LevelBlue Knowledge Base » Knowledgebase » Latest Articles

How do I use Intermediate Certificates with MailMarshal TLS?

Charles — Thu, 03 Sep 2026 01:41:23 GMT

This article applies to:

MailMarshal (SEG)
TLS Inbound Security functionality

Question:

How do I use Intermediate Certificates with MailMarshal TLS?
How do I use certificate chains with MailMarshal TLS?

Procedure:

Although the SEG/MailMarshal user interfaces do not currently provide a way to import certificate chains, it is possible to use chained certificates issued by a Certificate Authority in SEG if required.

For an automated method, see Knowledgebase article Q21265, Automating renewal of TLS certificates. This method will publish the entire certificate chain to all nodes automatically.

To use the MailMarshal interface:

Using the TLS Certificate Wizard in the MailMarshal Configurator or Management Console, generate a certificate signing request to send to a Certificate Authority (such as Thawte or Verisign). This CSR uses the private key generated and stored in the file csrprivkey.pem on the MailMarshal node server.
- Note: If you have more than one processing node and/or more than one email domain, you should ensure that all required DNS names are included in the certificate.
  - MailMarshal supports Subject Alternative Name (SAN) entries. See Knowledge Base article Q14516.
You will receive a certificate from the CA. This will typically be a server certificate (not including any intermediate certificate or root CA certificate). Other certificates may be provided in the distribution package.
Import the certificate to MailMarshal via the Management Interface (in 8.X, the Configurator). This certificate will be written to the file cacert.pem on the specific email processing node. The file csrprivkey.pem will also be copied to privkey.pem, overwriting any previous private key.

At this point, TLS will function with a subset of other Mail Transport Agents (MTAs) that do not require intermediate certificates (such as another MailMarshal server).

Note: If you have more than one processing node, you must import a certificate to each node using the above method. This may be the same certificate or a different certificate as noted in Knowledge Base article Q14516. If you are importing the same certificate to additional nodes, you will also need to import the private key file (privkey.pem).

To use TLS with other MTAs that do require intermediate certificates, complete the following additional steps:

Back up cacert.pem and privkey.pem
Retrieve the necessary certificates to complete the chain. The procedures and required certificates will vary, but generally this includes the intermediate CA certificate responsible for signing the server certificate. Additional intermediate certificates could be required.
- The CA root certificate should not be included in most cases (assuming the CA root is included in client repositories such as the Windows certificate store).
- For assistance, ask the CA.
If necessary, export the intermediate CA certificates to DER encoded base64 using OpenSSL or another tool.
Copy cacert.pem to a convenient temporary location.
Open the temporary copy in a text editor.
Paste in the intermediate certificates (text from the DER files) in reverse order, for example:
- Server cert (the existing content of the file)
- Intermediate cert 1 (that signed the server cert)
- Intermediate cert 2 (that signed intermediate cert 1) if any
Note: The chain might include more than one intermediate certificate. OpenSSL refers to these as the "Local Issuer" and one or more "Issuer" certificates.
Save the file to the temporary location (NOT in the SEG or MailMarshal folder).
Verify the validity of the certificate chain in the temporary file. This allows you to be sure that you have added all needed certificates in the correct order.
- You can use the OpenSSL verify function. The syntax is openssl verify -CAfile cacert.pem cacert.pem (note the name of the certificate file is entered twice).
Once you have verified the certificate file contains all needed certificates for a valid chain, distribute the files cacert.pem and privkey.pem to all desired nodes.
- To distribute to every node, place the files in the Config folder on the Array Manager server, overwriting any existing files, then commit configuration.
- You can also replace the files in the NodeConfig folder on individual nodes.

At this point, MailMarshal will load the certificate chain when establishing TLS negotiations in the Receiver.

You can validate the certificate chain using free web based SSL test services provided by third parties.

Notes:

You cannot use the MailMarshal user interfaces to import a cacert.pem file that contains a chain of certificates. To use certificate chains, you must copy or edit the files.
To obtain OpenSSL, see OpenSSL Light for Windows. You might also require the Visual C++ redistributables as linked from the OpenSSL download page.
Each time you generate a self signed certificate or import a CA certificate from the MailMarshal Configurator or MailMarshal (SEG) 10 Management Interface, the private key (privkey.pem) can be overwritten. This will cause previously generated certificates to stop working. Always back up privkey.pem and cacert.pem before performing any other certificate tasks.

Requesting and installing a signed certificate for TLS

Charles — Thu, 03 Sep 2026 01:37:14 GMT

This article applies to:

MailMarshal (SEG)

Question:

How do I create a a certificate signing request for MailMarshal TLS?
How do I install a signed certificate returned from a Certificate Authority for MailMarshal TLS?

Procedure:

This article provides an overview of the steps required to use a CA certificate with MailMarshal TLS (Transport Layer Security).

Before working with certificates, always ensure that you have a valid backup of any existing certificate and/or private key.
- MailMarshal does not back up certificates automatically. If you install a new certificate, the old certificate is permanently deleted.
- LevelBlue recommends that you keep copies of certificates separate from the servers, ideally off-site.
For important information about differences between MailMarshal versions, see the Notes at the end of this article.
For an alternate method, see Knowledgebase article Q21265, Automating renewal of TLS certificates

To access MailMarshal TLS certificate management:

Open the Inbound Security (TLS) item or tab for a server:
- In the Configurator expand Server and Array Properties. Select a processing node server from the list, and click Server Properties.
- In the MailMarshal (SEG) 10.0 and above Management Console, select Mail Servers and edit a server entry in the list.
Select the Inbound Security (TLS) item or tab.

To create a Certificate Signing Request:

From the Inbound Security (TLS) window, run the TLS Certificate Wizard.
Choose to create a Certificate Signing Request.
Enter the required information and complete the wizard. Copy the CSR or save it to a file, and include this information when you request a certificate from a Certificate Authority.
MailMarshal also creates a private key file, and saves this file in the \NodeConfig folder within the MailMarshal installation on the processing node server.

To import a certificate that you received from the Certificate Authority:

Notes:

If you have more than one processing server, ensure that you use the same server where you generated the CSR.
If the Certificate Authority uses a certificate chain (Intermediate Certificates) and you want connecting servers to be able to validate the certificate, you will need to perform additional steps. See LevelBlue Knowledgebase article Q14063.

From the Inbound Security (TLS) window, run the TLS Certificate Wizard.
Choose to import a signed certificate.
To import the certificate, browse to the certificate file.
- You may need to select a different file extension or "all files" to select the file.
You should not need to enter a private key filename. MailMarshal will use the private key file saved when you generated the request.
Complete the wizard to import the certificate.

To use the same certificate on more than one processing node server:

Request and import a certificate using one processing server.
After importing the certificate, use the TLS Certificate Wizard to make a backup of the certificate and private key.
On the other processing server(s), use the TLS Certificate Wizard to import the certificate from the backup.
- Note: If the certificate file includes Intermediate Certificates, do not use the wizards. Instead, copy the .pem files. See LevelBlue Knowledgebase article Q14063.

Notes:

In current releases of MailMarshal, the private key for a pending CSR is stored in a file named csrprivkey.pem and the CSR can be generated without overwriting an existing key. However, only one CSR can be pending on each server.
Warning: In MailMarshal 6.4 and below, if you create a CSR, any existing private key is overwritten and permanently lost.
- If you need to use a previous certificate after creating a CSR, restore it from your backup copy.
All files are stored on the email processing server(s) in the \NodeConfig folder. (In a single server installation, this folder is still present within the installation.)
The certificate is stored in a file named cacert.pem
The private key is stored in a file named privkey.pem

Automating renewal of TLS certificates

Charles — Thu, 03 Sep 2026 01:30:02 GMT

This article applies to:

MailMarshal SMTP
TLS certificate renewal

Question:

How can I automate renewal of email TLS certificates?
How can I automate distribution of updated certificates to processing nodes?

Background:

It is possible to automate certificate generation and distribution using an Automatic Certificate Management Environment (ACME) client.

ACME clients will automatically renew certificates on a schedule.
Automation reduces the chances of error, and helps with the newly required more frequent renewal of certificates.

A well known ACME client is Certify the Web. This client requests free certificates from Let's Encrypt by default. It can be used to request certificates from other Certificate Authorities including DigiCert.

Certify the Web provides the ability to deploy the generated certificates in PEM files as required by MailMarshal.

This article describes the required workflow with reference to Certify the Web. Other ACME clients are available with similar functionality.

Procedure:

Install Certify the Web on the MailMarshal Array Manager.

Certify is free for evaluation only. Before using this application for production, license the application.

On the Settings page you can select one or more certificate authorities to use.

To set up a certificate:

Begin creating a new certificate.

Manually enter the required list of domains or domain wildcards.

On the Authorization page, select the "dns-01" challenge type. This type is required where the certificate is not bound to a local website.

This authorization type requires you to grant Certify the ability to create TXT records in the DNS zone of the domains that you will be creating certificates for. To accomplish this, Certify includes API clients for many DNS providers such as Azure, GoDaddy, and Google.
See Certify documentation for the selected API, linked from the page in the Certify client.
Test the credentials.
Once the credential test is successful, you can generate a certificate and verify that it is correct.

To distribute the certificate to MailMarshal nodes:

MailMarshal requires the certificate and its key to be in two files: cacert.pem and privkey.pem.

You can create a deployment task to place these files in the Config folder of the Array Manager. They will be automatically distributed to the nodes.

It is not necessary to restart node services. The certificate is retrieved from disk for every use.
Certificates distributed in this way are not immediately validated by MailMarshal. Before configuring automatic distribution of the generated certificates, validate that they include the required SAN entries.

In Certify the Web, create a deployment task of type "Deploy to Generic Server (multi-purpose)"

The trigger type for production is "Run on success"

On the Parameters page:

Save the key as privkey.pem in the config path, by default C:\Program Files\Trustwave\Secure Email Gateway\Config\
Save the full chain as cacert.pem in the config path
MailMarshal does not require the other outputs.

Automating renewal of TLS certificates

Charles — Thu, 03 Sep 2026 01:30:02 GMT

This article applies to:

MailMarshal SMTP
TLS certificate renewal

Question:

How can I automate renewal of email TLS certificates?
How can I automate distribution of updated certificates to processing nodes?

Background:

It is possible to automate certificate generation and distribution using an Automatic Certificate Management Environment (ACME) client.

ACME clients will automatically renew certificates on a schedule.
Automation reduces the chances of error, and helps with the newly required more frequent renewal of certificates.

Certify the Web provides the ability to deploy the generated certificates in PEM files as required by MailMarshal.

This article describes the required workflow with reference to Certify the Web. Other ACME clients are available with similar functionality.

Procedure:

Install Certify the Web on the MailMarshal Array Manager.

Certify is free for evaluation only. Before using this application for production, license the application.

On the Settings page you can select one or more certificate authorities to use.

To set up a certificate:

Begin creating a new certificate.

Manually enter the required list of domains or domain wildcards.

On the Authorization page, select the "dns-01" challenge type. This type is required where the certificate is not bound to a local website.

This authorization type requires you to grant Certify the ability to create TXT records in the DNS zone of the domains that you will be creating certificates for. To accomplish this, Certify includes API clients for many DNS providers such as Azure, GoDaddy, and Google.
See Certify documentation for the selected API, linked from the page in the Certify client.
Test the credentials.
Once the credential test is successful, you can generate a certificate and verify that it is correct.

To distribute the certificate to MailMarshal nodes:

MailMarshal requires the certificate and its key to be in two files: cacert.pem and privkey.pem.

You can create a deployment task to place these files in the Config folder of the Array Manager. They will be automatically distributed to the nodes.

It is not necessary to restart node services. The certificate is retrieved from disk for every use.
Certificates distributed in this way are not immediately validated by MailMarshal. Before configuring automatic distribution of the generated certificates, validate that they include the required SAN entries.

In Certify the Web, create a deployment task of type "Deploy to Generic Server (multi-purpose)"

The trigger type for production is "Run on success"

On the Parameters page:

Save the key as privkey.pem in the config path, by default C:\Program Files\Trustwave\Secure Email Gateway\Config\
Save the full chain as cacert.pem in the config path
MailMarshal does not require the other outputs.

SSL certificate renewal for the Console and Configuration Service

Charles — Mon, 31 Aug 2026 02:01:54 GMT

This article applies to:

MailMarshal 10.X and above

Question:

How long are the MailMarshal interface SSL certificates valid?
Why is the Configuration Service failing to start with SSL errors?
How do I renew a self-signed certificate for MailMarshal components?

Background:

MailMarshal installation creates two SSL certificates, one for the Management Console and one for the Configuration Service.

These certificates are valid for 5 years from the first installation. There is no automatic renewal.

When these certificates expire they must be renewed.

The Configuration Service certificate is not visible to users and the expiration might be missed.

If this certificate expires, the Console and Array Manager may not be able to function properly.

The Console certificate is visible to users, and many customers choose to use a CA signed certificate.
- Expiry of this certificate is easier to notice.

Procedure:

To create a new self-signed certificate for either the Configuration Service or Console, use Windows Powershell. The certificates generated by IIS do not have certain flags required by current browsers.

Certificate creation in Powershell

To create a certificate in Powershell, run Powershell as administrator.

Use a command similar to the following. This command places the new certificate in the "Personal" store for the local computer.

new-selfsignedcertificate -dnsname "myMMserver" -subject "CN=myMMserver" `

-friendlyname "new-for-myMMserver" -KEYLENGTH 2048 `

-NotAfter $([datetime]::now.AddYears(5)) `

-CERTSTORELOCATION cert:\localmachine\my

For more information about certificate creation options, see the Related Links below.

Binding the websites

To apply a new certificate, open the IIS Manager on the MailMarshal Array Manager.

If you need to import a CA signed certificate, see the Server Certificates item on the server root page.
If you created a certificate with Powershell it will already be present.

To use the certificate:

From the menu tree at left, expand Sites
Select the required site (MailMarshal Management Console or MailMarshal Configuration Service).
From the right menu click Bindings
Edit the binding and select your new certificate.
Click OK.

After replacing the certificate:

For the Console, to ensure a new HTTPS connection you may need to fully close all browser windows and start again.
For the Configuration Service, restart IIS and also ensure the Array Manager service is running.

Performance Counters not available

Charles — Sun, 30 Aug 2026 21:00:55 GMT

This article applies to:

MailMarshal (SEG)

Symptoms:

MailMarshal performance counters cannot be selected in Windows Performance Monitor
MailMarshal performance counter information is zero or blank

Causes:

The MailMarshal Performance Monitor DLL was not registered.

Resolution:

For current versions of MailMarshal:

Log on to the server as administrator.
Open a command prompt and navigate to the MailMarshal install folder.
Run one or both of the following:
- For a processing server: lodctr /m:PerfCounters.man
- For an Array Manager server: lodctr /m:AMPerfCounters.man
You should see "Successfully installed performance counters" (some errors may also be reported if the counters were partially installed).
Counters should be available.
- If counters are not available, restart MailMarshal services and check again.

Known issues for Current MailMarshal versions

Charles — Mon, 10 Aug 2026 23:29:27 GMT

This article applies to:

MailMarshal (SEG) 10.X, 11.X, 12.X

Question:

What are the known issues and limitations for MailMarshal?

Information:

This article highlights differences between major versions of MailMarshal, as well as any known issues and major fixed issues.

Updated release 12.0.0.8219 corrects issues in 12.0.0.8194

If you installed MailMarshal 12.0.0.8194, you should upgrade to 12.0.0.8219 as soon as possible. The following issues are present in the earlier release where a Windows credential is used for the Configuration Service database:

During upgrade from earlier versions you will see a notice "Unable to upgrade the MailMarshal Config Service SQL Database"
On systems upgraded from 10.X only, configuration changes will never be delivered to the processing services.
On all systems, you will not be able to use the Config Service Admin Tool Users page.

Upgrading to release 8219 corrects all these issues.

Windows version requirement for upgrade to 12.0

Windows 2019 is the minimum version required for successful upgrade to 12.0. Windows 2016 will be blocked by the installer.

SQL version requirement for upgrade to 11.3 and above

SQL 2017 is the minimum version required for successful upgrade to 11.3. SQL 2016 will be blocked by the installer.

Known issue with upgrade to 11.1 or 11.2 using SQL 2014

SQL 2016 is the minimum version required for successful upgrade to 11.1 or 11.2. SQL 2014 is allowed by the installer but the upgrade will not fully succeed. For details and remediation, see article Q21223.

Known issues with the Entra Connector (11.2)

These issues are corrected in release 11.3.

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, connections to Entra will fail. Use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Import of a group can fail if the group "description" is blank or the group has a large number of members. A hotfix is available - contact Support.

Known issues with upgrade from 8.3.2 to 10.2.X

For installations with separate processing nodes, after upgrading a processing node the MailMarshal Controller service will not start.

A new release 10.2.5.7024 has been issued to correct this problem. Customers upgrading from 8.3.2 with node only servers MUST use this new release. See the MailMarshal Previous Version Downloads page.
A workaround is available for systems actually in the problem state. Contact LevelBlue Support.

For installations using Image Analyzer, after upgrade the MailMarshal Engine may stop when processing images.

Check the Config folder on Array Manager for the file "plugins.xml".
Remove the file "plugins.xml" from the Config folder. Then, on each processing node, remove the file from the NodeConfig folder.
This issue only affects upgrades from 8.X to 10.2 (not earlier 10.X releases).

Updates released in MailMarshal 10.2.5:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.5.

The Console now validates moved rules to prevent moving a target rule above a rule that refers to it (circular policy).
Moving or copying rules between Policy Groups is supported.
Policy printing is supported.
Connector user groups selected for some uses did not display in the user interface. This display issue is fixed. Note that LevelBlue recommends using local groups in these settings (Digests, SpamProfiler exclusions, and DHA settings) with the connector groups as members.

Known issues in 10.2.X:

Some customers have reported an issue in release 10.2.5 with the Array Manager service halting at 0100 local time.
- The issue affects installations in non-default locations (such as D drive).
- The source of this issue has been identified and an update has been published through Automatic Updates.
- If your installation cannot receive the automatic updates, you can request this file through a support case.
- Customers are also encouraged to set the service recovery action to restart the Array Manager automatically.

For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal 10.2.0:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.0.

In rare cases, deletion of deeply nested unpacked files could fail.
In version 10.1, in rare cases, child user groups were not correctly loaded on processing nodes.
A new version of the third party SSL library is included. This version addresses performance issues identified in 10.0.7 and 10.1.0
Performance of Image Analyzer has been adjusted. Some scanning issues have been addressed.

Known performance issue in 10.0.7 and 10.1.0

The third party SSL library used in these versions of MailMarshal has been found to use more system resource than earlier releases when under load. It may also initialize more slowly for each connection. In some cases, email throughput can be affected.
A new version of the library is provided in version 10.2.0 and above.

Known issues in 10.1.0:

LevelBlue identified an issue with database insertion in the original release 10.1.0.5089. This issue could affect the display of data in Mail History and the ability to manage processed messages. The issue is resolved in 10.1.0.5102.
- Release 10.1.0.5089 has been withdrawn. Customers must upgrade to the current release 10.1.0.5102.
For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal (SEG) 10.1.0:

The following issues or limitations present in MailMarshal (SEG) 10.0.7 and below have been resolved in version 10.1.0.

"Unsafe legacy renegotiation" can be enabled with a configuration setting. See LevelBlue Knowledgebase article Q21216.
DKIM record status is correctly displayed in the Management Console Local Domains detail.
The installer does not exit without warning after checking for Visual Studio updates.
See Release Notes for additional updates.

Known issues in 10.0.7:

Unsafe legacy renegotiation disabled: The TLS/SSL library included in release 10.0.7 (and above) does not negotiate outbound (sender) TLS connections where the remote server only supports legacy renegotiation of TLS. The risk in legacy renegotiation is described in CVE-2009-3555. Servers that still use this legacy method are very rare. A hotfix is available for customers who have a business need to allow this risk.
The original 10.0.7 release (3969) caused unexpected changes in TLS behavior. This release has been withdrawn from download pages. The currently available release 10.0.7.3979 corrects this issue. Any customers who installed the earlier release should upgrade immediately.
On some systems the installer will exit with no warning after checking for Visual Studio updates. To continue, simply run the installer again.
Restoring a backup created in an earlier version will cause processing services to stop, because the SSL libraries will be overwritten with the earlier and incompatible versions. For more information and resolution steps, see LevelBlue Knowledgebase article Q21209.

Important Known Issues in 10.0.4:

Folder changes cause quarantine problem: If you edit properties of a Folder, the physical path location information is lost. Message files are stored in an incorrect location. Message details and release for earlier quarantined messages do not work.
Folder editing is corrected in later releases. However, any changes made in 10.0.4 are not automatically fixed.
For customers who encounter this issue, a tool is available to detect incorrectly configured folders and move the incorrectly stored files. Contact LevelBlue support.

Updates released in MailMarshal (SEG) 10.0.7:

The following issues or limitations present in MailMarshal (SEG) 10.0.6 and below have been resolved in version 10.0.7.

Node servers can now be deleted from the installation in the Console.
Import of configurations could fail due to an issue with parsing of XML. This issue is corrected.
See Release Notes for additional updates.

Updates released in MailMarshal (SEG) 10.0.6:

The following issues or limitations present in MailMarshal (SEG) 10.0.5 and below have been resolved in version 10.0.6.

Upgraded installations that have custom Relay or Routing tables did not show the correct values in the website editor initially and other settings for a server could not be changed, with error "The Name field is required". This issue is corrected for new upgrades from version 8.X. To resolve the issue manually, select and save the desired settings for these tables.
Connector group members are not preserved in the upgrade from 8.2 to 10.0, or on restore of a configuration backup. Upgrade and restore now initiate an immediate refresh of these groups.
Console folder date issues related to Daylight Saving Time changes have been resolved.

Updates released in earlier releases:

This section highlights significant fixes that are included in releases 10.0.1 through 10.0.5. See release notes for full information.

In release 10.0.4, editing of folder properties caused messages to be stored in an incorrect location.
In release 10.0.4, for Windows authentication users, the "light" theme was not applied when selected.
In release 10.0.4, the rule condition "sender authenticated successfully" was no evaluated as expected.

Installation/Upgrade:

Prerequisite check on nodes now correct handles the case where IIS was previously installed then uninstalled.
The Configuration Service now accepts passwords that contain the characters: ; = '
Upgrade correctly determines the database location if the location was changed.
Validation of group names is improved.
Detection of WebDAV by the installer is corrected.
Issues with folder and history display when installing the Array Manager on non-English Windows distributions are corrected.
The installer detects port conflict issues (most likely where Exchange or another mail server is installed on the same server). For more discussion of steps required when installing on Exchange Server, see LevelBlue Knowledgebase article Q21146.
The installer prompts for an Operational User for the Configuration Service database if required.
Upgrade handles additional cases where rules (including disabled rules) contain references to templates, folders, or other rules that no longer exist or where the reference was malformed.

Policy elements and settings:

The retention setting shown on the Management Console Reporting page is correctly applied.
On upgraded installations, all Connector groups synchronize as scheduled.
Issues with incorrect selection of items in list views are corrected.
Message Templates and Message Stamps will now use the HTML formatting created using the WYSIWYG editor. You can also continue to use the stylesheet method described in Help.
Timezone offsets are correctly applied to all items in the Dashboard.
Unicode characters in subjects are handled correctly.
Folder permissions using Windows accounts are correctly retained.
In 10.0.2, changing Reporting Groups in the Management Console prevented further configuration changes. This issue is fixed.
Re-commit of the current configuration can be requested from the system configuration > General page.
Reporting Groups configuration is present.
- Caution: An issue has been identified in the Reporting Group interface 10.0.2. Upgrade to 10.0.3.
The Variables list on the HTML message stamp editor is corrected.
Rules can be enabled or disabled from the list view.
Entry of service names/keys in Advanced Settings is no longer case sensitive.
When restore takes a long time, the Management Console correctly shows the status.
Automatic backups are performed only if selected.
Maintenance expiry is correctly shown on the License page.
Configuration can be committed as prompted after entering a license key.

Mail View

Raw HTML source of email can be viewed.
Large lists load with acceptable speed.
Selecting an item no longer causes display issues on smaller resolution displays.
Deleting or forwarding from a filtered list selects the correct item.
Sorting is case-insensitive (as in 8.X).
Issues with folder display in certain timezones are corrected.
Filtering on the Message History pages is corrected. Note that filtering applies only to the displayed page, by design. To search over all available items, use Search instead.

Functionality first added in MailMarshal (SEG) 10.0.1:

The following features (present in SEG 8.X but not in 10.0.0) are included in current releases:

Folder physical path setting for individual folders
Folder security for individual folders
Authorization for configuration and email management by Windows accounts
Granular folder access authorization
Configuration commit scheduling

Known Issues in MailMarshal (SEG) 10.0 and above

Installation/Upgrade

Configuration import error
- Configuration import will fail if services are not listening on the default IP and port. To import manually (using MMExportCFG), use the -a and -c parameters to set the correct server and port information.
Database Collation:
- The MailMarshal databases MUST use a Case Insensitive collation. Installation of SQL sets collation based on the server locale. Most locales use Case Insensitive collation. If in doubt set the database collations to the default SQL_Latin1_General_CP1_CI_AS. Note that the collation MUST NOT be Turkish_CI_AS due to special treatment of the letter "i" in Turkish.
Azure Databases:
- The Installer and Server Tool cannot currently create Azure SQL managed instance databases. SEG can use Azure databases if they are created in advance.
Upgrade - TLS 1.3 and Elliptic Curves:
- LevelBlue previously suggested use of the secp521r1 Elliptic Curve for key exchange. Customers should be aware that if this is the only curve enabled, email delivery from Gmail may not succeed. This change is due to TLS1.3 behaviors and Google's decision not to use the secp521r1 curve.
- The X25519 curve is widely used and this is the default in both SEG 8.2 and MailMarshal (SEG) 10.0 and above.
- To check settings see the Inbound Security - TLS page for each mail server.
Array Join credentials:
- Adding an "Array Join" credential in the SEG Server Tool (used to join a processing server to an array) requires a restart of the Array Manager. The tool does not prompt you for this restart.

Policy Elements and Settings

Configuration restore:
- A restored configuration is committed with no confirmation or possibility of review in some cases.
- Restoring a configuration from a previous version that has rules referencing SpamZeroDay.xml and KnownThreats.xml causes the Engine to stop. (The upgrade process blocks upgrade of these configurations, but restore does not.)
- Restoring a configuration fails if any local MailMarshal user group name contains a fullstop character ( . ) . The error reported in logs may not identify the specific group. Older MailMarshal versions did not validate names. Upgrade validation does not allow these characters when upgrading from 8.X to versions 10.0.4 thorugh 10.2.5.
Configuration backup:
- The retention setting applies to manual as well as automatic backups, since the files are created in the same location. To save manual backups, copy them to another location.
- Backups and restores do not include DKIM keys unless a password is explicitly entered either as default or as override. No warning about missing passwords or unsaved keys is provided.
- A custom backup location set in SEG 8.X will apply in MailMarshal (SEG) 10.0 and above. This setting currently cannot be edited in the new versions.
Licensing:
- Blended Threat licensing status is not shown on the License page.
- Maintenance expiry shows today's date if the key cannot be validated through the LevelBlue website (it should display "unknown").
- Reminders about license status (seen in earlier versions) are not provided when you enter a new key.
- Entering a key that has a Marshal RBL credential forces configuration commit with no notice.
- Upgrading with an expired key results in no key being displayed on the License page. This behavior will not be changed.
Mail Server settings:
- If custom settings have been configured, reverting to the default settings and saving does not update the display in the console. The settings have actually been updated correctly.
Policy Elements:
- Dead Letter folders are not configurable in the Folders list.
Rules
- Enabling default virus scanner rules does not validate that a scanner is present and working.
Users
- Setting a user to "blocked" or "deleted" is only effective after a restart of the Management Console website.

Mail View

Message History:
- The default view of message history only shows items from "today". To see all items, use Search. The default should be to return all items up to the configured row count.

API

Some REST API calls listed in the automatically generated "handler listing" are not available. This includes TextCensor addition, edit, and deletion

Limitations in MailMarshal (SEG) 10.0 and above

The following functionality that was present in previous versions is not currently available in 10.0 and above.

Finding items in User Groups and IP Groups
Restore from Mail Recycle Bin (this does not affect retention of messages)
RSS news feeds
- Alternative: subscribe to the Notifications forum on the LevelBlue support site

Retired Features

The DMARC Dashboard has been retired. Customers must use third party services for this functionality.

The "Do not log to SQL" option when deleting a message is not available in this version of MailMarshal.

INFO: Additions to Release Notes for MailMarshal 12.0

Charles — Mon, 10 Aug 2026 22:58:03 GMT

This article applies to:

MailMarshal 12.0

Question:

What are the Release Notes for MailMarshal 12.0?

Information:

MailMarshal version 12.0 (12.0.0.8219) was released on August 11, 2026. The Release Notes included with the product are generally accurate as of the date of publication.

This article provides any additional information or corrections generated after that date.

See also article Q21135 for information about Known and Fixed Issues.

For current updates and information, customers should subscribe to the Notifications forum.

Updated release

Release build 8219 includes updates to Configuration Service database connectivity, specifically when using Windows credentials. Customers who installed or upgraded MailMarshal using the original release (12.0.0.8194) should update to 12.0.0.8219. For details of functionality affected, see Known and Fixed Issues.

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

Charles — Mon, 10 Aug 2026 22:54:32 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal Secure Email Server/MailMarshal SES

Question:

What versions of MailMarshal (SEG) are currently supported by LevelBlue Technical Support?
What versions of MailMarshal ECM/MailMarshal Exchange are currently supported by LevelBlue Technical Support?
What versions of MailMarshal Secure Email Server are currently supported by LevelBlue Technical Support?

Information:

Important: End of Support and End of Threat Protection dates for many earlier versions have now passed.

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For versions that have passed the end of support, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

Versions out of support do not receive component updates such as file type and unpacking updates.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Automatic updates to LevelBlue threat protection technologies for SEG (such as SpamCensor, Known Threats, YAE scripts) may be provided to some versions that are out of support. The table below lists this date separately.

All versions earlier than those listed are out of support and do not receive threat protection updates.

This includes MailMarshal 8.0.X and 8.1.X.

MailMarshal (SEG)

Software Version

Release Date
Support Status
End of Support

End of Threat
Protection Updates

12.0.0.8219 August 11, 2026 Active

12.0.0.8194 August 5, 2026 Withdrawn August 11, 2026

11.3.0.7659 December 2, 2025 Active

11.2.0.7413 September 4, 2025 Active

11.1.0.6958 May 29, 2025 Active

10.2.5.7024 June 5, 2025 Active

10.2.5.6043 September 10. 2024 Active

10.2.0.5718 July 2, 2024 Discontinued   June 1, 2026   June 1, 2026

10.1.0.5102 April 3, 2024 Discontinued   June 1, 2026   June 1, 2026

10.1.0.5089 March 28, 2024 Withdrawn April 3, 2024

10.0.7.3979 September 29, 2023 Discontinued June 1, 2026   June 1, 2026

10.0.7.3969

September 12, 2023

Withdrawn

September 29, 2023

10.0.6.3739

February 28, 2023
Discontinued February 1, 2025 June 1, 2025

10.0.5.3470

August 31, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.4.3361

May 16, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.3.2387

July 6, 2021
Discontinued
February 1, 2024
December 31, 2024

10.0.2.2230

April 28, 2021

Deprecated

July 6, 2021
December 31, 2024

10.0.1.2030

November 3, 2020
Discontinued
September 1, 2022
December 31, 2024

10.0.0.1428

April 14, 2020

Deprecated

November 3, 2020
December 31, 2024

8.3.2.11492 September 29, 2023 Discontinued August 1, 2025 December 31, 2025

8.2.6.11305

December 22, 2020
Discontinued February 1, 2025 June 1, 2025

8.2.4.11170

October 31, 2019
Discontinued
March 31, 2022
December 31, 2024

8.2.3.11111

July 2, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.2.11949

February 14, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.1.11863

December 14, 2018
Discontinued
March 31, 2021
December 31, 2024

8.2.0.11849

December 6, 2018

Withdrawn

December 14, 2018
December 31, 2024

MailMarshal ECM (formerly MailMarshal Exchange)

Software Version

Release Date
Support Status
Discontinued Date

7.2.0.9773

March 7, 2017

Active

7.1.7.7380

January 12, 2015
Discontinued
February 1, 2019

MailMarshal Secure Email Server (SES)

Software Version

Release Date
Support Status
Discontinued Date

5.8.1.398

July 24, 2017
By special arrangement only

5.8.0.361

May 30, 2016
By special arrangement only

5.7.2.9723

May 1, 2013

December 31, 2012

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

How to use the Support Tool for MailMarshal SPE

Charles — Wed, 05 Aug 2026 01:58:11 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use the Support Tool for MailMarshal SPE?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about a MailMarshal SPE installation. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about MailMarshal SPE, MailMarshal SEG, IIS, Marshal virus scanners, and the Connector Agent.

Note: For help with the Support Tool for other LevelBlue email products (MailMarshal SEG, LevelBlue ECM, WebMarshal, and MRC), see Q15024.

Installation

The tool is included in current installations of SPE and MailMarshal. You can also download the latest version manually if necessary from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

Copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect to check for updates, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool (latest version 2.x) appears as shown below. This interface is simplified compared to earlier versions. The data gathered is the same.
- For reference, a screenshot of the earlier version of the tool is provided at the end of this article.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Click Gather to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include the SPE database statistics data. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Dark/Light mode

Version 2.0 provides an optional dark theme for the interface. Use the slider at the top to select the theme.

Version: Shows the version of the Support Tool.

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a MailMarshal processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

NOTE: A minimum of 2 days is recommended to ensure that at least one file of each type is included.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.

Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

SPE database

Include the SPE configuration and logging data as CSV files.

Warning: Only select these items if directed by LevelBlue Support. Including the SPE database data can result in a very large file. In some cases it could consume all available disk space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.

In addition to the above items, the following are always gathered by version 2 of the tool:

System Information

Includes a listing of the system hardware and operating system information. 8.3 file naming settings are included.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

Event logs

Includes Windows Event Log information.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
The tool is able to gather information for current versions of all components.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.
The previous version of the tool appears as below:

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles — Wed, 05 Aug 2026 01:57:35 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about installed software and configuration. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal, ECM, or WebMarshal).

Otherwise, download the support tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, download or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool (latest version 2.X) appears as below. This interface is simplified compared to earlier versions. The data gathered is the same.
- For reference, a screenshot of the earlier version of the tool is provided at the end of this article.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click Gather to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Dark/Light mode

Version 2.0 provides an optional dark theme for the interface. Use the slider at the top to select the theme.

Version: Shows the version of the Support Tool.

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

Gather specific message

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

NOTE: A minimum of 2 days is recommended to ensure that at least one file of each type is included.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.
Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

In addition to the above items, the following are always gathered by version 2 of the tool:

System Information: Includes a listing of the system hardware and operating system information. 8.3 file naming settings are included.
Current process details: Includes a listing of processes running on the server.
Configuration details: Includes the XML or text files that define configuration of the selected software.
Marshal Registry: Includes a copy of the registry hive for all components that are present on the server.
Marshal install directory listings: Includes file and version information for files in the installation directories of all selected components.
Event logs: Includes Windows Event Log information.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.
The earlier product interface appears as below:

Documentation for the MailMarshal REST API

Charles — Tue, 04 Aug 2026 22:08:03 GMT

This article applies to:

MailMarshal/SEG 8.0 and above
REST API

Question:

Is there any documentation for the REST API?
What functions are available through the REST API?

Information:

MailMarshal exposes a REST API for management functions.

This API provides all email administration functions, and a limited set of configuration functions.

You can use the API to:

View and act on messages in folders
Manage SQM users and configuration
Commit configuration
Force SpamCensor update
Update user groups and members
Query service and processing statistics
Query DMARC data

The API cannot be used to manage rules and settings.

Caution: DKIM key functionality should be considered "read only".

The API is a HTTPS web interface on the Array Manager server (port 19006 by default).

Security:

In MailMarshal (SEG) 10.0 and above, the API is secured using Bearer tokens derived from Management Console credentials. Windows ACLs are not used. For details, see the API Handler listing document for your version, attached to this article.

Even when you use NTLM to secure the Management Console, you must use the local MailMarshal credentials (not Windows accounts) to access the API.
The one exception to this rule is for API connections from the Array Manager server. These connections can use the local Administrator credential.

In SEG 8.X, the API is secured using Windows credentials and implements the same account permissions as the Console and Configurator.

To use the API, the account must have the permission Log on as a batch job. Administrator accounts have this permission by default. You can grant this permission to other accounts using Group Policy.

Calling Applications:

You can use an application such as Postman to connect to the API for testing purposes.
You can use any scripting language to develop production uses for the API.

Caution:

The REST API is used internally by SEG and SPE. It is exposed for use by customers who have appropriate understanding and skills.
Documentation is limited to the API definitions and this article.
LevelBlue does not provide detailed usage documentation or support for applications that call the API. Development of any such application is at the customer's risk and responsibility.
Test on a test system before deploying to production, and ensure automatic configuration backups are enabled.
Data entered through the API may not be fully validated by SEG. The calling application is responsible to ensure that data is valid and correctly formatted.
- In particular, string data such as object names is only validated in the Configurator.
- See the section Known validation items for details.
API functions are subject to change. Applications should check the interface version or product version before making other calls.

To enable and configure the REST API, use the SEG Server Tool.

To retrieve a list of available functions in the installed version of the API, when logged on to the Array Manager server, use the following URL:
https://localhost:19006/seg/api/debug/handlers/
- The response includes descriptions and definitions of each available call to the API.
- Attached to this article is a formatted copy of this listing updated for SEG 8.2.3, and another updated for a recent version of MailMarshal (SEG) 10.X.
  - Note that the available functions in these releases differ, and future releases are also likely to differ.
- The API can be made available from other locations as with any website, depending on firewall settings. Ensure that this interface is secured against abuse.
Input and output is in JSON format.
Query Parameters are sent as a http querystring. The parameter names are case sensitive.
Variable data in querystrings MUST be URL Encoded. For example, a semi-colon ; must be represented as %3B
Times (integers) are Unix epoch timestamps. The minimum value is 0 and the maximum value is 2147483647. For testing, you can convert times using many free online services. For production, cast the date/time to this format programmatically.
Where the API requires a processMessageKey, this is a JSON object containing the following items that can be retrieved from results of findmessage (all items required):
- blockNumber, edition, folderId, messageName, recipient, serverId, timeLogged

Simple GET examples:

Send a GET request to return information.

Get list of servers
https://localhost:19006/seg/api/services/servers
- Returns information like the "servers" list in the Configurator, including the server ID
Get receiver statistics for server 1
https://localhost:19006/seg/api/console/overview/1/receiver
- Returns similar statistics to the Console Servers | Receiver window.
Get list of groups
https://localhost:19006/seg/api/groups
Get list of members in a group
https://localhost:19006/seg/api/groups/3/members
- Returns details of each user in the group.

Simple POST examples:

Add an email address member to a group

The call is defined as:

 {  "description": "Add member to a group   Post data fields: memberType(int), memberGroupId(int),      memberData(string), touchDate(int)      GroupMemberType: 0 - group, 1 - email, 2 - wildcard",  "method": "POST",  "url": "^groups/usermaintained/(?<groupid>[0-9]+)/members/$" }

The URL to add a member to Group 3 is:
https://localhost:19006/seg/api/groups/usermaintained/3/members

Send a POST request with JSON formatted body, such as:

{      "memberType":1, "memberData":"coo@example.com">", "touchDate":0}

Returns a JSON message (member added, or member already exists)

Kill messages from the Sender queue by recipient, sender, or subject

The call is defined as:

 {  "description": "Kill messages current queued/being delivered by Sender   Post data fields: sender(string,regular expression),     recipient(string,regular expression),      subject(string,regular expression),     speCustomerId(int) - at least one of these is required     bNotify(bool, optional)",  "method": "POST",  "url": "^console/sender/message/killex/(?<serverid>[0-9+]/" }

The URL to kill messages on server 2 is:
https://localhost:19006/seg/api/console/sender/message/killex/2/
Send a POST request with JSON formatted body. For instance, to kill messages to gmail.com and return a notification to the senders:
```
{      "recipient":".*@gmail\\.com$","bNotify":true}
```
Note the double-backslash required as the escape character in JSON representation of regular expressions
Returns a JSON message (number of messages deleted and server number)

Search Mail History (similar to Console search)

The call is defined as:

 {  "description": "Finds message by specified parameters   Post data fields: startTime(int, required), endTime(int, required),     folderId(int), messageName(str), actionType(int), classification(int),
    fromUser(str), fromDomain(str),toOrFrom(bool), toUser(str), 
    toDomain(str), minSize(int), maxSize(int), subject(str), 
    searchHistory(bool), forwards(bool), blockNumber(int64), 
    searchBlankSubject(bool), direction(int)
Query parameters: maxRows(int, required)",  "method": "POST",  "url": "^quarantine/findmessage/$"}

The URL to return up to 5 results is:
https://localhost:19006/seg/api/quarantine/findmessage/?maxRows=5
Send a POST request with JSON formatted body. You must include a start and end time as Unix time integers. You must include the querystring parameter maxRows.
Parameters are case sensitive.
For instance, to find messages sent from gmail.com, from the earliest to the last available time, use this body:
```
{      "startTime":0 , "endTime":2147483647 ,"fromDomain":"gmail.com"  }
```
By default the search only finds messages quarantined in folders. To include history records like "Undeliverable" results, add "searchHistory":true
To understand the other available parameters, see the Search feature in the Console.
To find folder and classification IDs, look them up using other REST calls
Returns a JSON array (details of the matching messages)

Simple PATCH example using a JSON array:

Update IP group membership with addition and deletion in the same call

The call is defined as:

{  "description": "Add membership delta information to an IP group   Patch data fields:     add(array of objects with fields:            ipAddressStart(string), cidr(int),            ipAddressEnd(string, required only when cidr is 0),            name(string), description(string)),     remove(array of objects with fields:            ipAddressStart(string), cidr(int), ipAddressEnd(string))",  "method": "PATCH",  "url": "^ipgroups/(?<groupid>[0-9]+)/delta/$" }

The URL to change membership of Group 15 is:
https://localhost:19006/seg/api/ipgroups/15/delta

Send a PATCH request with JSON formatted body, such as:

{"add":[  {"ipAddressStart":"10.1.1.0","cidr":28,   "name":"Address Item 1","description":"Ten"},  {"ipAddressStart":"12.1.1.0","cidr":28,   "name":"Address Item 2","description":"12"}],"remove":[  {"ipAddressStart":"10.1.2.3","ipAddressEnd":"10.1.2.3","cidr":32}]}

Item names and IP ranges must be unique.
If any one of the operations cannot be performed, the entire call is cancelled
Returns a JSON message (group updated, or member to add already exists, or member to remove does not exist)
Note that for this call both Add and Remove sections are required. However either can be completely blank []

Known validation items

Group names and IP group item entry names must not contain any of the following characters:
( ) / \ ; .
Names using these characters are accepted by the API and do not cause problems with processing. However if you edit an item in the Configurator, you must remove the disallowed characters from the name before saving it.
Quarantine message find commands require a start time and end time, as well as a value for the maxRows parameter. If any of these are missing, no rows are returned.

What is the Product Support Lifecycle for DbProtect and AppDetectivePRO?

Charles — Tue, 04 Aug 2026 21:55:46 GMT

This article applies to:

AppDetectivePRO (All Versions)
DbProtect (All Versions)

Question:

What is the AppDetectivePRO or DbProtect product support lifecycle?
How long is my version of AppDetectivePRO or DbProtect supported for?

Information:

Supported versions of the named products are the latest release, and the two previous releases.

Earlier releases are not supported.
For your convenience, a recent product support matrix is included below. Versions not listed are out of support.

Version upgrades are available to all customers that have current support and maintenance contracts.

Clients running unsupported software are strongly encouraged to plan for an upgrade or fresh installation of their licensed software. Newer releases of software offer better performance, new features and capabilities, and often resolve issues experienced in older releases of software.

As always, new releases of licensed software are available for download at no additional cost for clients with a current and valid maintenance agreement (for DbProtect) or software subscription (AppDetectivePRO).

Important Notes:

If you are running older, unsupported versions of licensed software that are more than two versions behind the current release, please contact dbsssupport@levelblue.com before attempting any in-place upgrade or fresh installation.
Requirements to successfully install AppDetectivePRO and DbProtect may have changed since you last installed software. Please check the relevant README and Installation/Upgrade Guide documents before attempting an upgrade or installation. Please contact dbsssupport@levelblue.com with any questions.

AppDetectivePRO:

Version	Software Release Date
AppDetectivePRO 10.14	July 2026
AppDetectivePRO 10.13	March 2026
AppDetectivePRO 10.12	June 2025

DbProtect:

Version	Software Release Date
DbProtect 6.7.1	July 2026
DbProtect 6.7.0	March 2026
DbProtect 6.6.15	July 2025

How do I check that MailMarshal (SEG) is updating correctly?

Charles — Tue, 04 Aug 2026 20:50:59 GMT

This article applies to:

MailMarshal (SEG)

Question:

How do I check that web updates are working?
Is SpamCensor up to date?
Is SpamProfiler up to date?
Is the Blended Threats Module (BTM) up to date?
Are virus signatures up to date?
Is my IP Reputation Service license up to date?
What websites must be allowed through a firewall for updates to work?

Information:

To check that the MailMarshal (SEG) product automatic updates are working, see the relevant sections below.
Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

For troubleshooting notes see the end of this article

All update functions and TLS - Certificate issues

If service logs show errors related to SSL certificates, your server may be lacking a required SSL Root Certificate (CA Certificate) needed to verify the server certificate. Also, using a proxy server with HTTPS content inspection could cause issues.

Sample error:
SSL certificate problem, verify that the CA cert is OK.
Details: error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
For a resolution, see LevelBlue Knowledge Base article Q13703.
Note also that you must allow HTTP access to Certificate Revocation List servers so that SSL certificates can be validated. For TLS, this requires access via HTTP (port 80) from processing nodes to all certificate authority sites.

Spam Censor

[Updated by the MailMarshal Array Manager service]

The Spam Censor Updates run under the Array Manager Service on the Array Manager server, and they require HTTP and HTTPS access. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access).

Required URLs are:

HTTP:://www.marshal.com
HTTPS://www.marshal.com
HTTPS://cdn-updates.marshal.com
- This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.

If updates are not succeeding, particularly with a proxy, you may need to run the Array Manager service using a Windows account with administrative privilege and proxy permissions.

To check that updates are successful, see the Configurator (MailMarshal Properties > Automatic Updates). You can check that the SpamCensor updates are current by clicking Check for Updates Now.

SpamProfiler

This information applies to all supported MailMarshal versions.

[Updated by MailMarshal SpamProfiler Process]

The Array Manager checks daily to verify licensing of this service. The required URL is https://mailmarshal.licensing.marshal.com/

You can check licensing activity by searching the MMArrayManager log (located in the \Logging folder of the installation).

SpamProfiler updates are retrieved by services running on the MailMarshal processing servers (in an array, each server updates separately). To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

Required URLs are:

HTTP://sigupdates.marshal.com (not used in 12.0 and above)
HTTPS://sigupdates.marshal.com (not used in 12.0 and above)
HTTP://cdn-microupdates.cloudmark.com
HTTPS://cdn-microupdates.cloudmark.com
HTTP://pki.cloudmark.com/
HTTPS://pki.cloudmark.com/
HTTP://lvc.cloudmark.com/
HTTPS://lvc.cloudmark.com/
HTTP://tracks.cloudmark.com/
HTTPS://tracks.cloudmark.com/
HTTP and HTTPS access to the following network range: 208.83.136.0/22

NOTE: HTTPS is the default protocol for most connections. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for all the above URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.

You can check that SpamProfiler is updating by viewing the MMReceiver or MMSpamProfiler log (located in the \logging folder of the installation).

You should see an entry like the following when you first enable spam profiler:

[MICROUPDATE] Successful auto configuration download from network (new serial xx.xx).

and subsequent updates like:

[MICROUPDATE] Successful signatures incremental download from network (new serial xxxxxxx.xxxxxxx)

URL Categorizer Service

[Check performed by the MailMarshal Engine service]

The URL Categorizer check requests are performed in real time by the Engine service on each SEG processing server. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal SEG Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

The default required URLs are:

HTTP://tw-seg-urlcategorizer.cloudapp.net (Located in Americas region)
- also known as urlcategorizer.seg.trustwave.com
HTTP://tw-seg-urlcategorizer-au.cloudapp.net/ (Located in APAC region)

Note that the SEG installation will select an instance based on geography and latency. All installations should have access to both instances.

You can choose to use HTTPS for these requests. See article Q20362.

Blended Threat Service

[Licensing update by Array Manager service]

The Array Manager checks daily to verify licensing of this service.

The required URL is https://mailmarshal.licensing.marshal.com

Note: ALL installations of MailMarshal/SEG 7.1 and above perform this check. It is not limited to installations licensed for the Blended Threats service. Installations without the service still must check in order to determine whether a license has been added.
You can check licensing activity by searching the MMArrayManager log (located in the \logging folder of the installation).
In version 7.1, search for the string BTM Provisioning
In version 7.2 and above, search for the string Licensing

Testing and validation of URLs is performed in real time when the user clicks the URL.

For version 11.1 and earlier:
- URLs are checked through web request to the site scanmail.trustwave.com (from the user's browser)
- Click statistics are retrieved through web request to the site stats.scanmail.trustwave.com (from the Array Manager)
For version 11.2 and later:
- URLs are checked through web request to the site HTTP(S)://urlscanner.mailmarshal.cloud (from the user's browser)
- Click statistics are retrieved through web request to the site HTTPS://stats.btm.protection.mailmarshal.cloud (from the Array Manager)

Licensing/Maintenance display
Marshal IP Reputation Service provisioning

[Licensing update by Array Manager service]

The Array Manager checks daily to verify maintenance entitlement for the product, and checks as required for Marshal IP Reputation Service information.

The required URL is https://mailmarshal.licensing.marshal.com

You can check activity by searching the MMArrayManager log (located in the \Logging folder of the installation).
Search for the string Licensing or RBL Provisioning

Bitdefender for Marshal
McAfee For Marshal
Sophos For Marshal

[Updated by Marshal Bitdefender Updater, Marshal Sophos Updater, or Marshal McAfee Updater services]

These plug-ins update on each processing server. To set a proxy or local update location, use the configuration console for each application. You can check that updates are successful using the configuration console. Update information is also logged to text log files.

Note that the required URLs differ depending on the version installed

For details see the following articles:

Bitdefender for Marshal: Q20561
McAfee for Marshal: Q11360
Sophos for Marshal: Q11906

Entra Connector

[In MailMarshal 11.2 and above; retrieves user group information directly from Microsoft Entra ID]

This connector is implemented by the MailMarshal RPC Proxy service on the Array Manager. For infomation on how to set a proxy, see Knowledgebase article Q21252.

Troubleshooting notes:

If SpamProfiler or Blended Threats (7.1 and above) is not updating as expected:

Verify the internet access settings in TWO locations, even for a single server installation:
- MailMarshal Properties > Internet Access
- Server and Array Configuration > Server Properties for the individual server > Internet access (Customize...)
The customized node setting overrides the main setting, even if you have only one server.

This access setting is also used for retrieval of Certificate Revocation Lists for TLS functionality (version 7.1 and above)

Required URLs for Web Updates

Charles — Tue, 04 Aug 2026 20:48:55 GMT

This article applies to:

MailMarshal SEG
MailMarshal SPE

Question:

What URLs are required for product feature updates?
What URLs are required for product licensing updates?

Information:

The following URLs are used by MailMarshal SEG (MailMarshal) and MailMarshal SPE (Service Provider Edition).

You must allow access through your firewall from the servers as noted.

Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

The SEG requirements also apply to the processing arrays in a SPE installation.

URL	From Server	Purpose	More Info
HTTP (port 80) to all locations, including (but not limited to) HTTP://crl3.digicert.com HTTP://crl4.digicert.com HTTP://o.lencr.org Note: For correct operation of TLS, the Controller service on all processing nodes must have access to HTTP port 80 without restriction. TLS certificate revocation lists are published over HTTP and there is no definite list of URLs.	All	HTTPS Certificate Checking	Q12992
HTTPS://mailmarshal.licensing.marshal.com	Array Manager	Licensing IP Reputation Service credential	Q12992
HTTP://www.marshal.com HTTPS://www.marshal.com	Array Manager	SpamCensor and processing module updates	Q12992
HTTPS://cdn-updates.marshal.com This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.	Array Manager	SpamCensor and processing module updates (Azure CDN)	Q12992
HTTP://sigupdates.marshal.com HTTPS://sigupdates.marshal.com HTTP://cdn-microupdates.cloudmark.com HTTPS://cdn-microupdates.cloudmark.com HTTP://pki.cloudmark.com/ HTTPS://pki.cloudmark.com/ HTTP://lvc.cloudmark.com/ HTTPS://lvc.cloudmark.com/ HTTP://tracks.cloudmark.com/ HTTPS://tracks.cloudmark.com/ HTTP and HTTPS access to the following network range: 208.83.136.0/22	Processing Nodes	SpamProfiler HTTPS is the default protocol. Version 12.0 and above does not use the "sigupdates" alias. The "cdn-microupdates" alias is the same endpoint. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for these URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.	Q12992
HTTP://scanmail.trustwave.com HTTPS://scanmail.trustwave.com HTTP(S)://urlscanner.mailmarshal.cloud (11.2 and above) (These URLs may redirect or resolve to different IP addresses)	User's workstation	Blended Threat Service URL check	Q12992
HTTPS://stats.scanmail.trustwave.com HTTPS://stats.btm.protection.mailmarshal.cloud (11.2 and above)	Array Manager	Blended Threat Service statistics retrieval	Q12992
HTTP://urlcategorizer.seg.trustwave.com	Processing Nodes	URL Categorizer URL check Note: this service has multiple geographically distributed instances. MailMarshal installations use the best instance based on geography and latency.	Q12992
HTTP://sophos.marshal.com HTTPS://sophos.marshal.com	Processing Nodes	Sophos for Marshal Engine and IDE updates (if installed). HTTPS required from SfM version 1.1. Note that the LiveProtection service (present in version 1.1 and above) performs DNS-based queries and must have access to a DNS server that can query the Sophos DNS servers.	Q11906
HTTP://mcafee.marshal.com HTTPS://mcafee.marshal.com	Processing Nodes	McAfee for Marshal Engine updates (if installed). HTTPS required from MfM version 1.1.	Q11360
HTTP://update.nai.com/	Processing Nodes	McAfee for Marshal definition file updates (if installed)	Q11360
HTTPS://bitdefender.marshal.com HTTPS://agent-av-mirror.trustwave.com	Processing Nodes	Bitdefender for Marshal Engine and signature updates (if installed)	Q20561
HTTP://activations.marshal.com/ HTTPS://activations.marshal.com/	SPE MIA server or Maintenance Agent/Web Console server	SPE licensing and Connector Agent updates	Q12161
HTTPS://login.microsoftonline.com/ HTTPS://graph.microsoft.com/	Array Manager	Entra Connector NEW	Q21252

Note:

You can set a web proxy for these requests.

In SEG, see the Configurator, Tools > SEG Properties > Internet Access
- For the Entra Connector, see the Knowledgbase article linked above.
In SPE:
- For licensing, see the Web Admin Console, System Settings > Proxy
- For SEG arrays, see the properties of each array in the Web Admin Console.

SQM configuration on upgrade to MailMarshal 12 or above

Charles — Tue, 04 Aug 2026 20:39:40 GMT

This article applies to:

MailMarshal 12 and above
SQM installations
Error message: The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL.

Beckground:

In MailMarshal 12 and above, security settings for the SQM site are enhanced.

After installing or upgrading MailMarshal and MailMarshal SQM to version 12 or above, you may encounter security related errors.

Forms Login Security:

In version 12 and above, Forms login security requires SSL by default. If you are using Forms login for the SQM site and not using SSL, users will see the error message mentioned.

Updating to use SSL (HTTPS) is recommended.

To disable the SSL requirement temporarily if necessary:

From IIS Manager, navigate to the IIS Authentication Settings for the SpamConsole application.
Edit the Forms Authentication item, and uncheck "Requires SSL", then click OK.

Installations Created Prior to 7.2:

In some much earlier versions of MailMarshal, the password used to connect from SQM to the Array Manager was encrypted using a deprecated method. These legacy entries are not accepted in version 12 and above. They must be updated.

To update the password:

From IIS Manager, navigate to the Application Settings for the SpamConsole application
Remove the entry UpgradedFromPre720
Set the value of InitialConfigurationComplete to False
Open the SpamConsole website. You should be directed to the Initial Configuration page where you can enter the password.
- Do not change other settings on this page.

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

Charles — Tue, 04 Aug 2026 20:37:08 GMT

This article applies to:

MailMarshal (SEG) 7.X and above
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

What is the version of the Unpacker and File Type DLLs for my version of SEG or ECM?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function (SpamCensor updater) for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file. Files that can be automatically updated are found on the Array Manager, in the Config subfolder of the SEG installation.

Latest File Versions

Notes:

From May 2024, Unpacker and File Type releases are combined.
Available Release Notes for each release are linked in the tables below.
Updates are no longer published for SEG/MailMarshal versions below 10.2.5. Product support for these releases has ended.

MailMarshal (SEG) Supported Versions

Product Version File Type and Unpacker Version

10.2.5 through 12.0.0

2026.03.01
July 14, 2026
Some items updated on July 23, 2026
to address a reported vulnerability in a third party component

Product Version	File Type and Unpacker Version
10.2.5 through 12.0.0	2026.03.01 July 14, 2026 Some items updated on July 23, 2026 to address a reported vulnerability in a third party component

MailMarshal (SEG) Older Versions

Product Version File Type and Unpacker Version

10.0.7 through 10.2.0 2026.02.01
June 16, 2026

8.3.2

2025.02.01
July 7, 2025

8.2.6
10.0.4 through 10.0.6

2024.04.01
December 5, 2024

10.0.3

2024.02.01
May 7, 2024

Product Version	File Type and Unpacker Version
10.0.7 through 10.2.0	2026.02.01 June 16, 2026
8.3.2	2025.02.01 July 7, 2025
8.2.6 10.0.4 through 10.0.6	2024.04.01 December 5, 2024
10.0.3	2024.02.01 May 7, 2024

All versions older than those listed are out of support and were last updated in 2023 or before.

ECM

Product Version Unpacker Version

7.2.0
7.1.7
7.1.6
7.1.5 1.0.5
February 28, 2019

Product Version	Unpacker Version
7.2.0 7.1.7 7.1.6 7.1.5	1.0.5 February 28, 2019

Supported Operating Systems and Prerequisite Versions

Charles — Tue, 04 Aug 2026 20:36:25 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM	RTM	RTM	RTM
Windows Server 2016	(11.3 is the last release that allows installation on Windows 2016)		RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 12.0	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on earlier or later SQL versions.

Entering license key details in MailMarshal or WebMarshal

Charles — Mon, 13 Jul 2026 04:59:51 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
WebMarshal

Question:

How do I enter a license key?

Procedure:

To enter keys for the products and optional features, find the product or feature name below.

Note: These instructions refer to the current versions at the time of writing.

If you have any queries related to your license key please contact keyrequests@levelblue.com

MailMarshal (SEG)
MailMarshal Exchange (ECM)

Open the MailMarshal Management Console (for 8.X the Configurator).
Navigate to Array Properties | License.
Click Enter Key and paste the key.
Choose the action that should occur if the license expires (hold mail, or deliver unfiltered).

Note: Optional licensed items are licensed through the product key.
Marshal IP Reputation Service:
Product maintenance for MailMarshal SEG is required to access to this service. If you enter a new product key, the credential for this service changes.
The updated credential is automatically provisioned over the web. For the required URL access, see article Q12992.

A new installation attempts to retrieve credentials immediately.

If you request and install a new product key, normally the credentials will be retrieved within an hour from the time of generation of the key. You can force a check by re-entering the product key (even if the key has not changed).

WebMarshal 6.8 and above

Open the WebMarshal Console.
From the Help menu select Licensing.
Click Enter Key and paste the key.

Note: Most optional licensed items are licensed through the product key.

Web Filter Database

Subscriptions are linked to your account through the WebMarshal product key. To activate the database subscription:

After entering the key, in the WebMarshal navigate to Policy Elements > URL Filtering

Select the Web Filter Database.

Note that new keys can take up to 24 hours to be enabled for this feature.

IBM URL Filter list (Marshal Filter)

This URL filter list is no longer licensed or supported. For URL filtering, use the Web Filter Database.

Smartfilter

This URL filter list is no longer licensed or supported. For URL filtering, use the Web Filter Database.

Notes:

Access to many support items on the LevelBlue website requires you to log in. These items include product upgrades, the Marshal IP Reputation Service credentials for older versions, and the Customer Forum.

To register or log in, go to https://support.levelblue.com/

Once you register, your login will be granted access by association with your customer account. In many cases association of logins to accounts is automatic and instant. Some requests require processing by LevelBlue staff.

How do WebMarshal license keys work?

Charles — Mon, 13 Jul 2026 04:59:18 GMT

This article applies to:

WebMarshal

Question:

How do WebMarshal license keys work?
How do you obtain a WebMarshal license keys?
How can I trial McAfee for Marshal?
How do I get a permanent key?
How long do trial keys work?

Procedure:

Trial Keys

After you download a trial version of WebMarshal (6.0 or above) from the Web, a trial key is generated as part of initial setup. Trial keys have a fixed duration of 30 days, which starts from the time of the key generation. Other than the expiration date, trial keys are not limited. If you have a need to trial the product for longer than 30 days, contact your LevelBlue Partner for a special extended trial key.

Permanent Keys

How do I get a Permanent Key?
Once you have purchased WebMarshal, you need to obtain a permanent key by requesting a key from within the product as follows:

In the WebMarshal Console, on the Tools menu, click Server Properties > License Info tab > Request Key.

The Server Properties window displays a request form. Complete the form.

It is helpful to include the customer account number or exact customer name from a previous purchase in the Additional Information. WebMarshal automatically sends the company name you entered at the time of installation, but company names often change.

When you submit the form, WebMarshal sends it to your LevelBlue Partner and LevelBlue.
Your WebMarshal permanent license key is typically tied to your Windows domain SID. WebMarshal determines the SID number and sends the request to LevelBlue to enable a key to be made.
You can expect a reply from LevelBlue, normally within two business days.
Access requirements:

WebMarshal 6.X or 7.X requires HTTP access to www.marshal.com from the workstation where the Console is running. It uses connection settings (such as proxy authentication) from the logged in user's profile in system settings. So if you can browse to www.marshal.com using Edge on the workstation, then the request should be successful.
If for some reason the key request fails, there is another option.
To perform the manual key request:

When you click Send Request, the SID information is copied to the Windows Clipboard.

Paste this information into a text file or email message.

Email it to keyrequests@levelblue.com.

If for some reason you are not able to access the request key window in WebMarshal, you can run the application SiteID.exe within the WebMarshal directory. (SiteID.exe is provided in WebMarshal 3.5 and above.)
Note: The following information should be included in the email you send: Email address of the supplier - if known, Contact Details of Person (Including: Name, Email address, Phone Number, Company Name, Address and any Additional information LevelBlue might need to process the request.)

What if WebMarshal is not a member of a domain?
Perform a key request as normal, mention in the Additional Information field that WebMarshal is not in a domain, and LevelBlue will allocate you a special permanent key.

What about additional installation locations or Disaster Recovery setups?

If you want an additional array for disaster recovery, or for processing at another gateway, you can use the same Permanent Key IF the Array Manager is joined to the same domain (assuming the key was based on the Windows domain). If the key does not work in the new location, you can request another permanent key; be sure to include comments about why the key is required. WebMarshal is licensed on the number of users, not the number of servers.
Note: For additional capacity, even over multiple gateways with different policy requirements, in most cases you should add processing nodes to a single array rather than creating new arrays.

Add-on Modules

How can I trial additional modules?

Bitdefender for Marshal, McAfee for Marshal, Sophos for Marshal, and the Web Filter Database are enabled by the standard trial keys. If you are an existing customer with a permanent key, please contact LevelBlue or your LevelBlue partner for a special time-limited full key to trial these items.

How can I get a permanent license for additional modules?

Bitdefender for Marshal, Sophos for Marshal, and McAfee for Marshal are licensed through the product key. If you have added a module to your license and received confirmation from LevelBlue, you can submit a key request to get an updated key.
The Web Filter Database is provisioned automatically by the Array Manager. Ensure the Array Manager service has web access. The provisioning process can take up to 24 hours to respond and download an initial database. You do not need to request a new key.
For any supported antivirus products that you purchase through other channels, no change to the WebMarshal key is required. Contact the reseller for license information. Other antivirus products supported by WebMarshal include Sophos (SAVI interface) and Symantec Antivirus Scan Engine.

Upgrading from Previous WebMarshal Versions

In general, version upgrades do not require a change in license key.

Notes

For help entering a license key in WebMarshal, see Q14384.

This article was previously published as:: NETIQKB29509; Marshal KB279

Creating an Application Registration for Entra ID

Charles — Thu, 02 Jul 2026 20:18:49 GMT

This article applies to:

MailMarshal 11.2 and above
MailMarshal SPE 4.4 and above
Entra ID Group Import

Question:

How do I register an application in Azure/Entra to allow group import to MailMarshal?
What are the options and requirements for use of imported Entra groups?

Background:

MailMarshal allows you to retrieve user group information directly from Microsoft Entra ID (formerly known as Azure Active Directory). To connect, you must create an "application" in Entra.

You will enter the Client ID, Tenant ID, and Secret from Entra in the MailMarshal Management Console or the MailMarshal SPE Customer Console

Procedure:

Note common missed items in this procedure:

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Be sure you grant Application permissions (not "delegated")
Be sure to grant admin consent

Log in to the Microsoft Entra Admin Center (entra.microsoft.com). The minimum required permission is "Cloud Application Administrator"
If you have access to more than one tenant, use the Settings menu (gear icon in the top bar) to switch to the specific tenant.
From the left menu browse to Identity > Applications > App registrations. Click New registration.
Enter a name.
For "supported account types" accept the default (single tenant).
Click Register.
From the overview page of the application, note the following values:
- Application (client) ID
- Directory (tenant) ID
From the API Permissions page of the application, grant the following Microsoft Graph permissions (Application permissions):
- Group.Read.All
- Member.Read.Hidden
- OrgContact.Read.All
- User.Read.All
After updating the above permissions, click Grant admin consent (above the list of permissions)
From the Certificates & Secrets page of the application, create a new client secret. Note the value (it is only available immediately after creation).

Use the Client ID, Tenant ID, and client secret on the Entra Properties tab of the Connector page in the MailMarshal Management Console, or the Entra Connector Properties page in the SPE Customer Console.

Group usage:

After creating the connector you can select groups to import using the Import Connector Group or Import Entra Groups button on the User Groups page.

Only "Mail Enabled" groups will be available for import. This means that Dynamic Security Groups cannot be imported, because this type of group cannot be set as "Mail Enabled".

Groups are populated immediately. Group membership is queried and updated hourly.

What are the Release Notes for MailMarshal SPE 5.3?

Charles — Thu, 18 Jun 2026 21:11:13 GMT

This article applies to:

MailMarshal SPE 5.3

Question:

What are the Release Notes for MailMarshal SPE 5.3?

Information:

The Release Notes included with MailMarshal SPE 5.3 are accurate as of the date of publication.

Build 5.3.0.22502 was published on December 2, 2025.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 5.3 from 5.2.0 only

To upgrade from 4.3.x you must first upgrade to 5.2.0.

SQL Prerequisite Change

The minimum SQL version supported is SQL 2017.

Rule Updates

The latest versions include updated abilities for detection of malware, phishing, and spam. Review the latest MailMarshal default rules and consider updating global policy to use the new features.

Upgrading MailMarshal Service Provider Edition to a newer version

Charles — Thu, 18 Jun 2026 21:10:01 GMT

This article applies to:

MailMarshal SPE supported versions

Question:

What is the safe method to upgrade MailMarshal SPE from an earlier version to the currently released version?

Procedure:

To upgrade SPE, the general procedure is to upgrade the MailMarshal (SEG) servers first, then upgrade the SPE Marshal Interface Agent or console server and the SPE agents.

Product names in the installers and interfaces depend on the product versions. MailMarshal SPE (Service Provider Edition) is also known as MailMarshal SPE. MailMarshal is also known as MailMarshal SEG or MailMarshal SMTP.
This article assumes you are familiar with SEG and SPE concepts.
Before starting, review the Release Notes for the new version of SPE and SEG. Release Notes include version specific upgrade notes, such as previous version supported for direct upgrade.
Rule updates: The latest versions include updated abilities for detection of malware, phishing, and spam. Review the latest MailMarshal default rules and consider updating global policy to use the new features.

The following steps are suggested to upgrade SPE safely and with minimal disruption to email flow.

Upgrading to version 5.3 from 5.2:

Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the MailMarshal software.
- At this point you will have a fully working MailMarshal solution running on the new software. You may wish to take an additional snapshot of the MailMarshal database.
Repeat steps 3-7 for each MailMarshal array.
Start your IIS server.
Upgrade the Management Interface and/or MIA server: run the SPE installer and upgrade the Management Interface and Marshal Interface Agent. The database wizard will also run and upgrade your SPE database.
Upgrade any other standalone Management Interface servers.
Verify that email processing and Management Interface functions are working correctly.

Upgrading to version 5.2 from 4.3:

From the MailMarshal Configurator, take a note of Inbound Security (TLS) settings for each processing node in each array.
Stop Marshal Agent services on all servers. This will always include Array Managers and processing nodes. Also check other servers with SPE components such as web consoles.
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software (11.2). If necessary, first install version 8.3.3. This will upgrade your configuration from the earlier version.
Repeat steps 4-7 for each MailMarshal array.
Start your IIS server.
Identify the server where Marshal Interface Agent (MIA) is installed. This server might also include the Web Console/Management Interface. Run the SPE installer and upgrade MIA and any other components. The database wizard will also run and upgrade your SPE database.
If the Management Interface is not hosted on any of the servers already upgraded, then upgrade at least one Web Console/Management Interface server.
Open the Management Interface and log in. You may need to use CTRL-F5 to update client side scripts. Make sure the configuration appears correct.
Navigate to the Server Configuration/Arrays page. For each Array:
- For each Mail Server, navigate to the Inbound Security (TLS) page. Ensure settings match what you noted from the Configurator.
  - You may have to set Elliptic Curves. If none was selected in the Configurator, X25519 is a safe choice.
- Replication will be paused. Resume replication.
- Force a configuration reload.
- Wait for the status to indicate "Up to date".
Upgrade the processing nodes with the MailMarshal software.
For each processing node, if you have not restarted the node after the upgrade, restart the Controller service. This step ensures a full configuration update for all the processing services. Notably the "loopback" delivery of messages between customers may not work until you do this.
Upgrade any additional Web Console/Management Interface servers.
On all servers that have only the MailMarshal components (Array Manager and/or Nodes), uninstall SPE 4.X. The only SPE component affected is the Marshal Agent, which is no longer used in version 5.X.

Upgrading to version 4.X:

Stop all SPE services on all array managers and nodes (Depending on version this may include Marshal Agent, Replication Agent, Status Agent, Maintenance Agent, Reporting Agent).
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the SEG Array Manager.
Take a snapshot of the SEG database.
Start the SEG Array Manager.
To ensure ability to roll back, create a backup of the SEG configuration by running the MMExportCfg in the SEG directory (typically in SEG version 8.X: C:\Program Files\Trustwave\Secure Email Gateway)
- For instance: MMExportCfg MMBackupOct2008.xml
- For details of locations for earlier SEG versions, see article Q10832.
- For SEG 8.0 if DKIM is in use, also ensure you have exported DKIM keys. They are not included in SEG 8.0 backups.
Upgrade the array manager with the supported version of SEG software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the SEG software.
- At this point you will have a fully working SEG solution running on the new software. Take a configuration backup (as in step 7) and a snapshot of the SEG database.
Repeat steps 4-9 for each SEG array.
Start your IIS server.
Upgrade the Web Console and/or MIA server: run the SPE installer and upgrade the web console and Marshal Interface Agent (Maintenance Agent in earlier versions). The database wizard will also run and upgrade your SPE database.
When the installer and database wizard completes successfully, log into the SPE console and make sure the configuration appears correct. Arrays will not be connected at this stage.
Run the SPE installer on all Array Managers to upgrade the Replication Agent or Marshal Agent (depending on version).
Force a configuration reload on the SPE web console (Arrays->Force Reload).
Monitor the Array Manager logs for any errors. If you encounter any problems, stop and disable the SPE agent on the Array Manager (Marshal Agent for 3.8 and above, Replication Agent for earlier versions). Restore the SEG configuration (from the backup you took in step 7 above), and restart the Array Manager. You will not need to restore the SQL database. Do not proceed further but contact LevelBlue Technical Support for assistance.
Upgrade the Marshal Agents on the nodes.
If upgrading to a version below 3.6, upgrade the reporting agent. (3.6 and above does not use a separate reporting agent.)
Restore any custom branding. The upgrade creates a dated backup of the website directory, including the branding subdirectory. Move required items to the production website\branding folder.
If you use custom themes for the Customer Console or SQM, you may need to update the themes to cover new features. See the linked article below for more information.
- Release 4.0 includes breaking changes to the SQM login page.
- Release 3.6.2 includes significant changes in the Customer Console themes from 3.6.1.

Notes:

For some versions, the Release Notes recommend stopping all Marshal services including all SEG services during upgrade. This recommendation was to ensure that some settings are updated when services start. Normally you can follow the steps above and SEG services can remain running during the SPE upgrade.

For upgrade from SEG 8.0 or below with DKIM keys, in the rare case that you must roll back the SEG upgrade, you might need to re-import DKIM keys on the nodes. Contact LevelBlue for assistance.

How do I test e-mail policy rules set up to block or filter different types of e-mail messages and attachments?

Charles — Tue, 16 Jun 2026 20:05:13 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I test e-mail policy rules set up to block or filter different types of e-mail messages and attachments?
Which types of e-mail messages and attachments can I block or filter?

Procedure:

For a full list of file types recognized by SEG and ECM, please see article Q10858.

To test the e-mail policy rules you have set up to block or filter some common types of e-mail messages and attachments, send an e-mail to one of the following addresses and a message of the corresponding type will automatically be sent back to you. The message is returned "from" test.service@marshal.com

Notes:

The subject of your message must contain the word: test

You should only use this service for manual rule testing. This service is not intended as a connectivity checker. Overuse could result in your requests being ignored.

Choose any of the following options:

echo.test@mmpolicytester.marshal.com – returns a basic test message.
bounce.test@mmpolicytester.marshal.com – returns an email with your original message attached.
virus.test@mmpolicytester.marshal.com – attaches a pseudo test virus file (a harmless text string).
spam.test@mmpolicytester.marshal.com – returns a short text message that will trigger the SpamCensor or SpamProfiler (GTUBE standard spam test).
urlcategorizer.test@mmpolicytester.marshal.com - returns a short text message containing a harmless URL that will trigger the URL Categorizer (Suspect URLs) cloud service.
archive.test@mmpolicytester.marshal.com – attaches a sample .zip file.
docimage.test@mmpolicytester.marshal.com – attaches a Word document with an embedded image.
renamed.test@mmpolicytester.marshal.com – attaches a benign executable which has been renamed with a .txt extension.
doc.test@mmpolicytester.marshal.com – attaches a sample PDF file.
exe.test@mmpolicytester.marshal.com – attaches a small and benign executable.
image.test@mmpolicytester.marshal.com – attaches a small JPG file.
video.test@mmpolicytester.marshal.com – attaches a small AVI file.
sound.test@mmpolicytester.marshal.com – attaches a small WAV file.
mail.test@mmpolicytester.marshal.com – attaches this help information.

To comment about this service or suggest other test messages, please send an e-mail to webmaster@m86security.com.

This article was previously published as:: NETIQKB29660; Marshal KB355

What file types are recognized by MailMarshal (SEG) and ECM?

Charles — Mon, 15 Jun 2026 21:47:09 GMT

This article applies to:

MailMarshal (SEG) current versions
MailMarshal ECM/MailMarshal Exchange 5.2 and above

Question:

What file types are recognized by MailMarshal (SEG)?
What file types are recognized by MailMarshal ECM 5.2 and above?

Information:

The following formats are recognized by current MailMarshal (SEG) and ECM versions.

Notes:

Some types are recognized only with current product versions, as noted. Items marked "Current SEG" were added before 2023. These items are not recognized by ECM.
Additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each MailMarshal version, see article Q20446.
- File Type updates are distributed through the MailMarshal Automatic Updates to installations with current maintenance.
Items recognized with a specific MailMarshal/SEG or FileType update are not recognized in MailMarshal Exchange/ECM.

In the tables below, Type Name refers to the name seen in the Engine log and rule listings. Description is the name as seen when selecting types in the email policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by MailMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (Current SEG)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA (Current SEG)
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file (Current SEG)
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive (Current SEG)
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File (Current SEG)
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (Current SEG)
PBIX	Power BI Report (FileType 2024-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file (Current SEG)
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (Current SEG)
UUE	UUencoded Encoding
XZ	XZ archive (Current SEG)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items in MailMarshal/SEG 8.2.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document (Current SEG)
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLS	Excel document
XLSIRM	Excel document with IRM (Current SEG)
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB (Current SEG)
ONE	Microsoft OneNote (Current SEG)
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (Current SEG)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form (Current SEG)
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (Current SEG; see Q16666)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM (Current SEG)
PPTIRM	PowerPoint document with IRM (Current SEG)
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM (Current SEG)
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DEVMODE	Windows Printer DEVMODE settings (printer.bin) (FileType 2026-02-01 and above)
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM (Current SEG)
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document (Current SEG)

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB (Current SEG)
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX (Current SEG - see note)
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (Current SEG)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (Current SEG)
STL	StereoLithography Drawing (Current SEG)

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (Current SEG)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data (Current SEG)
Switch	Egress Switch Encrypted Mail (Current SEG)
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLSIRM	Excel document with IRM (Current SEG)
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (Current SEG)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (Current SEG)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM (Current SEG)
PPTIRM	Powerpoint document with IRM (Current SEG)
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7A	SMime AuthEnveloped Data (FileType 2026-01-01 and above)
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM (Current SEG)
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail (Current SEG)

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (Current SEG)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (Current SEG)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font (Current SEG)
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format (Current SEG)
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF) (Current SEG)

Image

Type Name	Description
PSD	Adobe Photoshop Image
AVIF	AV1 Image File Format (FileType 2026-02-01 and above)
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (Current SEG)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image (Current SEG)
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (Current SEG)
TIF	Tiff image
WEBP	WebP Image File (Current SEG)
HDPHOTO	Windows HD Photo (Current SEG)
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar) (Current SEG)
ICSDescription	Calendar Meeting Invitation Description (Current SEG)
ICSSummary	Calendar Meeting Invitation Summary (Current SEG)
TPS	Clarion TopSpeed File .TPS (Current SEG)
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF (Current SEG)
DBT	dBase Memo Field File (Current SEG)
MDXdbase	dBase Multiple Index File (Current SEG)
SYS	DOS device driver (Current SEG)
VCF	Electronic Business Card .VCF (Current SEG)
ICM	Independent Color Matching .ICM (Current SEG)
InfoSlip	Infoslips document (Current SEG)
JOS	Java Object Serialized Data (Current SEG)
DSStore	Mac OSX Finder Info (Current SEG)
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (Current SEG)
PDB	Microsoft Debugging Symbols (Current SEG)
LIB	Microsoft Program Library (Current SEG)
MSBLDCACHE	MS Build Cache File (Current SEG)
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File (Current SEG)
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture (Current SEG)
PCAPNG	Packet Capture NG (Current SEG)
PEMCert	PEM encoded certificate .PEM (Current SEG - see note)
PFX	PFX Certificate Archive (Current SEG)
PGPPublicKey	PGP Public Key (Current SEG)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (Current SEG)
PBIXMetadata	Power BI Data Metadata (Current SEG)
PBIXModel	Power BI Data Model (Current SEG)
PBIXBindings	Power BI Security Bindings (Current SEG)
PBIXSettings	Power BI Settings (FileType 2024-02-01 and above)
QBB	QuickBooks Backup .QBB (Current SEG)
QBW	QuickBooks Company file .QBW (Current SEG)
RTF Object	RTF Object
SHP	Shape file (.SHP) (Current SEG)
SHX	Shape Index file (.SHX) (Current SEG)
P7S	SMime Signed Data
SQLiteDB	SQLite Database (Current SEG)
EMC	Striata Encrypted Mail Communication (Current SEG)
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (Current SEG)
VSSSCC	Visual Source Safe Source Code Control (Current SEG)
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (Current SEG)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF (Current SEG)
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX (Current SEG)
XML	XML Document (Current SEG)

Sound

Type Name	Description
AAC	AAC audio
FLSA	Adobe Flash Audio (Current SEG)
AU	AU sound file
ENC	Encore Music Notation .ENC (Current SEG)
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video (Current SEG)
FLSV	Adobe Flash Video (Current SEG)
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (Current SEG)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (Current SEG)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (Current SEG)
WEBP	WebP Image File (Current SEG)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by MailMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

Word, Excel, and PowerPoint "2007" or "2007+" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
LevelBlue Knowledgebase articles for information about earlier versions have been withdrawn.

This article was previously published as:: NETIQKB40962

Software Version	Release Date	Support Status	End of Support	End of Threat Protection Updates
12.0.0.8219	August 11, 2026	Active
12.0.0.8194	August 5, 2026	Withdrawn	August 11, 2026
11.3.0.7659	December 2, 2025	Active
11.2.0.7413	September 4, 2025	Active
11.1.0.6958	May 29, 2025	Active
10.2.5.7024	June 5, 2025	Active
10.2.5.6043	September 10. 2024	Active
10.2.0.5718	July 2, 2024	Discontinued	June 1, 2026	June 1, 2026
10.1.0.5102	April 3, 2024	Discontinued	June 1, 2026	June 1, 2026
10.1.0.5089	March 28, 2024	Withdrawn	April 3, 2024
10.0.7.3979	September 29, 2023	Discontinued	June 1, 2026	June 1, 2026
10.0.7.3969	September 12, 2023	Withdrawn	September 29, 2023
10.0.6.3739	February 28, 2023	Discontinued	February 1, 2025	June 1, 2025
10.0.5.3470	August 31, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.4.3361	May 16, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.3.2387	July 6, 2021	Discontinued	February 1, 2024	December 31, 2024
10.0.2.2230	April 28, 2021	Deprecated	July 6, 2021	December 31, 2024
10.0.1.2030	November 3, 2020	Discontinued	September 1, 2022	December 31, 2024
10.0.0.1428	April 14, 2020	Deprecated	November 3, 2020	December 31, 2024
8.3.2.11492	September 29, 2023	Discontinued	August 1, 2025	December 31, 2025
8.2.6.11305	December 22, 2020	Discontinued	February 1, 2025	June 1, 2025
8.2.4.11170	October 31, 2019	Discontinued	March 31, 2022	December 31, 2024
8.2.3.11111	July 2, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.2.11949	February 14, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.1.11863	December 14, 2018	Discontinued	March 31, 2021	December 31, 2024
8.2.0.11849	December 6, 2018	Withdrawn	December 14, 2018	December 31, 2024