LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Upgrading MailMarshal Service Provider Edition to a newer version

Charles — Thu, 12 Mar 2026 23:35:24 GMT

This article applies to:

MailMarshal SPE supported versions

Question:

What is the safe method to upgrade MailMarshal SPE from an earlier version to the currently released version?

Procedure:

To upgrade SPE, the general procedure is to upgrade the MailMarshal (SEG) servers first, then upgrade the SPE Marshal Interface Agent or console server and the SPE agents.

Product names in the installers and interfaces depend on the product versions. MailMarshal SPE (Service Provider Edition) is also known as MailMarshal SPE. MailMarshal is also known as MailMarshal SEG or MailMarshal SMTP.
This article assumes you are familiar with SEG and SPE concepts.
Before starting, review the Release Notes for the new version of SPE and SEG. Release Notes include version specific upgrade notes, such as previous version supported for direct upgrade.

The following steps are suggested to upgrade SPE safely and with minimal disruption to email flow.

Upgrading to version 5.3 from 5.2:

Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the MailMarshal software.
- At this point you will have a fully working MailMarshal solution running on the new software. You may wish to take an additional snapshot of the MailMarshal database.
Repeat steps 3-7 for each MailMarshal array.
Start your IIS server.
Upgrade the Management Interface and/or MIA server: run the SPE installer and upgrade the Management Interface and Marshal Interface Agent. The database wizard will also run and upgrade your SPE database.
Upgrade any other standalone Management Interface servers.
Verify that email processing and Management Interface functions are working correctly.

Upgrading to version 5.2 from 4.3:

Stop the Marshal Agent services on all array managers and nodes.
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software (11.2). If necessary, first install version 8.3.3. This will upgrade your configuration from the earlier version.
Repeat steps 4-7 for each MailMarshal array.
Start your IIS server.
Identify the server where Marshal Interface Agent (MIA) is installed. This server might also include the Web Console/Management Interface. Run the SPE installer and upgrade MIA and any other components. The database wizard will also run and upgrade your SPE database.
If the Management Interface is not hosted on any of the servers already upgraded, then upgrade at least one Web Console/Management Interface server.
Open the Management Interface and log in. You may need to use CTRL-F5 to update client side scripts. Make sure the configuration appears correct.
Navigate to the Server Configuration/Arrays page:
- Replication will be paused. Resume replication.
- Force a configuration reload.
Upgrade the processing nodes with the MailMarshal software.
For each processing node, if you have not restarted the node after the upgrade, restart the Controller service. This step ensures a full configuration update for all the processing services. Notably the "loopback" delivery of messages between customers may not work until you do this.
Upgrade any additional Web Console/Management Interface servers.
On all servers that have only the MailMarshal components (Array Manager and/or Nodes), uninstall SPE 4.X. The only SPE component affected is the Marshal Agent, which is no longer used in version 5.X.

Upgrading to version 4.X:

Stop all SPE services on all array managers and nodes (Depending on version this may include Marshal Agent, Replication Agent, Status Agent, Maintenance Agent, Reporting Agent).
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the SEG Array Manager.
Take a snapshot of the SEG database.
Start the SEG Array Manager.
To ensure ability to roll back, create a backup of the SEG configuration by running the MMExportCfg in the SEG directory (typically in SEG version 8.X: C:\Program Files\Trustwave\Secure Email Gateway)
- For instance: MMExportCfg MMBackupOct2008.xml
- For details of locations for earlier SEG versions, see article Q10832.
- For SEG 8.0 if DKIM is in use, also ensure you have exported DKIM keys. They are not included in SEG 8.0 backups.
Upgrade the array manager with the supported version of SEG software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the SEG software.
- At this point you will have a fully working SEG solution running on the new software. Take a configuration backup (as in step 7) and a snapshot of the SEG database.
Repeat steps 4-9 for each SEG array.
Start your IIS server.
Upgrade the Web Console and/or MIA server: run the SPE installer and upgrade the web console and Marshal Interface Agent (Maintenance Agent in earlier versions). The database wizard will also run and upgrade your SPE database.
When the installer and database wizard completes successfully, log into the SPE console and make sure the configuration appears correct. Arrays will not be connected at this stage.
Run the SPE installer on all Array Managers to upgrade the Replication Agent or Marshal Agent (depending on version).
Force a configuration reload on the SPE web console (Arrays->Force Reload).
Monitor the Array Manager logs for any errors. If you encounter any problems, stop and disable the SPE agent on the Array Manager (Marshal Agent for 3.8 and above, Replication Agent for earlier versions). Restore the SEG configuration (from the backup you took in step 7 above), and restart the Array Manager. You will not need to restore the SQL database. Do not proceed further but contact LevelBlue Technical Support for assistance.
Upgrade the Marshal Agents on the nodes.
If upgrading to a version below 3.6, upgrade the reporting agent. (3.6 and above does not use a separate reporting agent.)
Restore any custom branding. The upgrade creates a dated backup of the website directory, including the branding subdirectory. Move required items to the production website\branding folder.
If you use custom themes for the Customer Console or SQM, you may need to update the themes to cover new features. See the linked article below for more information.
- Release 4.0 includes breaking changes to the SQM login page.
- Release 3.6.2 includes significant changes in the Customer Console themes from 3.6.1.

Notes:

For some versions, the Release Notes recommend stopping all Marshal services including all SEG services during upgrade. This recommendation was to ensure that some settings are updated when services start. Normally you can follow the steps above and SEG services can remain running during the SPE upgrade.

For upgrade from SEG 8.0 or below with DKIM keys, in the rare case that you must roll back the SEG upgrade, you might need to re-import DKIM keys on the nodes. Contact LevelBlue for assistance.

Product Licensing for DbProtect and AppDetctivePRO

Charles — Thu, 12 Mar 2026 22:26:32 GMT

This article applies to:

AppDetectivePRO
DbProtect

Question:

How many licenses do I need for my installation of AppDetectivePRO or DbProtect?
What is the scope of a unique database under protection?

Information:

LevelBlue licenses its AppDetectivePRO and DbProtect products based on the number and type of databases.

In the realm of structured and unstructured databases that can be deployed in standalone, SaaS, or PaaS architecture, the interpretation of a single licensed entity varies. The interpretation of a “unique database” is based on the boundary of a given database or datastore that allows for customization of security, configuration, patching and other variances. The definitions below specify the scope at which a license is considered as consumed for the database platform.

Database or Node Definitions by Platform

Database/Datastore Platform	Unit Under Protection Scope
Amazon Dynamo DB	Per AWS region and availability zone
Amazon RDS (MySQL, MSSQL, Oracle, MariaDB, PostgreSQL)	Per host/IP and port (and instance/SID where applicable)
Amazon RDS Aurora (MySQL, PostgreSQL)	Per host/IP and port
Azure SQL Database	Per database, host/IP and port
Azure SQL Managed Instance	Per instance, host/IP and port
Cassandra	Per host/IP and port
Couchbase	Per host/IP and port
Elasticsearch	Per instance/node, host/IP and port
IBM DB2 for z/OS	Per Db2 subsystem, host/IP and port
IBM DB2 LUW	Per instance and database, host/IP and port
MariaDB	Per host/IP and port
Microsoft SQL Server	Per instance (or each instance when multiple instances installed on the same host), host/IP
MongoDB (Enterprise Editions Only)	Per instance, host/IP and port
MySQL	Per host/IP and port
Oracle	Per SID, host/IP and port
Percona for MySQL	Per host/IP and port
PostgreSQL	Per host/IP and port
Redis Enterprise	Per host/IP and port
Sybase	Per instance (or each instance when multiple instances installed on the same host), host/IP
Teradata Database	Per host/IP and port

License expiry and overage behavior

A license usage banner is visible within the product, providing real-time insights into license compliance and validity. If there is any discrepancy between the number of licenses purchased and actual usage, users will be promptly notified. Additionally, notifications will alert users in cases of impending license expiry or any issues affecting license functionality, helping ensure uninterrupted access and compliance.

Upgrading SQL Reporting Services to SQL 2022

Charles — Wed, 04 Mar 2026 20:55:35 GMT

This article applies to:

Marshal Reporting Console
SQL Server and SSRS 2022

Question:

Can I install MRC with SQL 2022?
Can I upgrade the MRC SQL and SQL Reporting Services instances to SQL 2022?

Procedure:

MRC 2.6 cannot be directly installed with SSRS 2022. However it is possible to upgrade the standalone MRC instances to SQL 2022 and SSRS 2022.

This procedure assumes you have installed MRC using the bundled SQL Express 2016 Advanced installer, and tested operation.

Install SQL 2016 Service Pack 3 for the MRC_SQLEXPRESS instance. A computer restart will be required after installation.
From the Start menu, open Reporting Services Configuration Manager.
- Note the Report Server Database Name (by default, ReportServer$MRC_SQLEXPRESS). If you have used custom credentials, note the settings.
- From the Encryption Keys page, back up the key to a file.
- Exit the Reporting Services Configuration Manager.
Install Microsoft SQL Server 2022 Reporting Services.
- Choose the free edition Express.
- On the Setup Complete screen, click Configure report server.
In the Report Server Configuration Manager:
- On the WebService URL page, click Apply to accept the default values.
- On the Database page, click Change Database. In the wizard,
  - Select Choose an existing report server database.
  - On the Database Server page, the Server Name is the local computer name with MRC_SQLEXPRESS. Do not choose "Encrypt".
  - On the Database page, select the database you noted in step 2.
  - On the Credentials page, if you have not used the default service credentials, enter the credentials you noted in step 2.
  - Complete the wizard, click Finish, and exit the wizard.
  - On the Encryption Keys page, restore the key from your backup. You will be asked for confirmation to remove other registered servers. Click OK to this question.
  - Exit the Reporting Services Configuration Manager.
Upgrade to SQL Server 2022 Express.
- On the Welcome screen, choose the Custom option.
- On the Installation Center screen, choose Upgrade.
- On the Select Instance screen, select MRC_SQLEXPRESS.
- On the Reporting Services Migration screen, check the box Uninstall Reporting Services.
- Complete the upgrade process.

Notes:

On Windows Server 2025 the MRC installer cannot be used to install SQL Express. However you can manually install SQL Express 2016 SP3 Advanced before installing MRC, and choose to use the existing installation.
- Do not select installation of "R Services"
- Remember to select "Mixed Mode" authentication.
- You must also enable TCP connections to the SQL instance, using SQL Configuration Manager.
In some cases (where a current release of MailMarshal Array Manager is installed on the same server), the installation of SQL 2022 may report an error on installation of MSOLEDBSQL.

You can safely ignore this error and continue. MailMarshal has already installed a compatible version of MSOLDDBSQL.
If the error appears in the rules check and you cannot continue:
- Stop the MailMarshal Array Manager.
- Uninstall the offending version of MSOLEDBSQL.
- Upgrade SQL
- Re-install the version of MSOLEDBSQL. All versions are available for download from Microsoft.
- Start the Array Manager.

Additions to Release Notes for Marshal Reporting Console 2.6

Charles — Wed, 04 Mar 2026 19:37:41 GMT

This article applies to:

Marshal Reporting Console 2.6

Question:

What are the Release Notes for Marshal Reporting Console 2.6?

Information:

The Release Notes included with Marshal Reporting Console 2.6 are accurate as of the date of publication. The latest release of Marshal Reporting Console is 2.6.0.1469, released September 13, 2018.

This article provides any additional information generated after that date.

Supported Operating Systems and SQL versions

MRC 2.6 can be installed on all Windows Server operating systems up to Server 2025.

The latest SQL Server version supported for installation remains at SQL 2016 with SSRS, or 2016 Express Advanced.
After installing MRC with SQL 2016 Express Advanced, you can upgrade to SQL 2022.
On Windows Server 2025, you must first install SQL Express Advanced 2016 SP3 using the installer available from Microsoft.
See LevelBlue Knowledgebase article Q21228.

MRC 2.6 cannot be installed on Windows 10 (contrary to any earlier statement). LevelBlue strongly advises against installing MRC on a workstation operating system due to resource allocation factors.

MRC 2.6 can be installed on Windows Server 2008 R2. However, the included SQL Express 2016 cannot be installed on Windows 2008 R2.

The minimum Operating System requirement for a new installation of MRC 2.6 with SQL Express 2016 is Windows Server 2012.
If you must perform a new installation of MRC 2.6 on Windows 2008 R2, pre-install and use SQL Express Advanced Edition 2014 or earlier.

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

Charles — Tue, 24 Feb 2026 21:13:18 GMT

This article applies to:

MailMarshal (SEG) 7.X and above
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

What is the version of the Unpacker and File Type DLLs for my version of SEG or ECM?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function (SpamCensor updater) for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file. Files that can be automatically updated are found on the Array Manager, in the Config subfolder of the SEG installation.

Latest File Versions

Notes:

From May 2024, Unpacker and File Type releases are combined.
Available Release Notes for each release are linked in the tables below.
Updates are no longer published for SEG versions 8.2.6 and below, or for MailMarshal 10.0.0 through 10.0.6 Product support for these releases has ended.

MailMarshal (SEG) Supported Versions

Product Version File Type and Unpacker Version

10.0.7 through 11.3.0

2025.04.03
(Filetype DLL version 2025.04.02)
February 24, 2026

Product Version	File Type and Unpacker Version
10.0.7 through 11.3.0	2025.04.03 (Filetype DLL version 2025.04.02) February 24, 2026

MailMarshal (SEG) Older Versions

Product Version File Type and Unpacker Version

8.3.2

2025.02.01
July 7, 2025

8.2.6
10.0.4 through 10.0.6

2024.04.01
December 5, 2024

10.0.3

2024.02.01
May 7, 2024

Product Version	File Type and Unpacker Version
8.3.2	2025.02.01 July 7, 2025
8.2.6 10.0.4 through 10.0.6	2024.04.01 December 5, 2024
10.0.3	2024.02.01 May 7, 2024

Product Version Unpacker Version File Type Version

8.2.0 through 8.2.4
10.0.0 through 10.0.2

2023.03.01
September 26, 2023 2023.03.01
September 26, 2023

8.1.0 through 8.1.3 8.1.11
October 4, 2021 8.1.6
October 4, 2021

8.0.1 through 8.0.7 8.0.10.556
October 20, 2020 8.0.6
October 6, 2020

8.0.0
8.0.0
July 18, 2017 8.0.0
July 18, 2017

7.5.8
7.5.7
7.5.6
7.5.5 2.5.5
February 26, 2019 7.14.6
January 24, 2019

7.5.1 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.5.0 2.3.3
December 1, 2015 7.13.2

7.3.6 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.3.5 2.5.1
October 4, 2017 7.14.0.317
July 20, 2017

7.3.0 2.1.5
May 3, 2015

7.2.3 2.0.8
February 17, 2015

7.2.2 2.0.3
May 16, 2015

7.2.1
7.2.0 2.0.3
January 8, 2014

7.1.2 1.0.0
December 8, 2014

Product Version	Unpacker Version	File Type Version
8.2.0 through 8.2.4 10.0.0 through 10.0.2	2023.03.01 September 26, 2023	2023.03.01 September 26, 2023
8.1.0 through 8.1.3	8.1.11 October 4, 2021	8.1.6 October 4, 2021
8.0.1 through 8.0.7	8.0.10.556 October 20, 2020	8.0.6 October 6, 2020
8.0.0	8.0.0 July 18, 2017	8.0.0 July 18, 2017
7.5.8 7.5.7 7.5.6 7.5.5	2.5.5 February 26, 2019	7.14.6 January 24, 2019
7.5.1	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.5.0	2.3.3 December 1, 2015	7.13.2
7.3.6	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.3.5	2.5.1 October 4, 2017	7.14.0.317 July 20, 2017
7.3.0	2.1.5 May 3, 2015
7.2.3	2.0.8 February 17, 2015
7.2.2	2.0.3 May 16, 2015
7.2.1 7.2.0	2.0.3 January 8, 2014
7.1.2	1.0.0 December 8, 2014

ECM

Product Version Unpacker Version

7.2.0
7.1.7
7.1.6
7.1.5 1.0.5
February 28, 2019

Product Version	Unpacker Version
7.2.0 7.1.7 7.1.6 7.1.5	1.0.5 February 28, 2019

Failed to fetch server details: The server has not been configured yet - required security data not available

Charles — Sun, 22 Feb 2026 20:56:49 GMT

This article applies to:

MailMarshal

Symptoms:

Error seen as "toast" pop-up in Console, and in Console log files.
Failed to fetch server details: The server has not been configured yet - required security data not available
Some parts of the Console do not load.
The Controller service log (configuration check) may also indicate that no valid configuration is available.

Causes:

This error is caused by incomplete loading of configuration in the Array Manager service.
Because configuration is not fully loaded, the MailMarshal REST API is not available to other components including the Console website.
The most common reason for this issue is that a Syslog database is configured but not accessible.

Resolution:

For the Syslog related issue:

Use the MailMarshal Server Tool to verify the configuration and existence of the Syslog database. If necessary update the configuration or create a new database.

Notes:

To check for other possible causes of this error, see the Array Manager text log for a time when the service is restarted.

ACTION REQUIRED: TLS "Client Authentication" usage sunset

Charles — Mon, 16 Feb 2026 22:27:08 GMT

This article applies to:

MailMarshal
TLS validation rules

Background:

TLS Certificates issued by public Certificate Authorities will no longer enable the Extended Key Usage (EKU) "Client Authentication". This is an industry-wide initiative to enhance security.

Most CAs have already stopped including this EKU in certificates by default. Most CAs will fully remove the EKU from all certificates issued after May 1, 2026. For example see this information from Digicert (external link).

To ensure that you can continue to receive email via TLS, you must allow SMTP Client Certificates that do not contain the "Client Authentication" EKU.

MailMarshal Rule Update Required:

MailMarshal TLS Client Certificate rules must be updated to not enforce the requirement "Intention: Client Authentication".
Most MailMarshal versions have a default enabled Connection rule that applies this requirement.
- The rule is "TLS Connection Properties > Reject non-client TLS Certificates"
Customers could also have enforced this condition in a Content Analysis rule.
Disable the default rule and any rules that only contain "Intention: Client Authentication". If you have a rule that checks for multiple conditions, set the "Intention" to "Not Checked".

Notes:

The change to the EKU could also affect outbound connections, if the remote server is enforcing the requirement for the "Client Authentication" EKU.

After updating your server TLS certificate to a certificate that does not contain the EKU, you should monitor mail history for TLS related delivery failures.
If you find your certificate is being rejected, you may need to contact the owner of the remote server.

Additions to Release Notes for MailMarshal 11.3

Charles — Wed, 11 Feb 2026 21:58:30 GMT

This article applies to:

MailMarshal 11.3

Question:

What are the Release Notes for MailMarshal 11.3?

Information:

MailMarshal version 11.3 (11.3.0.7659) was released on December 2, 2025. The Release Notes included with the product are generally accurate as of the date of publication.

This article provides any additional information or corrections generated after that date.

See also article Q21135 for information about Known and Fixed Issues.

For current updates and information, customers should subscribe to the Notifications forum.

SQL Server version requirement

Take note that MailMarshal 11.3 requires SQL 2017 or above, as mentioned in system requirements.

If upgrade is attempted with databases hosted on an earlier SQL version, you may see a credential request early in the installation process (even though correct credentials were entered or not required).
To resolve this issue, upgrade SQL or SQL Express to a supported version such as SQL 2022.

Update from 11.2 with multiple servers

If you have an installation with separate email processing servers and Array Manager:

Ensure you upgrade all processing servers before making any changes to rules.

The configuration written by version 11.3 will be loaded and used by the version 11.2 nodes.

However, any use of the new "is not" options in rule conditions may cause services to stop.

This issue only relates to the new options introduced in 11.3. Rules with the pre-existing "is not" conditions continue to function as before (for example, "file is not of type").

Supported Operating Systems and Prerequisite Versions

Charles Creegan — Tue, 02 Dec 2025 01:43:09 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM		RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is not supported.	SQM works with current versions of Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer may be usable but is not recommended.	MRC works with Edge, and with Firefox and Chrome current versions. Internet Explorer may be usable but is not recommended.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Supported Operating Systems and Prerequisite Versions for MailMarshal SPE

Charles Creegan — Tue, 02 Dec 2025 01:41:10 GMT

This article applies to:

MailMarshal SEG Service Provider Edition

Question:

What are the supported operating systems for MailMarshal SPE?
What version of SQL Server can be used with MailMarshal SPE?
What versions of IIS and ASP.NET are supported by MailMarshal SPE?
What versions of Internet Explorer are supported for MailMarshal SPE?

Information:

The following table shows supported versions of operating systems and supporting software for MailMarshal SEG Service Provider Edition (SPE).

This article applies only to the latest released version (as noted in the table). For information about earlier versions, see the documentation provided with each version.

For more detailed information please see the MailMarshal SPE Administrator Guide.

Note: The operating system requirements apply to the main SPE server (Marshal Interface Agent server), Web Console servers, and all servers where SPE components are installed, including MailMarshal SEG servers managed by SPE. For information about supported operating systems for MailMarshal SEG, see the SEG Release Notes.

Key:

Symbol	Meaning
	Tested, Supported. No known issues
SPn	Minimum required service pack of the software
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds
	Not currently supported, obsolete, or known issues
	Not specifically tested, but LevelBlue plans to support the released version when it is available and has passed internal testing.
(blank)	Not applicable to this product

	MailMarshal SPE 5.3
Windows 2025
Windows 2022
Windows 2019
Windows 2016
Windows 2012 R2 Microsoft EOS October 2023
Windows 2012 Microsoft EOS October 2023
Windows 2008 R2 Microsoft terminated extended support on 14 January 2020.
Windows 2008 or below
Windows Core Edition
Windows XP Windows Vista Windows 7
SQL Express (Not supported in any version)
SQL 2025 (SQL Server Authentication or Mixed Mode is required)
SQL 2022 (SQL Server Authentication or Mixed Mode is required)
SQL 2019 (SQL Server Authentication or Mixed Mode is required)
SQL 2017 (SQL Server Authentication or Mixed Mode is required)
SQL 2016
SQL 2014
SQL 2012: Microsoft terminated support in July 2022
SQL 2008 R2: Microsoft terminated support on 9 July 2019.
SQL 2008 or below
Internet Explorer
Firefox, Chrome, Edge, Safari (supported versions) for all web interfaces
IIS (as provided on supported OS)
ASP.NET 6.0 (Required)
ADO/MDAC 2.5
ADO/MDAC 2.7 or above
MailMarshal SEG 11.2.0, build for SPE (This is the only version supported for SPE 5.2.0. For details of the SEG version allowed with each SPE release, see article Q20963.)

What versions of MailMarshal SPE are currently supported by LevelBlue Technical Support?

Charles — Tue, 02 Dec 2025 01:40:19 GMT

This article applies to:

MailMarshal SEG Service Provider Edition (SPE)/MailMarshal SPE

Question:

What versions of MailMarshal SPE are currently supported by LevelBlue Technical Support?

Information:

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For "discontinued" versions, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

All versions earlier than those listed are discontinued.

Threat Protection for SEG includes SpamCensor, AMAX, and other malware detection scripts maintained by LevelBlue Spider Labs Research.

Software Version

Release Date

Support Status
End of Support End of SEG Threat Protection Updates

SPE Version
5.3.0.22502
MailMarshal Version
11.3.0.7659 December 2, 2025 Active

SPE Version
5.2.0.22293
MailMarshal Version
11.2.0.7413 September 4, 2025 Active

SPE Version
4.3.5.20677
SEG Version
8.3.2.11492 April 9, 2024 Active   January 31, 2026 December 31, 2025

SPE Version 4.3.4.20423
SEG Version 8.3.2.11492 October 4, 2023 Active   January 31, 2026 December 31, 2025

SPE Version 4.3.3.20042
SEG Version 8.3.1.11439

July 11, 2023

Active
  January 31, 2026 December 31, 2025

SPE Version 4.3.0.19124
SEG Version 8.3.0.11436

October 11, 2022

Active
January 31, 2026 December 31, 2025

SPE Version 4.2.4.16662
SEG Version 8.2.6.11305

December 22, 2020

Active
December 31, 2025 June 1, 2025

SPE Version 4.2.0.14203
SEG Version 8.2.4.11170

October 31, 2019

Active
December 31, 2025 December 31, 2024

SPE Version 4.0.3.20390
SEG Version 8.0.7.11235

February 12, 2019

Discontinued
March 31, 2021 March 31, 2021

SPE Version 4.0.1.19758
    SEG Version 8.0.7.11235 (recommended)
    SEG Version 8.0.6.10796 (also supported)

March 6, 2018

Discontinued
August 1, 2020 March 31, 2021

SPE Version 4.0.0.19570
    SEG Version 8.0.5.10552

December 12, 2017

Discontinued
March 6, 2018 March 31, 2021

Notes:

For information about virus scanner plug-ins, see the Related Articles below.

What are the Release Notes for MailMarshal SPE 5.3?

Charles Creegan — Tue, 02 Dec 2025 01:38:34 GMT

This article applies to:

MailMarshal SPE 5.3

Question:

What are the Release Notes for MailMarshal SPE 5.3?

Information:

The Release Notes included with MailMarshal SPE 5.3 are accurate as of the date of publication.

Build 5.3.0.22502 was published on December 2, 2025.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 5.3 from 5.2.0 only

To upgrade from 4.3.x you must first upgrade to 5.2.0.

SQL Prerequisite Change

The minimum SQL version supported is SQL 2017.

Known issues for Current MailMarshal versions

Charles — Tue, 02 Dec 2025 01:25:15 GMT

This article applies to:

MailMarshal (SEG) 10.X and 11.X

Question:

What are the known issues and limitations for MailMarshal?

Information:

This article highlights differences between major versions of MailMarshal, as well as any known issues and major fixed issues.

SQL version requirement for upgrade to 11.3

SQL 2017 is the minimum version required for successful upgrade to 11.3. SQL 2016 will be blocked by the installer.

Known issue with upgrade to 11.1 or 11.2 using SQL 2014

SQL 2016 is the minimum version required for successful upgrade to 11.1 or 11.2. SQL 2014 is allowed by the installer but the upgrade will not fully succeed. For details and remediation, see article Q21223.

Known issues with the Entra Connector (11.2)

These issues are corrected in release 11.3.

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, connections to Entra will fail. Use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Import of a group can fail if the group "description" is blank or the group has a large number of members. A hotfix is available - contact Support.

Known issues with upgrade from 8.3.2 to 10.2.X

For installations with separate processing nodes, after upgrading a processing node the MailMarshal Controller service will not start.

A new release 10.2.5.7024 has been issued to correct this problem. Customers upgrading from 8.3.2 with node only servers MUST use this new release. See the MailMarshal Previous Version Downloads page.
A workaround is available for systems actually in the problem state. Contact LevelBlue Support.

For installations using Image Analyzer, after upgrade the MailMarshal Engine may stop when processing images.

Check the Config folder on Array Manager for the file "plugins.xml".
Remove the file "plugins.xml" from the Config folder. Then, on each processing node, remove the file from the NodeConfig folder.
This issue only affects upgrades from 8.X to 10.2 (not earlier 10.X releases).

Updates released in MailMarshal 10.2.5:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.5.

The Console now validates moved rules to prevent moving a target rule above a rule that refers to it (circular policy).
Moving or copying rules between Policy Groups is supported.
Policy printing is supported.
Connector user groups selected for some uses did not display in the user interface. This display issue is fixed. Note that LevelBlue recommends using local groups in these settings (Digests, SpamProfiler exclusions, and DHA settings) with the connector groups as members.

Known issues in 10.2.X:

Some customers have reported an issue in release 10.2.5 with the Array Manager service halting at 0100 local time.
- The issue affects installations in non-default locations (such as D drive).
- The source of this issue has been identified and an update has been published through Automatic Updates.
- If your installation cannot receive the automatic updates, you can request this file through a support case.
- Customers are also encouraged to set the service recovery action to restart the Array Manager automatically.

For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal 10.2.0:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.0.

In rare cases, deletion of deeply nested unpacked files could fail.
In version 10.1, in rare cases, child user groups were not correctly loaded on processing nodes.
A new version of the third party SSL library is included. This version addresses performance issues identified in 10.0.7 and 10.1.0
Performance of Image Analyzer has been adjusted. Some scanning issues have been addressed.

Known performance issue in 10.0.7 and 10.1.0

The third party SSL library used in these versions of MailMarshal has been found to use more system resource than earlier releases when under load. It may also initialize more slowly for each connection. In some cases, email throughput can be affected.
A new version of the library is provided in version 10.2.0 and above.

Known issues in 10.1.0:

LevelBlue identified an issue with database insertion in the original release 10.1.0.5089. This issue could affect the display of data in Mail History and the ability to manage processed messages. The issue is resolved in 10.1.0.5102.
- Release 10.1.0.5089 has been withdrawn. Customers must upgrade to the current release 10.1.0.5102.
For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal (SEG) 10.1.0:

The following issues or limitations present in MailMarshal (SEG) 10.0.7 and below have been resolved in version 10.1.0.

"Unsafe legacy renegotiation" can be enabled with a configuration setting. See LevelBlue Knowledgebase article Q21216.
DKIM record status is correctly displayed in the Management Console Local Domains detail.
The installer does not exit without warning after checking for Visual Studio updates.
See Release Notes for additional updates.

Known issues in 10.0.7:

Unsafe legacy renegotiation disabled: The TLS/SSL library included in release 10.0.7 (and above) does not negotiate outbound (sender) TLS connections where the remote server only supports legacy renegotiation of TLS. The risk in legacy renegotiation is described in CVE-2009-3555. Servers that still use this legacy method are very rare. A hotfix is available for customers who have a business need to allow this risk.
The original 10.0.7 release (3969) caused unexpected changes in TLS behavior. This release has been withdrawn from download pages. The currently available release 10.0.7.3979 corrects this issue. Any customers who installed the earlier release should upgrade immediately.
On some systems the installer will exit with no warning after checking for Visual Studio updates. To continue, simply run the installer again.
Restoring a backup created in an earlier version will cause processing services to stop, because the SSL libraries will be overwritten with the earlier and incompatible versions. For more information and resolution steps, see LevelBlue Knowledgebase article Q21209.

Important Known Issues in 10.0.4:

Folder changes cause quarantine problem: If you edit properties of a Folder, the physical path location information is lost. Message files are stored in an incorrect location. Message details and release for earlier quarantined messages do not work.
Folder editing is corrected in later releases. However, any changes made in 10.0.4 are not automatically fixed.
For customers who encounter this issue, a tool is available to detect incorrectly configured folders and move the incorrectly stored files. Contact LevelBlue support.

Updates released in MailMarshal (SEG) 10.0.7:

The following issues or limitations present in MailMarshal (SEG) 10.0.6 and below have been resolved in version 10.0.7.

Node servers can now be deleted from the installation in the Console.
Import of configurations could fail due to an issue with parsing of XML. This issue is corrected.
See Release Notes for additional updates.

Updates released in MailMarshal (SEG) 10.0.6:

The following issues or limitations present in MailMarshal (SEG) 10.0.5 and below have been resolved in version 10.0.6.

Upgraded installations that have custom Relay or Routing tables did not show the correct values in the website editor initially and other settings for a server could not be changed, with error "The Name field is required". This issue is corrected for new upgrades from version 8.X. To resolve the issue manually, select and save the desired settings for these tables.
Connector group members are not preserved in the upgrade from 8.2 to 10.0, or on restore of a configuration backup. Upgrade and restore now initiate an immediate refresh of these groups.
Console folder date issues related to Daylight Saving Time changes have been resolved.

Updates released in earlier releases:

This section highlights significant fixes that are included in releases 10.0.1 through 10.0.5. See release notes for full information.

In release 10.0.4, editing of folder properties caused messages to be stored in an incorrect location.
In release 10.0.4, for Windows authentication users, the "light" theme was not applied when selected.
In release 10.0.4, the rule condition "sender authenticated successfully" was no evaluated as expected.

Installation/Upgrade:

Prerequisite check on nodes now correct handles the case where IIS was previously installed then uninstalled.
The Configuration Service now accepts passwords that contain the characters: ; = '
Upgrade correctly determines the database location if the location was changed.
Validation of group names is improved.
Detection of WebDAV by the installer is corrected.
Issues with folder and history display when installing the Array Manager on non-English Windows distributions are corrected.
The installer detects port conflict issues (most likely where Exchange or another mail server is installed on the same server). For more discussion of steps required when installing on Exchange Server, see LevelBlue Knowledgebase article Q21146.
The installer prompts for an Operational User for the Configuration Service database if required.
Upgrade handles additional cases where rules (including disabled rules) contain references to templates, folders, or other rules that no longer exist or where the reference was malformed.

Policy elements and settings:

The retention setting shown on the Management Console Reporting page is correctly applied.
On upgraded installations, all Connector groups synchronize as scheduled.
Issues with incorrect selection of items in list views are corrected.
Message Templates and Message Stamps will now use the HTML formatting created using the WYSIWYG editor. You can also continue to use the stylesheet method described in Help.
Timezone offsets are correctly applied to all items in the Dashboard.
Unicode characters in subjects are handled correctly.
Folder permissions using Windows accounts are correctly retained.
In 10.0.2, changing Reporting Groups in the Management Console prevented further configuration changes. This issue is fixed.
Re-commit of the current configuration can be requested from the system configuration > General page.
Reporting Groups configuration is present.
- Caution: An issue has been identified in the Reporting Group interface 10.0.2. Upgrade to 10.0.3.
The Variables list on the HTML message stamp editor is corrected.
Rules can be enabled or disabled from the list view.
Entry of service names/keys in Advanced Settings is no longer case sensitive.
When restore takes a long time, the Management Console correctly shows the status.
Automatic backups are performed only if selected.
Maintenance expiry is correctly shown on the License page.
Configuration can be committed as prompted after entering a license key.

Mail View

Raw HTML source of email can be viewed.
Large lists load with acceptable speed.
Selecting an item no longer causes display issues on smaller resolution displays.
Deleting or forwarding from a filtered list selects the correct item.
Sorting is case-insensitive (as in 8.X).
Issues with folder display in certain timezones are corrected.
Filtering on the Message History pages is corrected. Note that filtering applies only to the displayed page, by design. To search over all available items, use Search instead.

Functionality first added in MailMarshal (SEG) 10.0.1:

The following features (present in SEG 8.X but not in 10.0.0) are included in current releases:

Folder physical path setting for individual folders
Folder security for individual folders
Authorization for configuration and email management by Windows accounts
Granular folder access authorization
Configuration commit scheduling

Known Issues in MailMarshal (SEG) 10.0 and above

Installation/Upgrade

Configuration import error
- Configuration import will fail if services are not listening on the default IP and port. To import manually (using MMExportCFG), use the -a and -c parameters to set the correct server and port information.
Database Collation:
- The MailMarshal databases MUST use a Case Insensitive collation. Installation of SQL sets collation based on the server locale. Most locales use Case Insensitive collation. If in doubt set the database collations to the default SQL_Latin1_General_CP1_CI_AS. Note that the collation MUST NOT be Turkish_CI_AS due to special treatment of the letter "i" in Turkish.
Azure Databases:
- The Installer and Server Tool cannot currently create Azure SQL managed instance databases. SEG can use Azure databases if they are created in advance.
Upgrade - TLS 1.3 and Elliptic Curves:
- LevelBlue previously suggested use of the secp521r1 Elliptic Curve for key exchange. Customers should be aware that if this is the only curve enabled, email delivery from Gmail may not succeed. This change is due to TLS1.3 behaviors and Google's decision not to use the secp521r1 curve.
- The X25519 curve is widely used and this is the default in both SEG 8.2 and MailMarshal (SEG) 10.0 and above.
- To check settings see the Inbound Security - TLS page for each mail server.
Array Join credentials:
- Adding an "Array Join" credential in the SEG Server Tool (used to join a processing server to an array) requires a restart of the Array Manager. The tool does not prompt you for this restart.

Policy Elements and Settings

Configuration restore:
- A restored configuration is committed with no confirmation or possibility of review in some cases.
- Restoring a configuration from a previous version that has rules referencing SpamZeroDay.xml and KnownThreats.xml causes the Engine to stop. (The upgrade process blocks upgrade of these configurations, but restore does not.)
- Restoring a configuration fails if any local MailMarshal user group name contains a fullstop character ( . ) . The error reported in logs may not identify the specific group. Older MailMarshal versions did not validate names. Upgrade validation does not allow these characters when upgrading from 8.X to versions 10.0.4 thorugh 10.2.5.
Configuration backup:
- The retention setting applies to manual as well as automatic backups, since the files are created in the same location. To save manual backups, copy them to another location.
- Backups and restores do not include DKIM keys unless a password is explicitly entered either as default or as override. No warning about missing passwords or unsaved keys is provided.
- A custom backup location set in SEG 8.X will apply in MailMarshal (SEG) 10.0 and above. This setting currently cannot be edited in the new versions.
Licensing:
- Blended Threat licensing status is not shown on the License page.
- Maintenance expiry shows today's date if the key cannot be validated through the LevelBlue website (it should display "unknown").
- Reminders about license status (seen in earlier versions) are not provided when you enter a new key.
- Entering a key that has a Marshal RBL credential forces configuration commit with no notice.
- Upgrading with an expired key results in no key being displayed on the License page. This behavior will not be changed.
Mail Server settings:
- If custom settings have been configured, reverting to the default settings and saving does not update the display in the console. The settings have actually been updated correctly.
Policy Elements:
- Dead Letter folders are not configurable in the Folders list.
Rules
- Enabling default virus scanner rules does not validate that a scanner is present and working.
Users
- Setting a user to "blocked" or "deleted" is only effective after a restart of the Management Console website.

Mail View

Message History:
- The default view of message history only shows items from "today". To see all items, use Search. The default should be to return all items up to the configured row count.

API

Some REST API calls listed in the automatically generated "handler listing" are not available. This includes TextCensor addition, edit, and deletion

Limitations in MailMarshal (SEG) 10.0 and above

The following functionality that was present in previous versions is not currently available in 10.0 and above.

Finding items in User Groups and IP Groups
Restore from Mail Recycle Bin (this does not affect retention of messages)
RSS news feeds
- Alternative: subscribe to the Notifications forum on the LevelBlue support site

Retired Features

The DMARC Dashboard has been retired. Customers must use third party services for this functionality.

The "Do not log to SQL" option when deleting a message is not available in this version of MailMarshal.

Restarting Processing Services for one node at a time

Charles — Tue, 02 Dec 2025 00:51:15 GMT

This article applies to:

MailMarshal 11.3 and above

Question:

How can I keep at least one node running when service restart is required?

Background:

Some changes to MailMarshal configuration require restart of the processing services. This includes some automatic updates that may occur with no user input.

By default all nodes update the running configuration, including service restarts, as soon as the new configuration is received.

For installations with more than one processing node server, it is possible to make the restart happen for only one node at a time.

Procedure:

To enable restart management, in the Management Console add the following Advanced Setting:

Name: RestartOneNodeAtATime
- Type: Boolean
- Value: True (selected) to enable the feature.

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

Charles Creegan — Tue, 02 Dec 2025 00:47:16 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal Secure Email Server/MailMarshal SES

Question:

What versions of MailMarshal (SEG) are currently supported by LevelBlue Technical Support?
What versions of MailMarshal ECM/MailMarshal Exchange are currently supported by LevelBlue Technical Support?
What versions of MailMarshal Secure Email Server are currently supported by LevelBlue Technical Support?

Information:

Important: End of Support and End of Threat Protection dates for many earlier versions have now passed.

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For versions that have passed the end of support, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

Versions out of support do not receive component updates such as file type and unpacking updates.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Automatic updates to LevelBlue threat protection technologies for SEG (such as SpamCensor, Known Threats, YAE scripts) may be provided to some versions that are out of support. The table below lists this date separately.

All versions earlier than those listed are out of support and do not receive threat protection updates.

This includes MailMarshal 8.0.X and 8.1.X.

MailMarshal (SEG)

Software Version

Release Date
Support Status
End of Support

End of Threat
Protection Updates

11.3.0.7659 December 2, 2025 Active

11.2.0.7413 September 4, 2025 Active

11.1.0.6958 May 29, 2025 Active

10.2.5.7024 June 5, 2025 Active

10.2.5.6043 September 10. 2024 Active

10.2.0.5718 July 2, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5102 April 3, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5089 March 28, 2024 Withdrawn April 3, 2024

10.0.7.3979 September 29, 2023 Active June 1, 2026   June 1, 2026

10.0.7.3969

September 12, 2023

Withdrawn

September 29, 2023

10.0.6.3739

February 28, 2023
Discontinued February 1, 2025 June 1, 2025

10.0.5.3470

August 31, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.4.3361

May 16, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.3.2387

July 6, 2021
Discontinued
February 1, 2024
December 31, 2024

10.0.2.2230

April 28, 2021

Deprecated

July 6, 2021
December 31, 2024

10.0.1.2030

November 3, 2020
Discontinued
September 1, 2022
December 31, 2024

10.0.0.1428

April 14, 2020

Deprecated

November 3, 2020
December 31, 2024

8.3.2.11492 September 29, 2023 Active August 1, 2025 December 31, 2025

8.2.6.11305

December 22, 2020
Discontinued February 1, 2025 June 1, 2025

8.2.4.11170

October 31, 2019
Discontinued
March 31, 2022
December 31, 2024

8.2.3.11111

July 2, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.2.11949

February 14, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.1.11863

December 14, 2018
Discontinued
March 31, 2021
December 31, 2024

8.2.0.11849

December 6, 2018

Withdrawn

December 14, 2018
December 31, 2024

MailMarshal ECM (formerly MailMarshal Exchange)

Software Version

Release Date
Support Status
Discontinued Date

7.2.0.9773

March 7, 2017

Active

7.1.7.7380

January 12, 2015
Discontinued
February 1, 2019

MailMarshal Secure Email Server (SES)

Software Version

Release Date
Support Status
Discontinued Date

5.8.1.398

July 24, 2017
By special arrangement only

5.8.0.361

May 30, 2016
By special arrangement only

5.7.2.9723

May 1, 2013

December 31, 2012

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

Trustwave External Vulnerability Scans Policy for "Host(s) Not Detected"

Charles Creegan — Mon, 20 Oct 2025 00:25:01 GMT

This article applies to:

External Vulnerability Scanning

Information:

Please see the updated SecureTrust External Vulnerability Scans Policy for "Host(s) Not Detected".

Additions to Release Notes for WebMarshal 7.6

Charles — Sun, 19 Oct 2025 19:11:58 GMT

This article applies to:

WebMarshal 7.6

Question:

What are the Release Notes for WebMarshal 7.6?

Information:

The Release Notes included with WebMarshal 7.6 are accurate as of the date of publication.

WebMarshal 7.6.0 (build 7.6.0.9374) was released on August 13, 2025.

This article provides highlights and any later updates.

See also the Current Known Issues article, Q21010.

Additional Updates:

The current File Type and Unpacker library is included. Some additional file types are recognized. See articles Q21078 and Q20913.

New categories are included in the Web Filter Database. These categories were populated on 15 October 2025. For more information, see article Q21089.

Web Filter Database changes - New WebMarshal versions

Charles — Sun, 19 Oct 2025 19:10:00 GMT

This article applies to:

WebMarshal
LevelBlue Web Filter Database
Note changes with new WebMarshal versions

Information:

This article describes changes to the categories available in the Web Filter Database URL categorization service that is used by WebMarshal and other products.

The changes do not require any action from customers. However, customers should review their use of the categories to ensure the best use of available information

Categorization Check

To check the categorization of any URL, see the URL check page on the LevelBlue support site. You can also request a review of categorization.

New Categories

Version 7.5.5

In version 7.5.5 and above, a new category for Artificial Intelligence is provided. In addition, the School Cheating category has been restored.

Version 7.6.0

Version 7.6.0 adds support for new categories. As of 15 October 2025, these categories have been populated. The new categories include:

AI Agents: Websites that use an AI agent. AI agents can autonomously interact with their environment, make decisions, and take actions to achieve predefined goals based on user input.
Generative AI: Websites that use AI technology to generate text, images, video, audio, code, or other content based on user input.
Trusted Proxy Relays: External relay proxies from trusted providers, used to obfuscate IP addresses or dissociate browsing history from individual IPs. Examples include Apple's iCloud Private Relay and Google's IP Protection.
QR Code Generators: Websites that generate QR codes or provide tools for generating QR codes.
URL Shortening and Redirect Services: Websites that host redirect services for URLs or domains, masking the requested destination. This includes URL shortening services.

Deprecated Categories

Some categories that were provided before May 2019 are not available in the current database. The deprecated categories generally relate to special purpose sites and typically include only a small number of URLs. The URLs in these categories have generally been added to other appropriate categories.

In new installations of WebMarshal 7.5 and above, the deprecated categories are removed.

On upgrade to version 7.5 or above, the deprecated categories are listed as "Category [category number] no longer available". To preserve integrity of customer configuration the categories are not removed. LevelBlue recommends that customers remove the listings manually.

The list below shows the number for each deprecated category.

In earlier versions, the deprecated categories will still be available, but they will no longer be updated. They will contain the final list of URLs published from the old database. LevelBlue recommends that customers do not use the deprecated categories and remove the listings manually.

The list of deprecated categories and category numbers is:

Adware (0)
Child Pornography (9)
Comics (10)
Cults (13)
School cheating (88) - Available again in 7.5.5 and above
Educational games (20)
Fantasy sports (24)
Fitness (27)
Free hosting (28)
Freeware (29)
Greeting cards (70)
Holistic medicine (42)
Humor (43)
Internet radio (48)
ISPs (49)
Military appreciation (59)
Online classes (68)
Portals (78)
Religious opinion (85)
Remote access (34)
Social opinion (93)
Self defense (90)
Theater (97)
Tickets (98)
Traffic (107)
Web-based productivity apps (113)
Web-based newsgroups (109)

Configuring MailMarshal (SEG) with Exchange 2019/SE or 2016 as internal mail server

Charles — Sun, 19 Oct 2025 18:58:15 GMT

This article applies to:

MailMarshal (SEG)
- Note for MailMarshal (SEG) 10.0 and above additional steps are required for same-server installation and some restrictions may apply
Microsoft Exchange Server 2019, 2016, 2013 and "Subscription Edition"
- For Exchange Online, see the document "Using MailMarshal with Exchage Online", available on the MailMarshal documentation page.

Question:

How to configure MailMarshal (SEG) to forward mail to Microsoft Exchange Server
How to configure Microsoft Exchange Server to forward and receive email from MailMarshal (SEG)

Procedure:

To configure MailMarshal as gateway with Microsoft Exchange Server (current versions) as the internal email server, follow the steps in this article.

MailMarshal (SEG) 8.X interfaces differ, but the information required is the same.

Please read through and understand the details, particularly about port assignments, before starting.

NOTES:

It is possible to install MailMarshal with Exchange Server on the same machine and this article covers this scenario. However, you should carefully consider the resources required for same-server installation.

For installations of significant size, LevelBlue recommends you install MailMarshal separately. This article also covers installation of MailMarshal on a separate machine with email flow between the servers.

The MailMarshal Array Manager includes a default HTTPS website that conflicts with Exchange. To install MailMarshal on the same server as Exchange you must change the binding of the MailMarshal Management Console. The Exchange ECP and OWA websites will not run until you make this change. Current MailMarshal installers detect conflicts and prompt you to select a different port.

For additional steps to allow the co-existence of MailMarshal and Exchange websites, see article Q12671.

Port 25 assignment: When installing MailMarshal and Exchange server on the same computer, you will most likely find that both attempt to use port 25 for SMTP email. Generally you should allow MailMarshal to use this port (to accept email from external locations) and configure Exchange to use another port. Port 97 is usually available for this purpose.

Exchange connectors by default use TLS. To learn about configuring TLS in MailMarshal, see article Q11636.

This article describes the simplest un-authenticated configuration for incoming email. Many other security options are available.

For example, you may want to limit access by IP address, and/or use Basic authentication over TLS to control access.

Two procedures are given for configuring MailMarshal delivery. The first is for the configuration of MailMarshal if it has not already been installed. The second can be used to change the settings after MailMarshal is already installed.

Configuring MailMarshal Delivery During Initial Installation

In the Configuration Wizard, on the Delivery window Specify the Server... field, enter the IP Address or Server Name and the Port of your Microsoft Exchange Server.
- If Exchange and MailMarshal are on the same server, be sure to configure and use a unique port for Exchange, as mentioned above.
Select Deliver external email using DNS resolution. See below.

Configuring MailMarshal Delivery After Installation:

In the Management Console, expand System Configuration > Array Properties and select Routes.
Edit the Default Routing Table.
Edit the Local Domain you would like to forward to Microsoft Exchange Server.
On the Domain Routing window double click the IP Address you are currently using to route mail.
On the Route Entry Properties window, change the IP address to the IP Address of your Microsoft Exchange Server installation.
On the Advanced tab of Route Entry Properties, make any changes to the Port and Priority for the route. For more information see Help.
- If Exchange and MailMarshal are on the same server, be sure to configure and use a unique port for Exchange. See the section about configuring Exchange below.
You can also configure MailMarshal to make authenticated connections to Exchange. See the Authentication tab of Route Entry Properties. Details are beyond the scope of this article.
Save the changes and commit the configuration.

Configuring MailMarshal Relaying Permissions:

In most cases the above steps will also allow Exchange Server to relay outgoing email through MailMarshal. However, if you find that relaying from the Exchange Server is denied by MailMarshal, you can allow relaying using the following steps:

In the Management Console, expand System Configuration > Array Properties, and select Relaying.
Edit the Default Relay Table.
Add an entry with the IP Address of the Microsoft Exchange Server you want to allow to forward email to SEG.
Save the changes and commit the configuration.

Configuring Exchange Server

Follow the steps below to configure Microsoft Exchange Server to receive email from MailMarshal:

In the Exchange Admin Center website, select mail flow from the left menu, and then select receive connectors from the top menu.
From the Select server menu, select the server you want to use to receive incoming mail from MailMarshal.
You may be able to use an existing receive connector such as the "Default Frontend" connector, or you may need to create a new connector.
- If you want to use an existing connector, double-click to edit it, and verify the network and permission settings are as described below.
- If you want to create a new connector, click + to create a new receive connector.
Enter a Name for the connector.
Select Role: Frontend Transport
Select Type: Internet
- Note: This setting enables connections from all locations. If you want to limit connections by IP address, after creating the connector edit the setting on the Scoping tab.
On the Network adapter bindings window, ensure the IP addresses field includes All Available IPv4. (You can also use IPv6 with current MailMarshal versions.)
For the Port:
- If Exchange and MailMarshal are on the same server, DO NOT use port 25. Instead, edit the line and select an unused port. Port 97 is often available.
- If Exchange and MailMarshal are on separate servers, generally you should use port 25.
Click Finish.
Verify anonymous access:
- Double click the name of the new connector.
- On the Security tab, ensure the Anonymous users box is checked. Click Save.
- You can also enable or require authenticated connections from MailMarshal with other options on the Security tab. Details are beyond the scope of this article.

Follow the steps below to forward mail from Microsoft Exchange Server to MailMarshal:

In the Exchange Admin Center website, select mail flow from the left menu, and then select send connectors from the top menu.
Click + to create a new send connector.
- A Send Connector may already be configured. If you want to use the existing connector, verify the network and security settings as described below.
Enter a Name for the connector and select Custom from the menu. Click Next.
On the Network Settings window, select Route mail through the following smart hosts. Click Add and enter the IP Address where MailMarshal accepts email. Click Save and then Next.
- For array installations, use the address of an email processing node or the external IP of a load balancer; for single servers, the address of the server.
Select an authentication method, or "none" if you do not want to require authentication. All current MailMarshal versions support Basic authentication and Basic over TLS.
- Before enabling authentication here, ensure you have set up the required account (and TLS if desired) in MailMarshal.
On the Address space window, click + to add an address space. In the FQDN field, enter * to signify all domains. Click OK and then click Next.
On the Source server window, click + to add one or more servers. Generally add all Mailbox servers in the Exchange installation. Click OK and then click Next.
Click Finish to create the connector.

What file types are recognized by MailMarshal (SEG) and ECM?

Charles — Wed, 15 Oct 2025 21:35:34 GMT

This article applies to:

MailMarshal (SEG) current versions
MailMarshal ECM/MailMarshal Exchange 5.2 and above

Question:

What file types are recognized by MailMarshal (SEG)?
What file types are recognized by MailMarshal ECM 5.2 and above?

Information:

The following formats are recognized by current MailMarshal (SEG) and ECM versions.

Notes:

Some types are recognized only with current product versions, as noted. Items marked "Current SEG" were added before 2023. These items are not recognized by ECM.
Additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each MailMarshal version, see article Q20446.
- File Type updates are distributed through the MailMarshal Automatic Updates to installations with current maintenance.
Items recognized with a specific MailMarshal/SEG or FileType update are not recognized in MailMarshal Exchange/ECM.

In the tables below, Type Name refers to the name seen in the Engine log and rule listings. Description is the name as seen when selecting types in the email policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by MailMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (Current SEG)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA (Current SEG)
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file (Current SEG)
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive (Current SEG)
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File (Current SEG)
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (Current SEG)
PBIX	Power BI Report (FileType 2024-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file (Current SEG)
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (Current SEG)
UUE	UUencoded Encoding
XZ	XZ archive (Current SEG)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items in MailMarshal/SEG 8.2.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document (Current SEG)
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLS	Excel document
XLSIRM	Excel document with IRM (Current SEG)
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB (Current SEG)
ONE	Microsoft OneNote (Current SEG)
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (Current SEG)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form (Current SEG)
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (Current SEG; see Q16666)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM (Current SEG)
PPTIRM	PowerPoint document with IRM (Current SEG)
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM (Current SEG)
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM (Current SEG)
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document (Current SEG)

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB (Current SEG)
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX (Current SEG - see note)
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (Current SEG)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (Current SEG)
STL	StereoLithography Drawing (Current SEG)

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (Current SEG)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data (Current SEG)
Switch	Egress Switch Encrypted Mail (Current SEG)
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLSIRM	Excel document with IRM (Current SEG)
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (Current SEG)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (Current SEG)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM (Current SEG)
PPTIRM	Powerpoint document with IRM (Current SEG)
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM (Current SEG)
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail (Current SEG)

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (Current SEG)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (Current SEG)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font (Current SEG)
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format (Current SEG)
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF) (Current SEG)

Image

Type Name	Description
PSD	Adobe Photoshop Image
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (Current SEG)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image (Current SEG)
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (Current SEG)
TIF	Tiff image
WEBP	WebP Image File (Current SEG)
HDPHOTO	Windows HD Photo (Current SEG)
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar) (Current SEG)
ICSDescription	Calendar Meeting Invitation Description (Current SEG)
ICSSummary	Calendar Meeting Invitation Summary (Current SEG)
TPS	Clarion TopSpeed File .TPS (Current SEG)
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF (Current SEG)
DBT	dBase Memo Field File (Current SEG)
MDXdbase	dBase Multiple Index File (Current SEG)
SYS	DOS device driver (Current SEG)
VCF	Electronic Business Card .VCF (Current SEG)
ICM	Independent Color Matching .ICM (Current SEG)
InfoSlip	Infoslips document (Current SEG)
JOS	Java Object Serialized Data (Current SEG)
DSStore	Mac OSX Finder Info (Current SEG)
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (Current SEG)
PDB	Microsoft Debugging Symbols (Current SEG)
LIB	Microsoft Program Library (Current SEG)
MSBLDCACHE	MS Build Cache File (Current SEG)
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File (Current SEG)
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture (Current SEG)
PCAPNG	Packet Capture NG (Current SEG)
PEMCert	PEM encoded certificate .PEM (Current SEG - see note)
PFX	PFX Certificate Archive (Current SEG)
PGPPublicKey	PGP Public Key (Current SEG)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (Current SEG)
PBIXMetadata	Power BI Data Metadata (Current SEG)
PBIXModel	Power BI Data Model (Current SEG)
PBIXBindings	Power BI Security Bindings (Current SEG)
PBIXSettings	Power BI Settings (FileType 2024-02-01 and above)
QBB	QuickBooks Backup .QBB (Current SEG)
QBW	QuickBooks Company file .QBW (Current SEG)
RTF Object	RTF Object
SHP	Shape file (.SHP) (Current SEG)
SHX	Shape Index file (.SHX) (Current SEG)
P7S	SMime Signed Data
SQLiteDB	SQLite Database (Current SEG)
EMC	Striata Encrypted Mail Communication (Current SEG)
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (Current SEG)
VSSSCC	Visual Source Safe Source Code Control (Current SEG)
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (Current SEG)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF (Current SEG)
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX (Current SEG)
XML	XML Document (Current SEG)

Sound

Type Name	Description
AAC	AAC audio
FLSA	Adobe Flash Audio (Current SEG)
AU	AU sound file
ENC	Encore Music Notation .ENC (Current SEG)
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video (Current SEG)
FLSV	Adobe Flash Video (Current SEG)
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (Current SEG)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (Current SEG)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (Current SEG)
WEBP	WebP Image File (Current SEG)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by MailMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

Word, Excel, and PowerPoint "2007" or "2007+" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
LevelBlue Knowledgebase articles for information about earlier versions have been withdrawn.

This article was previously published as:: NETIQKB40962

Provisioning customer-maintained blacklists in SPE

Charles — Tue, 14 Oct 2025 20:56:28 GMT

This article applies to:

MailMarshal SPE

Question:

How can I allow Managed customers in SPE to maintain their own blacklists of senders?
Each customer should be able to maintain their own unique blacklist through the Customer Console

Procedure:

To allow a customer maintained blacklist in a package policy rule that is enabled by default, use "Preset User Groups". Preset groups in rules will apply a separate list for each customer.

In the SPE Management Interface provier view, create a Preset User Group as shown.
Create a customer package policy. Ensure the package that contains this policy is active for all the desired customers.
Create a rule using the Preset User Group.
In the SPE Management Interface Customer view, the rule is visible to the customer. The rule has no effect until addresses are added to the Preset Group.
To add members to the group, the customer simply clicks the Preset Group link. The customer can add
- Individual addresses (including wildcarded addresses if permitted)
- A list of addresses imported from a file

Other user groups that they maintain in SPE

How to use the Support Tool for MailMarshal SPE

Charles Creegan — Tue, 14 Oct 2025 18:40:15 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use the Support Tool for MailMarshal SPE?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about a MailMarshal SPE installation. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about MailMarshal SPE, MailMarshal SEG, IIS, Marshal virus scanners, and the Connector Agent.

Note: For help with the Support Tool for other LevelBlue email products (MailMarshal SEG, LevelBlue ECM, WebMarshal, and MRC), see Q15024.

Installation

Download the latest version of the tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool (1.14 and above) is packaged with .NET 7 runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

Copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect to check for updates, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool appears as shown below.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Click GO to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include the SPE database statistics data. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

System Information

Includes a listing of the system hardware and operating system information.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

If this is a SEG processing node, optionally select Include Quarantine directory listing to list all messages in quarantine and archive (only if required, as the file will be much larger and take longer to generate).

Event logs

Includes Windows Event Log information. If you include the event logs, choose to include Application and/or System logs by checking the boxes.

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a SEG processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.

Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

SPE database

Include the SPE configuration and logging data as CSV files.

Include statistics data

Also include dashboard statistics from the SPE database.

Warning: Select these options only when directed. Including the SPE database (particularly the statistics data) can result in a very large file. In some cases it could consume all available disk space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Version: The installed version of the Support Tool.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
The tool is able to gather information for MailMarshal SPE (MailMarshal SPE) 3.0 and above.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.

Using externally generated certificates for Marshal Interface Agent

Charles — Tue, 14 Oct 2025 01:36:56 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use my own certificate for the Marshal Interface Agent connection to other components?
Using a certificate from a Certificate Authority for MIA

Procedure:

Stop the MIA service and all services that connect to it
Delete the binding of the existing certificate with the MIA port
1. Run netsh (Make sure that you have administrator privileges, for instance by using runas or starting netsh from an elevated command prompt).
2. At the netsh> prompt, change to http context by entering http
3. (Optional) At the netsh http> prompt, you can verify that the MIA port is bound by entering
  show sslcert
4. Remove the MIA port binding by entering
  delete sslcert ip=0.0.0.0:19200
  
  The utility should confirm that the delete was successful.
Manage certificates:
1. Run MMC from Start>Run
2. Add the Certificate snap-in for the local computer account
3. Navigate to Certificates (Local Computer)\Personal\Certificates
(Optional) Delete the default MIA certificate from the certificate store.
- Note: You may wish to leave this certificate in the store as a backup. The certificate cannot be fully exported for backup, because the private key cannot be exported.
1. Locate a certificate that is issued to computer_name by computer_name (where computer_name is the name of the server) and the Subject contains the following properties:
  - OU = Marshal Dev
  - O = LevelBlue
  - CN = computer_name
2. Remove that certificate.
Insert your own certificate into the computer account certificate store, under the Personal store. The certificate can be a standard web server certificate ordered from a Certificate Authority. If you are creating your own certificate, it must meet the following criteria:
- Certificate needs to contain a private key
- Certificate subject: CN attribute must be the resolveable name of the computer where MIA is installed (DNS name or computer name). This is the server name you will enter when connecting.
- Key usage: Digital Signature, Key Encipherment, Data Encipherment
- Intended purpose: Server Authentication
Copy the certificate hash (Thumbprint) formatted without spaces in between values
for example: 035c49f034ee505b8d1cad1f3485fb642b470607
Add the binding for the MIA port
1. Run netsh as administrator
2. At the netsh> prompt, change to http context by entering http
3. At the netsh http> prompt, enter following command:
  add sslcert ip=0.0.0.0:19200 certhash=paste the hash from the step above appid={f0bd00f1-a9f0-4466-bd36-ee495fa9cc25}
  - For example:
    add sslcert ip=0.0.0.0:19200 certhash=035c49f034ee505b8d1cad1f3485fb642b470607 appid={f0bd00f1-a9f0-4466-bd36-ee495fa9cc25}
Verify that the binding exists (at the netsh http> prompt, enter show sslcert)
Start the MIA service
Re-register all of the client services using the Marshal Client Settings application (found on the Start Menu of each server).
- In the URL field, be sure to specify the CN used in the new certificate.
Start all client services.

Creating an Application Registration for Entra ID

Charles — Tue, 14 Oct 2025 01:34:26 GMT

This article applies to:

MailMarshal 11.2 and above
MailMarshal SPE 4.4 and above
Entra ID Group Import

Question:

How do I register an application in Azure/Entra to allow group import to MailMarshal?
What are the options and requirements for use of imported Entra groups?

Background:

MailMarshal allows you to retrieve user group information directly from Microsoft Entra ID (formerly known as Azure Active Directory). To connect, you must create an "application" in Entra.

You will enter the Client ID, Tenant ID, and Secret from Entra in the MailMarshal Management Console or the MailMarshal SPE Customer Console

Procedure:

Note common missed items in this procedure:

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Be sure you grant Application permissions (not "delegated")
Be sure to grant admin consent

Log in to the Microsoft Entra Admin Center (entra.microsoft.com). The minimum required permission is "Cloud Application Administrator"
If you have access to more than one tenant, use the Settings menu (gear icon in the top bar) to switch to the specific tenant.
From the left menu browse to Identity > Applications > App registrations. Click New registration.
Enter a name.
For "supported account types" accept the default (single tenant).
Click Register.
From the overview page of the application, note the following values:
- Application (client) ID
- Directory (tenant) ID
From the API Permissions page of the application, grant the following Microsoft Graph permissions (Application permissions):
- Group.Read.All
- Member.Read.Hidden
- OrgContact.Read.All
- User.Read.All
After updating the above permissions, click Grant admin consent (above the list of permissions)
From the Certificates & Secrets page of the application, create a new client secret. Note the value (it is only available immediately after creation).

Use the Client ID, Tenant ID, and client secret on the Entra Properties tab of the Connector page in the MailMarshal Management Console, or the Entra Connector Properties page in the SPE Customer Console.

Group usage:

After creating the connector you can select groups to import using the Import Connector Group or Import Entra Groups button on the User Groups page.

Groups are populated immediately. Group membership is queried and updated hourly.

Using the SPE Connector Agent with Azure AD

Charles — Tue, 14 Oct 2025 01:30:12 GMT

This article applies to:

MailMarshal SEG Service Provider Edition
Microsoft Azure Active Directory

Question:

How can SPE user information be imported from Azure AD?

Procedure:

The Connector Agent is an optional module of SPE that allows you to retrieve information about local user groups and email addresses from an Active Directory server or LDAP server, for use in email filtering policy.

You can use the Connector Agent with Azure AD.

Note: In current versions of SPE, customers can retrieve Azure/Entra directory information directly, using the Entra Connector. This is a much quicker and more robust option. See customer facing documentation. Basic information on the required setup in Entra is found in LevelBlue Knowledgebase article Q21246.

If a customer has a workstation or server available on premises that is a domain member, they can install and configure the Connector Agent for Azure AD in the same way as for a premises AD installation.

Note: For customer-focused basic instructions about how to download, install, and configure the Connector Agent, refer to the End User Guide provided with SPE.

The customer or Service Provider can also use the Connector Agent to synchronize information from Azure AD using LDAPS.

Note: The Service Provider can host Connector Agent service for multiple customers with a single installation. See article Q14972.

To use the Connector Agent with Azure AD LDAPS:

Configure Secure LDAP (LDAPS) in Azure AD Domain Services. See the Microsoft documentation for this task.
Once secure LDAP access to a managed domain over the internet is successfully enabled, the Azure AD Domain Services management site shows the external IP address that can be used to access the directory over LDAPS in the field EXTERNAL IP ADDRESS FOR LDAPS ACCESS.
Install the Connector Agent on any computer that has Internet access (HTTPS access to the SPE Customer Console, and port 636 for LDAPS access to the Azure LDAPS IP address).
Create a new connector, and specify a LDAP directory of type “Microsoft Active Directory”.
Enter the Azure LDAPS IP address. Specify port 636 and select Connect using SSL. Enter logon credentials.
Click Next. The Agent tests the connection.
When the connection is successfully tested, continue the Wizard as described in the End User Guide.
When the connector has been successfully created, you can proceed to select groups for synchronization.

Software Version	Release Date	Support Status	End of Support	End of SEG Threat Protection Updates
SPE Version 5.3.0.22502 MailMarshal Version 11.3.0.7659	December 2, 2025	Active
SPE Version 5.2.0.22293 MailMarshal Version 11.2.0.7413	September 4, 2025	Active
SPE Version 4.3.5.20677 SEG Version 8.3.2.11492	April 9, 2024	Active	January 31, 2026	December 31, 2025
SPE Version 4.3.4.20423 SEG Version 8.3.2.11492	October 4, 2023	Active	January 31, 2026	December 31, 2025
SPE Version 4.3.3.20042 SEG Version 8.3.1.11439	July 11, 2023	Active	January 31, 2026	December 31, 2025
SPE Version 4.3.0.19124 SEG Version 8.3.0.11436	October 11, 2022	Active	January 31, 2026	December 31, 2025
SPE Version 4.2.4.16662 SEG Version 8.2.6.11305	December 22, 2020	Active	December 31, 2025	June 1, 2025
SPE Version 4.2.0.14203 SEG Version 8.2.4.11170	October 31, 2019	Active	December 31, 2025	December 31, 2024
SPE Version 4.0.3.20390 SEG Version 8.0.7.11235	February 12, 2019	Discontinued	March 31, 2021	March 31, 2021
SPE Version 4.0.1.19758 SEG Version 8.0.7.11235 (recommended) SEG Version 8.0.6.10796 (also supported)	March 6, 2018	Discontinued	August 1, 2020	March 31, 2021
SPE Version 4.0.0.19570 SEG Version 8.0.5.10552	December 12, 2017	Discontinued	March 6, 2018	March 31, 2021

LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Upgrading MailMarshal Service Provider Edition to a newer version

This article applies to:

Question:

Procedure:

Upgrading to version 5.3 from 5.2:

Upgrading to version 5.2 from 4.3:

Upgrading to version 4.X:

Notes:

Product Licensing for DbProtect and AppDetctivePRO

This article applies to:

Question:

Information:

Database or Node Definitions by Platform

License expiry and overage behavior

Upgrading SQL Reporting Services to SQL 2022

This article applies to:

Question:

Procedure:

Notes:

Additions to Release Notes for Marshal Reporting Console 2.6

This article applies to:

Question:

Information:

Supported Operating Systems and SQL versions

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

This article applies to:

Question:

Information:

Latest File Versions

MailMarshal (SEG) Supported Versions

MailMarshal (SEG) Older Versions

ECM

Failed to fetch server details: The server has not been configured yet - required security data not available

This article applies to:

Symptoms:

Causes:

Resolution:

Notes:

ACTION REQUIRED: TLS "Client Authentication" usage sunset

This article applies to:

Background:

MailMarshal Rule Update Required:

Notes:

Additions to Release Notes for MailMarshal 11.3

This article applies to:

Question:

Information:

SQL Server version requirement

Update from 11.2 with multiple servers

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Supported Operating Systems and Prerequisite Versions for MailMarshal SPE

This article applies to:

Question:

Information:

Key:

What versions of MailMarshal SPE are currently supported by LevelBlue Technical Support?

This article applies to:

Question:

Information:

Notes:

What are the Release Notes for MailMarshal SPE 5.3?

This article applies to:

Question:

Information:

Upgrade to 5.3 from 5.2.0 only

SQL Prerequisite Change

Known issues for Current MailMarshal versions

This article applies to:

Question:

Workstation Operating Systems
(for server installation)