marshal.com HTTPS://sophos.marshal.com	Processing Nodes	Sophos for Marshal Engine and IDE updates (if installed). HTTPS required from SfM version 1.1. Note that the LiveProtection service (present in version 1.1 and above) performs DNS-based queries and must have access to a DNS server that can query the Sophos DNS servers.	Q11906
HTTP://mcafee.marshal.com HTTPS://mcafee.marshal.com	Processing Nodes	McAfee for Marshal Engine updates (if installed). HTTPS required from MfM version 1.1.	Q11360
HTTP://update.nai.com/	Processing Nodes	McAfee for Marshal definition file updates (if installed)	Q11360
HTTPS://bitdefender.marshal.com HTTPS://agent-av-mirror.trustwave.com	Processing Nodes	Bitdefender for Marshal Engine and signature updates (if installed)	Q20561
HTTP://activations.marshal.com/ HTTPS://activations.marshal.com/	SPE MIA server or Maintenance Agent/Web Console server	SPE licensing and Connector Agent updates	Q12161
HTTPS://login.microsoftonline.com/ HTTPS://graph.microsoft.com/	Array Manager	Entra Connector NEW	Q21252

Note:

You can set a web proxy for these requests.

In SEG, see the Configurator, Tools > SEG Properties > Internet Access
- For the Entra Connector, see the Knowledgbase article linked above.
In SPE:
- For licensing, see the Web Admin Console, System Settings > Proxy
- For SEG arrays, see the properties of each array in the Web Admin Console.

How do I check that MailMarshal (SEG) is updating correctly?

Charles — Fri, 19 Sep 2025 02:14:04 GMT

This article applies to:

MailMarshal (SEG)

Question:

How do I check that web updates are working?
Is SpamCensor up to date?
Is SpamProfiler up to date?
Is the Blended Threats Module (BTM) up to date?
Are virus signatures up to date?
Is my IP Reputation Service license up to date?
What websites must be allowed through a firewall for updates to work?

Information:

To check that the MailMarshal (SEG) product automatic updates are working, see the relevant sections below.
Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

For troubleshooting notes see the end of this article

All update functions and TLS - Certificate issues

If service logs show errors related to SSL certificates, your server may be lacking a required SSL Root Certificate (CA Certificate) needed to verify the server certificate. Also, using a proxy server with HTTPS content inspection could cause issues.

Sample error:
SSL certificate problem, verify that the CA cert is OK.
Details: error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
For a resolution, see LevelBlue Knowledge Base article Q13703.
Note also that you must allow HTTP access to Certificate Revocation List servers so that SSL certificates can be validated. For TLS, this requires access via HTTP (port 80) from processing nodes to all certificate authority sites.

Spam Censor

[Updated by the MailMarshal Array Manager service]

The Spam Censor Updates run under the Array Manager Service on the Array Manager server, and they require HTTP and HTTPS access. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access).

Required URLs are:

HTTP:://www.marshal.com
HTTPS://www.marshal.com
HTTPS://cdn-updates.marshal.com
- This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.

If updates are not succeeding, particularly with a proxy, you may need to run the Array Manager service using a Windows account with administrative privilege and proxy permissions.

To check that updates are successful, see the Configurator (MailMarshal Properties > Automatic Updates). You can check that the SpamCensor updates are current by clicking Check for Updates Now.

SpamProfiler

This information applies to all supported MailMarshal versions.

[Updated by MailMarshal SpamProfiler Process]

The Array Manager checks daily to verify licensing of this service. The required URL is https://mailmarshal.licensing.marshal.com/

You can check licensing activity by searching the MMArrayManager log (located in the \Logging folder of the installation).

SpamProfiler updates are retrieved by services running on the MailMarshal processing servers (in an array, each server updates separately). To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

Required URLs are:

HTTP://sigupdates.marshal.com
HTTPS://sigupdates.marshal.com
HTTP://pki.cloudmark.com/
HTTPS://pki.cloudmark.com/
HTTP://lvc.cloudmark.com/
HTTPS://lvc.cloudmark.com/
HTTP://tracks.cloudmark.com/
HTTPS://tracks.cloudmark.com/
HTTP and HTTPS access to the following network range: 208.83.136.0/22

NOTE: As of February 2024, HTTPS is the default protocol for most connections. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for all the above URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.

You can check that SpamProfiler is updating by viewing the MMReceiver or MMSpamProfiler log (located in the \logging folder of the installation).

You should see an entry like the following when you first enable spam profiler:

[MICROUPDATE] Successful auto configuration download from network (new serial xx.xx).

and subsequent updates like:

[MICROUPDATE] Successful signatures incremental download from network (new serial xxxxxxx.xxxxxxx)

URL Categorizer Service

[Check performed by the MailMarshal Engine service]

The URL Categorizer check requests are performed in real time by the Engine service on each SEG processing server. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal SEG Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

The default required URLs are:

HTTP://tw-seg-urlcategorizer.cloudapp.net (Located in Americas region)
- also known as urlcategorizer.seg.trustwave.com
HTTP://tw-seg-urlcategorizer-au.cloudapp.net/ (Located in APAC region)

Note that the SEG installation will select an instance based on geography and latency. All installations should have access to both instances.

You can choose to use HTTPS for these requests. See article Q20362.

Blended Threat Service

[Licensing update by Array Manager service]

The Array Manager checks daily to verify licensing of this service.

The required URL is https://mailmarshal.licensing.marshal.com

Note: ALL installations of MailMarshal/SEG 7.1 and above perform this check. It is not limited to installations licensed for the Blended Threats service. Installations without the service still must check in order to determine whether a license has been added.
You can check licensing activity by searching the MMArrayManager log (located in the \logging folder of the installation).
In version 7.1, search for the string BTM Provisioning
In version 7.2 and above, search for the string Licensing

Testing and validation of URLs is performed in real time when the user clicks the URL.

For version 11.1 and earlier:
- URLs are checked through web request to the site scanmail.trustwave.com (from the user's browser)
- Click statistics are retrieved through web request to the site stats.scanmail.trustwave.com (from the Array Manager)
For version 11.2 and later:
- URLs are checked through web request to the site HTTP(S)://urlscanner.mailmarshal.cloud (from the user's browser)
- Click statistics are retrieved through web request to the site HTTPS://stats.btm.protection.mailmarshal.cloud (from the Array Manager)

Licensing/Maintenance display
Marshal IP Reputation Service provisioning

[Licensing update by Array Manager service]

The Array Manager checks daily to verify maintenance entitlement for the product, and checks as required for Marshal IP Reputation Service information.

The required URL is https://mailmarshal.licensing.marshal.com

You can check activity by searching the MMArrayManager log (located in the \Logging folder of the installation).
Search for the string Licensing or RBL Provisioning

Bitdefender for Marshal
McAfee For Marshal
Sophos For Marshal

[Updated by Marshal Bitdefender Updater, Marshal Sophos Updater, or Marshal McAfee Updater services]

These plug-ins update on each processing server. To set a proxy or local update location, use the configuration console for each application. You can check that updates are successful using the configuration console. Update information is also logged to text log files.

Note that the required URLs differ depending on the version installed

For details see the following articles:

Bitdefender for Marshal: Q20561
McAfee for Marshal: Q11360
Sophos for Marshal: Q11906

Entra Connector

[In MailMarshal 11.2 and above; retrieves user group information directly from Microsoft Entra ID]

This connector is implemented by the MailMarshal RPC Proxy service on the Array Manager. For infomation on how to set a proxy, see Knowledgebase article Q21252.

Troubleshooting notes:

If SpamProfiler or Blended Threats (7.1 and above) is not updating as expected:

Verify the internet access settings in TWO locations, even for a single server installation:
- MailMarshal Properties > Internet Access
- Server and Array Configuration > Server Properties for the individual server > Internet access (Customize...)
The customized node setting overrides the main setting, even if you have only one server.

This access setting is also used for retrieval of Certificate Revocation Lists for TLS functionality (version 7.1 and above)

General tips on reading MailMarshal (SEG) service logs

Charles — Sun, 14 Sep 2025 19:23:22 GMT

This article applies to:

MailMarshal (SEG)

Symptoms:

General tips on reading SEG/MailMarshal service logs.

Information:

The MailMarshal service logs are located by default in the \Logging\ subfolder of the install folder. The logs contain detailed information about the ongoing operation of each service. Familiarity with these logs is key to achieving a quick and successful understanding of MailMarshal issues.

Use Word Wrap wisely in Notepad.
Typically we view MailMarshal service logs in Notepad. Sometimes it is important to clearly see the columns in the log - if so turn off Word Wrap. Each service log will have three columns - the columns are Thread Number, Time, and Logged Data. At other times, it is more important to see all the Logged Data on-screen - in this case turn on Word Wrap. Also use Notepad in full screen mode.

Learn to use the thread number.
The MailMarshal services run multi-threaded. Therefore different threads of data can be written to the logs at the same time. When reading the logs the data appears to jump from topic to topic in a meaningless way. However if you follow the thread number you can easily track relevant entries. Use the Notepad search function to locate subsequent thread entries.

Note that thread numbers can be used again once freed up by the thread.

Use the Message ID
The message name (such as B422c96d90000) is also a useful way of tracking the progress of a message through the logs. Unlike the Thread number, it is unique and never reused. If the message is created with a filename of, say, B422c96d90000.000000000001.0001.mml, then the B422c96d90000 part will be used in all the MailMarshal logs when referencing this message, or any messages split from it. A split typically occurs if the message has multiple recipients, and a rule applies to some but not all recipients.

Use a Grep tool to parse information from logs
Given that logs may be appear cryptic due to the multithreaded operation of MailMarshal, some users find it extremely helpful to use a grep tool to assist viewing of relevant information in the logs. One example of such a tool is PowerGREP from JGS.

Familiarize yourself with commonly-used log entries

RX - Data that MailMarshal receives from the connected mail server.
TX - Data that MailMarshal transmits to the connected mail server.
Event - an event raised by MailMarshal in response to an error condition.

Follow the progress of a message from start to finish.
When it is being processed by MailMarshal, a message will go through the MailMarshal Receiver, Engine and Sender services, in that order

Receiver:
The MMReceiver logs steps for an individual message as follows:

Initial handshake between MailMarshal and other mail server, including MAIL FROM: and RCPT TO.

Receiver Rules are run against the information gleaned from the initial handshake

DATA command is received to signal start of transmission of message.

QUIT is received at end of message.

Engine:
The MMEngine logs steps for an individual message as follows:

Thread unpacks message.

Rules are run against message.

If rule triggers, the actions taken against message are logged.
Sender:
The MMSender logs steps for an individual message as follows:

Recipient domain is resolved in DNS.

A new thread is started to connect to the remote server and initiate handshake.

Sender transmits HELO, MAIL FROM: and RCPT TO.

DATA command is transmitted to signal start of transmission of message.

QUIT is transmitted at end of message.

Message is considered successfully sent when "250 OK" acknowledgement from recipient server.

Notes on other MailMarshal Logs

MailMarshal includes two other services that exist in every MailMarshal system, the Controller and Array Manager services. In addition, there are some optional services and utilities, each with their own logs. They are MMUpdater, MMSpamProfiler, MMReleaseMessage, MMRPCProxy, MMPop3, and MMGetMail.

In MailMarshal (SEG) 10, the Configuration Service (back end for the web Management Interface) also generates logs (found in Config Service\Logging).

MMController:

Each MailMarshal node will have a MailMarshal Controller, which interfaces between the central Array Manager and the node's mail processing services (I.E. Receiver, Engine and Sender).

Reports on configuration updates received from the Array Manager.
Logs when message is unpacked for viewing in Console.
Logs when SQL log information is passed to Array Manager.
From 6.2, logs information about DNS lookup and caching.

MMArrayManager:

Any given system of MailMarshal servers will have one central Array Manager.

Logs LDAP and AD groups updates
Oversees and logs the status of MailMarshal nodes
Logs SQL database updates.
Records the processing of Digest Notifications

MMUpdater:

This is the log of the service that performs upgrades of the processing nodes as requested from the Configurator (in version 6.4 through 8.2).

Upgrade log
The upgrade functionality is not available in MailMarshal 10.X and above. The MMUpdater service has been removed in version 11.2 and above.

MMSpamProfiler:

This log provides information about the SpamProfiler spam detection service (if enabled).

The separate log is present in versions above 7.5.7; in 6.7 through 7.2.3; and in other installations depending on hotfix installation.

SpamProfiler Updates
Message detection scores

MMReleaseMessage:

If you use the MMReleaseMessage.exe external command to allow end users to release email, a log file is generated to record release activities.

Release code is parsed from message
Service connects to Node to locate and release message.

MMRPCPRoxy:: This is a helper service for the Entra Connector (user group retrieval from Microsoft Entra). This service was introduced in version 11.2.

MMPop3:

MailMarshal can operate as a fully functional Pop3 server. If used this way the MMPop3 service allows local users to connect to MailMarshal to retrieve their email using Pop3.

Mail Client connects to MMPop3 service to retrieve message.
Mail Client authenticates and downloads messages from MailMarshal.

MMGetMail:

MMGetMail logs will only exist if you use Mail Batching or the standalone MMGetMail application to retrieve mail from a remote Pop3 service. Very few sites still use this method.

MMGetmail service connects to remote POP3 server, authenticates and retrieves message.
MMGetmail connects to Receiver and generates the SMTP commands necessary to pass the message to the Receiver.

Notes:

See also the following Knowledge Base articles:

Q10429 - How do I read MailMarshal Log Files?
Q10192 - How do email messages flow through MailMarshal SMTP?

This article was previously published as:: NETIQKB46128

Software Version	Release Date	Support Status	End of Support	End of Threat Protection Updates
11.3.0.7659	December 2, 2025	Active
11.2.0.7413	September 4, 2025	Active
11.1.0.6958	May 29, 2025	Active
10.2.5.7024	June 5, 2025	Active
10.2.5.6043	September 10. 2024	Active
10.2.0.5718	July 2, 2024	Active	June 1, 2026	June 1, 2026
10.1.0.5102	April 3, 2024	Active	June 1, 2026	June 1, 2026
10.1.0.5089	March 28, 2024	Withdrawn	April 3, 2024
10.0.7.3979	September 29, 2023	Active	June 1, 2026	June 1, 2026
10.0.7.3969	September 12, 2023	Withdrawn	September 29, 2023
10.0.6.3739	February 28, 2023	Discontinued	February 1, 2025	June 1, 2025
10.0.5.3470	August 31, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.4.3361	May 16, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.3.2387	July 6, 2021	Discontinued	February 1, 2024	December 31, 2024
10.0.2.2230	April 28, 2021	Deprecated	July 6, 2021	December 31, 2024
10.0.1.2030	November 3, 2020	Discontinued	September 1, 2022	December 31, 2024
10.0.0.1428	April 14, 2020	Deprecated	November 3, 2020	December 31, 2024
8.3.2.11492	September 29, 2023	Active	August 1, 2025	December 31, 2025
8.2.6.11305	December 22, 2020	Discontinued	February 1, 2025	June 1, 2025
8.2.4.11170	October 31, 2019	Discontinued	March 31, 2022	December 31, 2024
8.2.3.11111	July 2, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.2.11949	February 14, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.1.11863	December 14, 2018	Discontinued	March 31, 2021	December 31, 2024
8.2.0.11849	December 6, 2018	Withdrawn	December 14, 2018	December 31, 2024

LevelBlue Knowledge Base » Knowledgebase » MailMarshal (SEG)

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

This article applies to:

Question:

Information:

Latest File Versions

MailMarshal (SEG) Supported Versions

MailMarshal (SEG) Older Versions

ECM

Failed to fetch server details: The server has not been configured yet - required security data not available

This article applies to:

Symptoms:

Causes:

Resolution:

Notes:

ACTION REQUIRED: TLS "Client Authentication" usage sunset

This article applies to:

Background:

MailMarshal Rule Update Required:

Notes:

Additions to Release Notes for MailMarshal 11.3

This article applies to:

Question:

Information:

SQL Server version requirement

Update from 11.2 with multiple servers

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Known issues for Current MailMarshal versions

This article applies to:

Question:

Information:

SQL version requirement for upgrade to 11.3

SQL 2017 is the minimum version required for successful upgrade to 11.3. SQL 2016 will be blocked by the installer.

Known issue with upgrade to 11.1 or 11.2 using SQL 2014

Known issues with the Entra Connector (11.2)

Known issues with upgrade from 8.3.2 to 10.2.X

Updates released in MailMarshal 10.2.5:

Known issues in 10.2.X:

Updates released in MailMarshal 10.2.0:

Known performance issue in 10.0.7 and 10.1.0

Known issues in 10.1.0:

Updates released in MailMarshal (SEG) 10.1.0:

Known issues in 10.0.7:

Important Known Issues in 10.0.4:

Updates released in MailMarshal (SEG) 10.0.7:

Updates released in MailMarshal (SEG) 10.0.6:

Updates released in earlier releases:

Installation/Upgrade:

Mail View

Functionality first added in MailMarshal (SEG) 10.0.1:

Known Issues in MailMarshal (SEG) 10.0 and above

Installation/Upgrade

Policy Elements and Settings

Mail View

API

Limitations in MailMarshal (SEG) 10.0 and above

Retired Features

Restarting Processing Services for one node at a time

This article applies to:

Question:

Background:

Procedure:

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

This article applies to:

Question:

Information:

MailMarshal (SEG)

MailMarshal ECM (formerly MailMarshal Exchange)

MailMarshal Secure Email Server (SES)

Notes:

Workstation Operating Systems
(for server installation)