LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Node failing to contact Array Manager in cross domain installation

Charles — Sun, 18 Oct 2026 18:29:05 GMT

This article applies to:

MailMarshal SMTP
DKIM signing issues
Configuration "out of date" issues

Symptoms:

DKIM signature failing when a key is correctly configured
- Controller log entry: DKIM: Exception when importing the key
Console shows node configuration "out of date" but configuration changes are applied
- Controller log entry: Event - Configuration retrieved and loaded successfully, but could not notify Array Manager.

Causes:

Both of the symptoms can be caused by authentication issues between the node and the Array Manager.

Resolution:

A method is available for the nodes to provide authentication credentials when contacting the Array Manager.

Please contact Technical Support to confirm the issue and get details of the required configuration. Quote this Knowledgebase article number and request information from the related internal article.

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

Charles — Wed, 14 Oct 2026 21:08:37 GMT

This article applies to:

WebMarshal

Question:

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

Information:

The following table shows the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For "discontinued" versions, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

All versions earlier than those listed are discontinued. Versions below 6.10 no longer have access to Tracenet and other web based updates.

Software Version

Release Date
Support Status
Discontinued Date

8.0.0.9434 October 15, 2026 Active

7.6.0.9374 August 13, 2025 Active

7.5.5.9336 November 1, 2023 Active

7.5.0.9239

August 31, 2022
Active
March 1, 2027

7.4.5.9142

February 18, 2021
Active
March 1, 2027

7.4.1.9033

February 4, 2020
Discontinued
September 1, 2026

7.4.0.8999

November 19, 2019
Discontinued
September 1, 2026

7.3.2.8927

July 4, 2019
Discontinued
September 1, 2022

7.3.1.8879

May 14, 2019
Discontinued
September 1, 2022

7.3.0.8967

January 29, 2019
Discontinued
September 1, 2022

Software Version	Release Date	Support Status	Discontinued Date
8.0.0.9434	October 15, 2026	Active
7.6.0.9374	August 13, 2025	Active
7.5.5.9336	November 1, 2023	Active
7.5.0.9239	August 31, 2022	Active	March 1, 2027
7.4.5.9142	February 18, 2021	Active	March 1, 2027
7.4.1.9033	February 4, 2020	Discontinued	September 1, 2026
7.4.0.8999	November 19, 2019	Discontinued	September 1, 2026
7.3.2.8927	July 4, 2019	Discontinued	September 1, 2022
7.3.1.8879	May 14, 2019	Discontinued	September 1, 2022
7.3.0.8967	January 29, 2019	Discontinued	September 1, 2022

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

Charles — Wed, 14 Oct 2026 21:08:37 GMT

This article applies to:

WebMarshal

Question:

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

Information:

The following table shows the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For "discontinued" versions, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

All versions earlier than those listed are discontinued. Versions below 6.10 no longer have access to Tracenet and other web based updates.

Software Version

Release Date
Support Status
Discontinued Date

8.0.0.9434 October 15, 2026 Active

7.6.0.9374 August 13, 2025 Active

7.5.5.9336 November 1, 2023 Active

7.5.0.9239

August 31, 2022
Active
March 1, 2027

7.4.5.9142

February 18, 2021
Active
March 1, 2027

7.4.1.9033

February 4, 2020
Discontinued
September 1, 2026

7.4.0.8999

November 19, 2019
Discontinued
September 1, 2026

7.3.2.8927

July 4, 2019
Discontinued
September 1, 2022

7.3.1.8879

May 14, 2019
Discontinued
September 1, 2022

7.3.0.8967

January 29, 2019
Discontinued
September 1, 2022

Software Version	Release Date	Support Status	Discontinued Date
8.0.0.9434	October 15, 2026	Active
7.6.0.9374	August 13, 2025	Active
7.5.5.9336	November 1, 2023	Active
7.5.0.9239	August 31, 2022	Active	March 1, 2027
7.4.5.9142	February 18, 2021	Active	March 1, 2027
7.4.1.9033	February 4, 2020	Discontinued	September 1, 2026
7.4.0.8999	November 19, 2019	Discontinued	September 1, 2026
7.3.2.8927	July 4, 2019	Discontinued	September 1, 2022
7.3.1.8879	May 14, 2019	Discontinued	September 1, 2022
7.3.0.8967	January 29, 2019	Discontinued	September 1, 2022

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

Latest versions of Unpacker and Filetype for WebMarshal

Charles — Wed, 14 Oct 2026 21:07:03 GMT

This article applies to:

WebMarshal (Supported versions)

Question:

What is the version of the Unpacker and File Type DLLs for my version of WebMarshal?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file.

Latest File Versions

Product Version	Unpacker Version	File Type Version
8.0.0	2026-03-01	2026-03-01
7.6.0	2025-02-01 July 7, 2025	2025-02-01 July 7, 2025
7.5.0-7.5.5	2023-03-01 October 24, 2023	2023-03-01 October 24, 2023
7.4.0-7.4.5	8.2.9 November 8, 2021	8.2.6 November 8, 2021
7.0.1-7.3.0	8.2.2 February 28, 2019	8.2.1 February 28, 2019

Supported Operating Systems and Prerequisite Versions

Charles — Wed, 14 Oct 2026 21:02:37 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 8.0
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 8.0
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM	RTM	RTM	RTM
Windows Server 2016	(11.3 is the last release that allows installation on Windows 2016)		RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 8.0
Windows 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 12.0	MailMarshal Web Components 12.0	Marshal Reporting Console 2.6	WebMarshal 8.0
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.8

SQL Server Versions

	MailMarshal 12.0	Marshal Reporting Console 2.6	WebMarshal 8.0
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on earlier or later SQL versions.

Current Known Issues for latest released version

Charles — Wed, 14 Oct 2026 20:59:06 GMT

This article applies to:

WebMarshal 8.0.0 (Current Release)
WebMarshal 7.6.0
WebMarshal 7.5.X
WebMarshal 7.4.X
WebMarshal 7.3.X

Question:

What are the known issues in the latest release of WebMarshal?
What are the latest changes and resolved issues in WebMarshal?

Resolved Issues:

For details of the latest changes and resolved issues, see the Release Notes for WebMarshal 8.0.

Known Issues and Limitations:

Release 7.5.5 and above does not allow installation on Windows 10. For console access, the Remote Console functionality can be used. LevelBlue always strongly recommends that the server components of WebMarshal should be installed on server operating systems only.
In release 7.5.0, email sending from rule actions does not succeed in some cases.
Due to a change in the Google Terms of Service for the Safe Browsing API, use of the Safe Browsing engine in WebMarshal (7.1 and above) is discontinued.
- WebMarshal 7.4.1 introduced the Google Web Risk functionality as a replacement.
- For more information see LevelBlue Knowledgebase article Q21118.
WebSockets connections from Chrome using NTLM cannot be authenticated. This issue is under investigation, and currently seen as a limitation of the Chrome browser.

Fixed Issues:

In release 7.4.5, the Engine service can hang when cleaning up user session information. This issue can also appear as inability to connect to the proxy. Requests are not completed.
- This issue is fixed in release 7.5.0.
In release 7.4.0 as installed, accessing PDF documents through WebMarshal can cause the Engine to stop.
- This issue has been addressed with an automatic update to a DLL file. Ensure that WebMarshal can access automatic updates.
In release 7.3.2 and earlier 7.X releases, adding many URLs to a category concurrently could cause the Controller service to stop.
- This issue is resolved in WebMarshal 7.4 and above.
In release 7.3.2 and earlier 7.X releases, console connections required the permission "Modify Policy".
- This issue is resolved in WebMarshal 7.4 and above. The minimum permissions required are "Console Connect" and "View Policy".
In release 7.3.1 when upgraded from some earlier versions, the engine can stop unexpectedly. Engine text logs show "One of the plugins crashed while it was running its rules over the user request."
- This issue is resolved in WebMarshal 7.3.2 and above.

Notes:

For further assistance, contact LevelBlue Support or your reseller support organization.

Additions to Release Notes for WebMarshal 8.0

Charles — Wed, 14 Oct 2026 20:56:37 GMT

This article applies to:

WebMarshal 8.0

Question:

What are the Release Notes for WebMarshal 8.0?

Information:

The Release Notes included with WebMarshal 8.0 are accurate as of the date of publication.

WebMarshal 8.0.0 (build 8.0.0.9434) was released on October 15, 2026.

This article provides highlights and any later updates.

See also the Current Known Issues article, Q21010.

Configuring Encrypted Connections to the WebMarshal Database

Charles — Wed, 14 Oct 2026 20:54:00 GMT

This article applies to:

WebMarshal 8.0.0 and above
Database connectivity

Question:

How do I configure WebMarshal to use encryption for the database connection?

Procedure:

First, configure the database using the WebMarshal Console.

To use encrypted connections:

On the Array Manager server, in the WebMarshal install edit the file ArrayManager\Policy\ArrayPolicy.Working.xml
Locate the node "Database"
Add two attributes and set both values to to "yes"
- useDataEncryption (value: "yes")
- trustServerCertificate (value: "yes" unless a specific certificate is installed and can be validated on both the SQL Server and the WebMarshal Array Manager server)
For example: <Database useDataEncryption="yes" trustServerCertificate="yes" provider="MSOLEDBSQL19" server="mySQLServer" database="WebMarshal" user="EXAMPLE\Secureuser" password="6X+NAW/fiu/egydom+4j4A==" useTCP="yes" enabled="yes" retention="100" reportingConsole="" />
Do not edit the other values.
- Note that XML values are case sensitive.
- Note that these settings require MSOLEDBSQL19. This provider is installed in current WebMarshal versions and set as the provider.
Save the file, and the restart the WebMarshal Array Manager service

Notes:

Be aware that the Marshal Reporting Console does not support encrypted connections.

What file types are recognized by WebMarshal 7.X and 8.X?

Charles — Wed, 14 Oct 2026 20:44:11 GMT

This article applies to:

WebMarshal 7.X and 8.X

Question:

What file types are recognized by WebMarshal?

Information:

The following formats are recognized by current versions of WebMarshal.

Notes:

Some types are recognized only with specific updates to the File Type DLL, as noted.
- WebMarshal 7.0 through 7.3 uses FileType 8.2.1
- WebMarshal 7.4 uses FileType 8.2.6 (updated 8 November 2021).
- WebMarshal 7.5 uses FileType 2023-03-01.
- WebMarshal 7.6 uses FileType 2025-02-01.
- WebMarshal 8.0 uses FileType 2026-03-01.

In the tables below, Type Name refers to the name seen in the Engine log, Traffic Logs, and rule listings. Description is the name as seen when selecting types in the policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by WebMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (from FileType 8.2.1)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (from FileType 8.2.1)
PBIX	Power BI Report (FileType 2025-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (from FileType 8.2.3)
UUE	UUencoded Encoding
XZ	XZ archive (from FileType 8.2.1)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items from FileType 8.2.1.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document
PPTcrypt	Encrypted PowerPoint Document (from FileType 8.2.1)
PPScrypt	Encrypted PowerPoint Show (from FileType 8.2.1)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM
XLS	Excel document
XLSIRM	Excel document with IRM
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB
ONE	Microsoft OneNote
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (SEG 7.2.3 and above)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (from FileType 8.2.1)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (from FileType 8.2.1)
PPTIRMcrypt	Password protected Powerpoint with IRM (from FileType 8.2.1)
WordIRMcrypt	Password protected Word with IRM (from FileType 8.2.1)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (see note below)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM
PPTIRM	PowerPoint document with IRM
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DEVMODE	Windows Printer DEVMODE settings (printer.bin) (FileType 2026-02-01 and above)
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (from FileType 8.2.7)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (from FileType 8.2.5)
STL	StereoLithography Drawing

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (from FileType 8.2.1)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data
Switch	Egress Switch Encrypted Mail
XLScrypt	Encrypted Excel document
PPTcrypt	Encrypted PowerPoint Document (from FileType 8.2.1)
PPScrypt	Encrypted PowerPoint Show (from FileType 8.2.1)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (from FileType 8.2.5)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (from FileType 8.2.1)
PPSIRMcrypt	Password protected Powerpoint show with IRM (from FileType 8.2.1)
PPTIRMcrypt	Password protected Powerpoint with IRM (from FileType 8.2.1)
WordIRMcrypt	Password protected Word with IRM (from FileType 8.2.1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (from FileType 8.2.5)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7A	SMime AuthEnveloped Data (FileType 2026-01-01 and above)
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (from FileType 8.2.1)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (from FileType 8.2.1)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF)

Image

Type Name	Description
PSD	Adobe Photoshop Image
AVIF	AV1 Image File Format (FileType 2026-02-01 and above)
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (from FileType 8.2.4)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (FileType 2025-02-01 and above)
TIF	Tiff image
WEBP	WebP Image File (from FileType 8.2.1)
HDPHOTO	Windows HD Photo
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar)
ICSDescription	Calendar Meeting Invitation Description
ICSSummary	Calendar Meeting Invitation Summary
TPS	Clarion TopSpeed File .TPS
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF
DBT	dBase Memo Field File
MDXdbase	dBase Multiple Index File
SYS	DOS device driver
VCF	Electronic Business Card .VCF
ICM	Independent Color Matching .ICM
InfoSlip	Infoslips document
JOS	Java Object Serialized Data
DSStore	Mac OSX Finder Info
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (from FileType 8.2.1)
PDB	Microsoft Debugging Symbols
LIB	Microsoft Program Library
MSBLDCACHE	MS Build Cache File
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture
PCAPNG	Packet Capture NG
PEMCert	PEM encoded certificate .PEM (from FileType 8.2.1)
PFX	PFX Certificate Archive (FileType 2023-03-01 and above)
PGPPublicKey	PGP Public Key (.ASC) (FileType 2025-02-01 and above)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (FileType 2025-02-01 and above)
PBIXMetadata	Power BI Data Metadata (FileType 2025-02-01 and above)
PBIXModel	Power BI Data Model (FileType 2025-02-01 and above)
PBIXBindings	Power BI Security Bindings (FileType 2025-02-01 and above) (Current SEG)
PBIXSettings	Power BI Settings (FileType 2025-02-01 and above)
QBB	QuickBooks Backup .QBB
QBW	QuickBooks Company file .QBW (from FileType 8.2.1)
RTF Object	RTF Object
SHP	Shape file .SHP (from FileType 8.2.1)
SHX	Shape Index file .SHX (from FileType 8.2.1)
P7S	SMime Signed Data
SQLiteDB	SQLite Database
EMC	Striata Encrypted Mail Communication
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (FileType 2023-03-01 and above)
VSSSCC	Visual Source Safe Source Code Control
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (FileType 2023-03-01 and above)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX
XML	XML Document (recognized from FileType 8.2.1; selectable in the user interface from Filetype 8.2.2)

Sound

Type Name	Description
AAC	AAC audio (Additional variants recognized from FileType 2026.01.01)
FLSA	Adobe Flash Audio
AU	AU sound file
ENC	Encore Music Notation .ENC
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video
FLSV	Adobe Flash Video
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (from FileType 8.2.1)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (from FileType 8.2.1)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (from FileType 8.2.1)
WEBP	WebP Image File (from FileType 8.2.1)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by WebMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

PDF files that do not begin with the string %PDF (header in the document source) do not comply with the PDF standard. These files are recognized separately.
- Note that recent versions of Adobe software enforce compliance with the standard. For more information see Adobe documentation.
Word, Excel, and Powerpoint "2007" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
See the following LevelBlue Knowledgebase articles for information about other versions:
- Q12033 What file types are recognized by WebMarshal 6.X?
- Q10859 What file types are recognized by WebMarshal 3.X?

Additions to Release Notes for MailMarshal 12.0

Charles Creegan — Thu, 24 Sep 2026 23:16:28 GMT

This article applies to:

MailMarshal 12.0

Question:

What are the Release Notes for MailMarshal 12.0?

Information:

MailMarshal version 12.0 (12.0.0.8219) was released on August 11, 2026. The Release Notes included with the product are generally accurate as of the date of publication.

This article provides any additional information or corrections generated after that date.

See also article Q21135 for information about Known and Fixed Issues.

For current updates and information, customers should subscribe to the Notifications forum.

Updated release

Release build 8219 includes updates to Configuration Service database connectivity, specifically when using Windows credentials. Customers who installed or upgraded MailMarshal using the original release (12.0.0.8194) should update to 12.0.0.8219. For details of functionality affected, see Known and Fixed Issues.

Additional updates

MailMarshal 12 includes an update/enhancement to the Image Analyzer component.

How do I use Intermediate Certificates with MailMarshal TLS?

Charles — Thu, 03 Sep 2026 01:41:23 GMT

This article applies to:

MailMarshal (SEG)
TLS Inbound Security functionality

Question:

How do I use Intermediate Certificates with MailMarshal TLS?
How do I use certificate chains with MailMarshal TLS?

Procedure:

Although the SEG/MailMarshal user interfaces do not currently provide a way to import certificate chains, it is possible to use chained certificates issued by a Certificate Authority in SEG if required.

For an automated method, see Knowledgebase article Q21265, Automating renewal of TLS certificates. This method will publish the entire certificate chain to all nodes automatically.

To use the MailMarshal interface:

Using the TLS Certificate Wizard in the MailMarshal Configurator or Management Console, generate a certificate signing request to send to a Certificate Authority (such as Thawte or Verisign). This CSR uses the private key generated and stored in the file csrprivkey.pem on the MailMarshal node server.
- Note: If you have more than one processing node and/or more than one email domain, you should ensure that all required DNS names are included in the certificate.
  - MailMarshal supports Subject Alternative Name (SAN) entries. See Knowledge Base article Q14516.
You will receive a certificate from the CA. This will typically be a server certificate (not including any intermediate certificate or root CA certificate). Other certificates may be provided in the distribution package.
Import the certificate to MailMarshal via the Management Interface (in 8.X, the Configurator). This certificate will be written to the file cacert.pem on the specific email processing node. The file csrprivkey.pem will also be copied to privkey.pem, overwriting any previous private key.

At this point, TLS will function with a subset of other Mail Transport Agents (MTAs) that do not require intermediate certificates (such as another MailMarshal server).

Note: If you have more than one processing node, you must import a certificate to each node using the above method. This may be the same certificate or a different certificate as noted in Knowledge Base article Q14516. If you are importing the same certificate to additional nodes, you will also need to import the private key file (privkey.pem).

To use TLS with other MTAs that do require intermediate certificates, complete the following additional steps:

Back up cacert.pem and privkey.pem
Retrieve the necessary certificates to complete the chain. The procedures and required certificates will vary, but generally this includes the intermediate CA certificate responsible for signing the server certificate. Additional intermediate certificates could be required.
- The CA root certificate should not be included in most cases (assuming the CA root is included in client repositories such as the Windows certificate store).
- For assistance, ask the CA.
If necessary, export the intermediate CA certificates to DER encoded base64 using OpenSSL or another tool.
Copy cacert.pem to a convenient temporary location.
Open the temporary copy in a text editor.
Paste in the intermediate certificates (text from the DER files) in reverse order, for example:
- Server cert (the existing content of the file)
- Intermediate cert 1 (that signed the server cert)
- Intermediate cert 2 (that signed intermediate cert 1) if any
Note: The chain might include more than one intermediate certificate. OpenSSL refers to these as the "Local Issuer" and one or more "Issuer" certificates.
Save the file to the temporary location (NOT in the SEG or MailMarshal folder).
Verify the validity of the certificate chain in the temporary file. This allows you to be sure that you have added all needed certificates in the correct order.
- You can use the OpenSSL verify function. The syntax is openssl verify -CAfile cacert.pem cacert.pem (note the name of the certificate file is entered twice).
Once you have verified the certificate file contains all needed certificates for a valid chain, distribute the files cacert.pem and privkey.pem to all desired nodes.
- To distribute to every node, place the files in the Config folder on the Array Manager server, overwriting any existing files, then commit configuration.
- You can also replace the files in the NodeConfig folder on individual nodes.

At this point, MailMarshal will load the certificate chain when establishing TLS negotiations in the Receiver.

You can validate the certificate chain using free web based SSL test services provided by third parties.

Notes:

You cannot use the MailMarshal user interfaces to import a cacert.pem file that contains a chain of certificates. To use certificate chains, you must copy or edit the files.
To obtain OpenSSL, see OpenSSL Light for Windows. You might also require the Visual C++ redistributables as linked from the OpenSSL download page.
Each time you generate a self signed certificate or import a CA certificate from the MailMarshal Configurator or MailMarshal (SEG) 10 Management Interface, the private key (privkey.pem) can be overwritten. This will cause previously generated certificates to stop working. Always back up privkey.pem and cacert.pem before performing any other certificate tasks.

Requesting and installing a signed certificate for TLS

Charles — Thu, 03 Sep 2026 01:37:14 GMT

This article applies to:

MailMarshal (SEG)

Question:

How do I create a a certificate signing request for MailMarshal TLS?
How do I install a signed certificate returned from a Certificate Authority for MailMarshal TLS?

Procedure:

This article provides an overview of the steps required to use a CA certificate with MailMarshal TLS (Transport Layer Security).

Before working with certificates, always ensure that you have a valid backup of any existing certificate and/or private key.
- MailMarshal does not back up certificates automatically. If you install a new certificate, the old certificate is permanently deleted.
- LevelBlue recommends that you keep copies of certificates separate from the servers, ideally off-site.
For important information about differences between MailMarshal versions, see the Notes at the end of this article.
For an alternate method, see Knowledgebase article Q21265, Automating renewal of TLS certificates

To access MailMarshal TLS certificate management:

Open the Inbound Security (TLS) item or tab for a server:
- In the Configurator expand Server and Array Properties. Select a processing node server from the list, and click Server Properties.
- In the MailMarshal (SEG) 10.0 and above Management Console, select Mail Servers and edit a server entry in the list.
Select the Inbound Security (TLS) item or tab.

To create a Certificate Signing Request:

From the Inbound Security (TLS) window, run the TLS Certificate Wizard.
Choose to create a Certificate Signing Request.
Enter the required information and complete the wizard. Copy the CSR or save it to a file, and include this information when you request a certificate from a Certificate Authority.
MailMarshal also creates a private key file, and saves this file in the \NodeConfig folder within the MailMarshal installation on the processing node server.

To import a certificate that you received from the Certificate Authority:

Notes:

If you have more than one processing server, ensure that you use the same server where you generated the CSR.
If the Certificate Authority uses a certificate chain (Intermediate Certificates) and you want connecting servers to be able to validate the certificate, you will need to perform additional steps. See LevelBlue Knowledgebase article Q14063.

From the Inbound Security (TLS) window, run the TLS Certificate Wizard.
Choose to import a signed certificate.
To import the certificate, browse to the certificate file.
- You may need to select a different file extension or "all files" to select the file.
You should not need to enter a private key filename. MailMarshal will use the private key file saved when you generated the request.
Complete the wizard to import the certificate.

To use the same certificate on more than one processing node server:

Request and import a certificate using one processing server.
After importing the certificate, use the TLS Certificate Wizard to make a backup of the certificate and private key.
On the other processing server(s), use the TLS Certificate Wizard to import the certificate from the backup.
- Note: If the certificate file includes Intermediate Certificates, do not use the wizards. Instead, copy the .pem files. See LevelBlue Knowledgebase article Q14063.

Notes:

In current releases of MailMarshal, the private key for a pending CSR is stored in a file named csrprivkey.pem and the CSR can be generated without overwriting an existing key. However, only one CSR can be pending on each server.
Warning: In MailMarshal 6.4 and below, if you create a CSR, any existing private key is overwritten and permanently lost.
- If you need to use a previous certificate after creating a CSR, restore it from your backup copy.
All files are stored on the email processing server(s) in the \NodeConfig folder. (In a single server installation, this folder is still present within the installation.)
The certificate is stored in a file named cacert.pem
The private key is stored in a file named privkey.pem

Automating renewal of TLS certificates

Charles — Thu, 03 Sep 2026 01:30:02 GMT

This article applies to:

MailMarshal SMTP
TLS certificate renewal

Question:

How can I automate renewal of email TLS certificates?
How can I automate distribution of updated certificates to processing nodes?

Background:

It is possible to automate certificate generation and distribution using an Automatic Certificate Management Environment (ACME) client.

ACME clients will automatically renew certificates on a schedule.
Automation reduces the chances of error, and helps with the newly required more frequent renewal of certificates.

A well known ACME client is Certify the Web. This client requests free certificates from Let's Encrypt by default. It can be used to request certificates from other Certificate Authorities including DigiCert.

Certify the Web provides the ability to deploy the generated certificates in PEM files as required by MailMarshal.

This article describes the required workflow with reference to Certify the Web. Other ACME clients are available with similar functionality.

Procedure:

Install Certify the Web on the MailMarshal Array Manager.

Certify is free for evaluation only. Before using this application for production, license the application.

On the Settings page you can select one or more certificate authorities to use.

To set up a certificate:

Begin creating a new certificate.

Manually enter the required list of domains or domain wildcards.

On the Authorization page, select the "dns-01" challenge type. This type is required where the certificate is not bound to a local website.

This authorization type requires you to grant Certify the ability to create TXT records in the DNS zone of the domains that you will be creating certificates for. To accomplish this, Certify includes API clients for many DNS providers such as Azure, GoDaddy, and Google.
See Certify documentation for the selected API, linked from the page in the Certify client.
Test the credentials.
Once the credential test is successful, you can generate a certificate and verify that it is correct.

To distribute the certificate to MailMarshal nodes:

MailMarshal requires the certificate and its key to be in two files: cacert.pem and privkey.pem.

You can create a deployment task to place these files in the Config folder of the Array Manager. They will be automatically distributed to the nodes.

It is not necessary to restart node services. The certificate is retrieved from disk for every use.
Certificates distributed in this way are not immediately validated by MailMarshal. Before configuring automatic distribution of the generated certificates, validate that they include the required SAN entries.

In Certify the Web, create a deployment task of type "Deploy to Generic Server (multi-purpose)"

The trigger type for production is "Run on success"

On the Parameters page:

Save the key as privkey.pem in the config path, by default C:\Program Files\Trustwave\Secure Email Gateway\Config\
Save the full chain as cacert.pem in the config path
MailMarshal does not require the other outputs.

Automating renewal of TLS certificates

Charles — Thu, 03 Sep 2026 01:30:02 GMT

This article applies to:

MailMarshal SMTP
TLS certificate renewal

Question:

How can I automate renewal of email TLS certificates?
How can I automate distribution of updated certificates to processing nodes?

Background:

It is possible to automate certificate generation and distribution using an Automatic Certificate Management Environment (ACME) client.

ACME clients will automatically renew certificates on a schedule.
Automation reduces the chances of error, and helps with the newly required more frequent renewal of certificates.

Certify the Web provides the ability to deploy the generated certificates in PEM files as required by MailMarshal.

This article describes the required workflow with reference to Certify the Web. Other ACME clients are available with similar functionality.

Procedure:

Install Certify the Web on the MailMarshal Array Manager.

Certify is free for evaluation only. Before using this application for production, license the application.

On the Settings page you can select one or more certificate authorities to use.

To set up a certificate:

Begin creating a new certificate.

Manually enter the required list of domains or domain wildcards.

On the Authorization page, select the "dns-01" challenge type. This type is required where the certificate is not bound to a local website.

This authorization type requires you to grant Certify the ability to create TXT records in the DNS zone of the domains that you will be creating certificates for. To accomplish this, Certify includes API clients for many DNS providers such as Azure, GoDaddy, and Google.
See Certify documentation for the selected API, linked from the page in the Certify client.
Test the credentials.
Once the credential test is successful, you can generate a certificate and verify that it is correct.

To distribute the certificate to MailMarshal nodes:

MailMarshal requires the certificate and its key to be in two files: cacert.pem and privkey.pem.

You can create a deployment task to place these files in the Config folder of the Array Manager. They will be automatically distributed to the nodes.

It is not necessary to restart node services. The certificate is retrieved from disk for every use.
Certificates distributed in this way are not immediately validated by MailMarshal. Before configuring automatic distribution of the generated certificates, validate that they include the required SAN entries.

In Certify the Web, create a deployment task of type "Deploy to Generic Server (multi-purpose)"

The trigger type for production is "Run on success"

On the Parameters page:

Save the key as privkey.pem in the config path, by default C:\Program Files\Trustwave\Secure Email Gateway\Config\
Save the full chain as cacert.pem in the config path
MailMarshal does not require the other outputs.

SSL certificate renewal for the Console and Configuration Service

Charles — Mon, 31 Aug 2026 02:01:54 GMT

This article applies to:

MailMarshal 10.X and above

Question:

How long are the MailMarshal interface SSL certificates valid?
Why is the Configuration Service failing to start with SSL errors?
How do I renew a self-signed certificate for MailMarshal components?

Background:

MailMarshal installation creates two SSL certificates, one for the Management Console and one for the Configuration Service.

These certificates are valid for 5 years from the first installation. There is no automatic renewal.

When these certificates expire they must be renewed.

The Configuration Service certificate is not visible to users and the expiration might be missed.

If this certificate expires, the Console and Array Manager may not be able to function properly.

The Console certificate is visible to users, and many customers choose to use a CA signed certificate.
- Expiry of this certificate is easier to notice.

Procedure:

To create a new self-signed certificate for either the Configuration Service or Console, use Windows Powershell. The certificates generated by IIS do not have certain flags required by current browsers.

Certificate creation in Powershell

To create a certificate in Powershell, run Powershell as administrator.

Use a command similar to the following. This command places the new certificate in the "Personal" store for the local computer.

new-selfsignedcertificate -dnsname "myMMserver" -subject "CN=myMMserver" `

-friendlyname "new-for-myMMserver" -KEYLENGTH 2048 `

-NotAfter $([datetime]::now.AddYears(5)) `

-CERTSTORELOCATION cert:\localmachine\my

For more information about certificate creation options, see the Related Links below.

Binding the websites

To apply a new certificate, open the IIS Manager on the MailMarshal Array Manager.

If you need to import a CA signed certificate, see the Server Certificates item on the server root page.
If you created a certificate with Powershell it will already be present.

To use the certificate:

From the menu tree at left, expand Sites
Select the required site (MailMarshal Management Console or MailMarshal Configuration Service).
From the right menu click Bindings
Edit the binding and select your new certificate.
Click OK.

After replacing the certificate:

For the Console, to ensure a new HTTPS connection you may need to fully close all browser windows and start again.
For the Configuration Service, restart IIS and also ensure the Array Manager service is running.

Performance Counters not available

Charles — Sun, 30 Aug 2026 21:00:55 GMT

This article applies to:

MailMarshal (SEG)

Symptoms:

MailMarshal performance counters cannot be selected in Windows Performance Monitor
MailMarshal performance counter information is zero or blank

Causes:

The MailMarshal Performance Monitor DLL was not registered.

Resolution:

For current versions of MailMarshal:

Log on to the server as administrator.
Open a command prompt and navigate to the MailMarshal install folder.
Run one or both of the following:
- For a processing server: lodctr /m:PerfCounters.man
- For an Array Manager server: lodctr /m:AMPerfCounters.man
You should see "Successfully installed performance counters" (some errors may also be reported if the counters were partially installed).
Counters should be available.
- If counters are not available, restart MailMarshal services and check again.

Known issues for Current MailMarshal versions

Charles — Mon, 10 Aug 2026 23:29:27 GMT

This article applies to:

MailMarshal (SEG) 10.X, 11.X, 12.X

Question:

What are the known issues and limitations for MailMarshal?

Information:

This article highlights differences between major versions of MailMarshal, as well as any known issues and major fixed issues.

Updated release 12.0.0.8219 corrects issues in 12.0.0.8194

If you installed MailMarshal 12.0.0.8194, you should upgrade to 12.0.0.8219 as soon as possible. The following issues are present in the earlier release where a Windows credential is used for the Configuration Service database:

During upgrade from earlier versions you will see a notice "Unable to upgrade the MailMarshal Config Service SQL Database"
On systems upgraded from 10.X only, configuration changes will never be delivered to the processing services.
On all systems, you will not be able to use the Config Service Admin Tool Users page.

Upgrading to release 8219 corrects all these issues.

Windows version requirement for upgrade to 12.0

Windows 2019 is the minimum version required for successful upgrade to 12.0. Windows 2016 will be blocked by the installer.

SQL version requirement for upgrade to 11.3 and above

SQL 2017 is the minimum version required for successful upgrade to 11.3. SQL 2016 will be blocked by the installer.

Known issue with upgrade to 11.1 or 11.2 using SQL 2014

SQL 2016 is the minimum version required for successful upgrade to 11.1 or 11.2. SQL 2014 is allowed by the installer but the upgrade will not fully succeed. For details and remediation, see article Q21223.

Known issues with the Entra Connector (11.2)

These issues are corrected in release 11.3.

MailMarshal uses the Array Manager REST API SSL certificate to access a local process that connects to Entra. If the certificate has expired, connections to Entra will fail. Use the MailMarshal Server Tool to generate a new one. Include localhost in the list of SANs.
Import of a group can fail if the group "description" is blank or the group has a large number of members. A hotfix is available - contact Support.

Known issues with upgrade from 8.3.2 to 10.2.X

For installations with separate processing nodes, after upgrading a processing node the MailMarshal Controller service will not start.

A new release 10.2.5.7024 has been issued to correct this problem. Customers upgrading from 8.3.2 with node only servers MUST use this new release. See the MailMarshal Previous Version Downloads page.
A workaround is available for systems actually in the problem state. Contact LevelBlue Support.

For installations using Image Analyzer, after upgrade the MailMarshal Engine may stop when processing images.

Check the Config folder on Array Manager for the file "plugins.xml".
Remove the file "plugins.xml" from the Config folder. Then, on each processing node, remove the file from the NodeConfig folder.
This issue only affects upgrades from 8.X to 10.2 (not earlier 10.X releases).

Updates released in MailMarshal 10.2.5:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.5.

The Console now validates moved rules to prevent moving a target rule above a rule that refers to it (circular policy).
Moving or copying rules between Policy Groups is supported.
Policy printing is supported.
Connector user groups selected for some uses did not display in the user interface. This display issue is fixed. Note that LevelBlue recommends using local groups in these settings (Digests, SpamProfiler exclusions, and DHA settings) with the connector groups as members.

Known issues in 10.2.X:

Some customers have reported an issue in release 10.2.5 with the Array Manager service halting at 0100 local time.
- The issue affects installations in non-default locations (such as D drive).
- The source of this issue has been identified and an update has been published through Automatic Updates.
- If your installation cannot receive the automatic updates, you can request this file through a support case.
- Customers are also encouraged to set the service recovery action to restart the Array Manager automatically.

For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal 10.2.0:

The following issues or limitations present in MailMarshal (SEG) 10.1.0 and below have been resolved in version 10.2.0.

In rare cases, deletion of deeply nested unpacked files could fail.
In version 10.1, in rare cases, child user groups were not correctly loaded on processing nodes.
A new version of the third party SSL library is included. This version addresses performance issues identified in 10.0.7 and 10.1.0
Performance of Image Analyzer has been adjusted. Some scanning issues have been addressed.

Known performance issue in 10.0.7 and 10.1.0

The third party SSL library used in these versions of MailMarshal has been found to use more system resource than earlier releases when under load. It may also initialize more slowly for each connection. In some cases, email throughput can be affected.
A new version of the library is provided in version 10.2.0 and above.

Known issues in 10.1.0:

LevelBlue identified an issue with database insertion in the original release 10.1.0.5089. This issue could affect the display of data in Mail History and the ability to manage processed messages. The issue is resolved in 10.1.0.5102.
- Release 10.1.0.5089 has been withdrawn. Customers must upgrade to the current release 10.1.0.5102.
For customers intending to enable DANE:
- On upgrade if the Policy Management Outbound policy group does not exist, a rule to ignore DANE validation for specified domains will be created in a new upgrade policy group __Upgrade__DANE Rule.
- If this policy group is created, you must edit Filtering conditions of this policy group and ensure it is set to apply to outgoing messages only.

Updates released in MailMarshal (SEG) 10.1.0:

The following issues or limitations present in MailMarshal (SEG) 10.0.7 and below have been resolved in version 10.1.0.

"Unsafe legacy renegotiation" can be enabled with a configuration setting. See LevelBlue Knowledgebase article Q21216.
DKIM record status is correctly displayed in the Management Console Local Domains detail.
The installer does not exit without warning after checking for Visual Studio updates.
See Release Notes for additional updates.

Known issues in 10.0.7:

Unsafe legacy renegotiation disabled: The TLS/SSL library included in release 10.0.7 (and above) does not negotiate outbound (sender) TLS connections where the remote server only supports legacy renegotiation of TLS. The risk in legacy renegotiation is described in CVE-2009-3555. Servers that still use this legacy method are very rare. A hotfix is available for customers who have a business need to allow this risk.
The original 10.0.7 release (3969) caused unexpected changes in TLS behavior. This release has been withdrawn from download pages. The currently available release 10.0.7.3979 corrects this issue. Any customers who installed the earlier release should upgrade immediately.
On some systems the installer will exit with no warning after checking for Visual Studio updates. To continue, simply run the installer again.
Restoring a backup created in an earlier version will cause processing services to stop, because the SSL libraries will be overwritten with the earlier and incompatible versions. For more information and resolution steps, see LevelBlue Knowledgebase article Q21209.

Important Known Issues in 10.0.4:

Folder changes cause quarantine problem: If you edit properties of a Folder, the physical path location information is lost. Message files are stored in an incorrect location. Message details and release for earlier quarantined messages do not work.
Folder editing is corrected in later releases. However, any changes made in 10.0.4 are not automatically fixed.
For customers who encounter this issue, a tool is available to detect incorrectly configured folders and move the incorrectly stored files. Contact LevelBlue support.

Updates released in MailMarshal (SEG) 10.0.7:

The following issues or limitations present in MailMarshal (SEG) 10.0.6 and below have been resolved in version 10.0.7.

Node servers can now be deleted from the installation in the Console.
Import of configurations could fail due to an issue with parsing of XML. This issue is corrected.
See Release Notes for additional updates.

Updates released in MailMarshal (SEG) 10.0.6:

The following issues or limitations present in MailMarshal (SEG) 10.0.5 and below have been resolved in version 10.0.6.

Upgraded installations that have custom Relay or Routing tables did not show the correct values in the website editor initially and other settings for a server could not be changed, with error "The Name field is required". This issue is corrected for new upgrades from version 8.X. To resolve the issue manually, select and save the desired settings for these tables.
Connector group members are not preserved in the upgrade from 8.2 to 10.0, or on restore of a configuration backup. Upgrade and restore now initiate an immediate refresh of these groups.
Console folder date issues related to Daylight Saving Time changes have been resolved.

Updates released in earlier releases:

This section highlights significant fixes that are included in releases 10.0.1 through 10.0.5. See release notes for full information.

In release 10.0.4, editing of folder properties caused messages to be stored in an incorrect location.
In release 10.0.4, for Windows authentication users, the "light" theme was not applied when selected.
In release 10.0.4, the rule condition "sender authenticated successfully" was no evaluated as expected.

Installation/Upgrade:

Prerequisite check on nodes now correct handles the case where IIS was previously installed then uninstalled.
The Configuration Service now accepts passwords that contain the characters: ; = '
Upgrade correctly determines the database location if the location was changed.
Validation of group names is improved.
Detection of WebDAV by the installer is corrected.
Issues with folder and history display when installing the Array Manager on non-English Windows distributions are corrected.
The installer detects port conflict issues (most likely where Exchange or another mail server is installed on the same server). For more discussion of steps required when installing on Exchange Server, see LevelBlue Knowledgebase article Q21146.
The installer prompts for an Operational User for the Configuration Service database if required.
Upgrade handles additional cases where rules (including disabled rules) contain references to templates, folders, or other rules that no longer exist or where the reference was malformed.

Policy elements and settings:

The retention setting shown on the Management Console Reporting page is correctly applied.
On upgraded installations, all Connector groups synchronize as scheduled.
Issues with incorrect selection of items in list views are corrected.
Message Templates and Message Stamps will now use the HTML formatting created using the WYSIWYG editor. You can also continue to use the stylesheet method described in Help.
Timezone offsets are correctly applied to all items in the Dashboard.
Unicode characters in subjects are handled correctly.
Folder permissions using Windows accounts are correctly retained.
In 10.0.2, changing Reporting Groups in the Management Console prevented further configuration changes. This issue is fixed.
Re-commit of the current configuration can be requested from the system configuration > General page.
Reporting Groups configuration is present.
- Caution: An issue has been identified in the Reporting Group interface 10.0.2. Upgrade to 10.0.3.
The Variables list on the HTML message stamp editor is corrected.
Rules can be enabled or disabled from the list view.
Entry of service names/keys in Advanced Settings is no longer case sensitive.
When restore takes a long time, the Management Console correctly shows the status.
Automatic backups are performed only if selected.
Maintenance expiry is correctly shown on the License page.
Configuration can be committed as prompted after entering a license key.

Mail View

Raw HTML source of email can be viewed.
Large lists load with acceptable speed.
Selecting an item no longer causes display issues on smaller resolution displays.
Deleting or forwarding from a filtered list selects the correct item.
Sorting is case-insensitive (as in 8.X).
Issues with folder display in certain timezones are corrected.
Filtering on the Message History pages is corrected. Note that filtering applies only to the displayed page, by design. To search over all available items, use Search instead.

Functionality first added in MailMarshal (SEG) 10.0.1:

The following features (present in SEG 8.X but not in 10.0.0) are included in current releases:

Folder physical path setting for individual folders
Folder security for individual folders
Authorization for configuration and email management by Windows accounts
Granular folder access authorization
Configuration commit scheduling

Known Issues in MailMarshal (SEG) 10.0 and above

Installation/Upgrade

Configuration import error
- Configuration import will fail if services are not listening on the default IP and port. To import manually (using MMExportCFG), use the -a and -c parameters to set the correct server and port information.
Database Collation:
- The MailMarshal databases MUST use a Case Insensitive collation. Installation of SQL sets collation based on the server locale. Most locales use Case Insensitive collation. If in doubt set the database collations to the default SQL_Latin1_General_CP1_CI_AS. Note that the collation MUST NOT be Turkish_CI_AS due to special treatment of the letter "i" in Turkish.
Azure Databases:
- The Installer and Server Tool cannot currently create Azure SQL managed instance databases. SEG can use Azure databases if they are created in advance.
Upgrade - TLS 1.3 and Elliptic Curves:
- LevelBlue previously suggested use of the secp521r1 Elliptic Curve for key exchange. Customers should be aware that if this is the only curve enabled, email delivery from Gmail may not succeed. This change is due to TLS1.3 behaviors and Google's decision not to use the secp521r1 curve.
- The X25519 curve is widely used and this is the default in both SEG 8.2 and MailMarshal (SEG) 10.0 and above.
- To check settings see the Inbound Security - TLS page for each mail server.
Array Join credentials:
- Adding an "Array Join" credential in the SEG Server Tool (used to join a processing server to an array) requires a restart of the Array Manager. The tool does not prompt you for this restart.

Policy Elements and Settings

Configuration restore:
- A restored configuration is committed with no confirmation or possibility of review in some cases.
- Restoring a configuration from a previous version that has rules referencing SpamZeroDay.xml and KnownThreats.xml causes the Engine to stop. (The upgrade process blocks upgrade of these configurations, but restore does not.)
- Restoring a configuration fails if any local MailMarshal user group name contains a fullstop character ( . ) . The error reported in logs may not identify the specific group. Older MailMarshal versions did not validate names. Upgrade validation does not allow these characters when upgrading from 8.X to versions 10.0.4 thorugh 10.2.5.
Configuration backup:
- The retention setting applies to manual as well as automatic backups, since the files are created in the same location. To save manual backups, copy them to another location.
- Backups and restores do not include DKIM keys unless a password is explicitly entered either as default or as override. No warning about missing passwords or unsaved keys is provided.
- A custom backup location set in SEG 8.X will apply in MailMarshal (SEG) 10.0 and above. This setting currently cannot be edited in the new versions.
Licensing:
- Blended Threat licensing status is not shown on the License page.
- Maintenance expiry shows today's date if the key cannot be validated through the LevelBlue website (it should display "unknown").
- Reminders about license status (seen in earlier versions) are not provided when you enter a new key.
- Entering a key that has a Marshal RBL credential forces configuration commit with no notice.
- Upgrading with an expired key results in no key being displayed on the License page. This behavior will not be changed.
Mail Server settings:
- If custom settings have been configured, reverting to the default settings and saving does not update the display in the console. The settings have actually been updated correctly.
Policy Elements:
- Dead Letter folders are not configurable in the Folders list.
Rules
- Enabling default virus scanner rules does not validate that a scanner is present and working.
Users
- Setting a user to "blocked" or "deleted" is only effective after a restart of the Management Console website.

Mail View

Message History:
- The default view of message history only shows items from "today". To see all items, use Search. The default should be to return all items up to the configured row count.

API

Some REST API calls listed in the automatically generated "handler listing" are not available. This includes TextCensor addition, edit, and deletion

Limitations in MailMarshal (SEG) 10.0 and above

The following functionality that was present in previous versions is not currently available in 10.0 and above.

Finding items in User Groups and IP Groups
Restore from Mail Recycle Bin (this does not affect retention of messages)
RSS news feeds
- Alternative: subscribe to the Notifications forum on the LevelBlue support site

Retired Features

The DMARC Dashboard has been retired. Customers must use third party services for this functionality.

The "Do not log to SQL" option when deleting a message is not available in this version of MailMarshal.

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

Charles — Mon, 10 Aug 2026 22:54:32 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal Secure Email Server/MailMarshal SES

Question:

What versions of MailMarshal (SEG) are currently supported by LevelBlue Technical Support?
What versions of MailMarshal ECM/MailMarshal Exchange are currently supported by LevelBlue Technical Support?
What versions of MailMarshal Secure Email Server are currently supported by LevelBlue Technical Support?

Information:

Important: End of Support and End of Threat Protection dates for many earlier versions have now passed.

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For versions that have passed the end of support, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

Versions out of support do not receive component updates such as file type and unpacking updates.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Automatic updates to LevelBlue threat protection technologies for SEG (such as SpamCensor, Known Threats, YAE scripts) may be provided to some versions that are out of support. The table below lists this date separately.

All versions earlier than those listed are out of support and do not receive threat protection updates.

This includes MailMarshal 8.0.X and 8.1.X.

MailMarshal (SEG)

Software Version

Release Date
Support Status
End of Support

End of Threat
Protection Updates

12.0.0.8219 August 11, 2026 Active

12.0.0.8194 August 5, 2026 Withdrawn August 11, 2026

11.3.0.7659 December 2, 2025 Active

11.2.0.7413 September 4, 2025 Active

11.1.0.6958 May 29, 2025 Active

10.2.5.7024 June 5, 2025 Active

10.2.5.6043 September 10. 2024 Active

10.2.0.5718 July 2, 2024 Discontinued   June 1, 2026   June 1, 2026

10.1.0.5102 April 3, 2024 Discontinued   June 1, 2026   June 1, 2026

10.1.0.5089 March 28, 2024 Withdrawn April 3, 2024

10.0.7.3979 September 29, 2023 Discontinued June 1, 2026   June 1, 2026

10.0.7.3969

September 12, 2023

Withdrawn

September 29, 2023

10.0.6.3739

February 28, 2023
Discontinued February 1, 2025 June 1, 2025

10.0.5.3470

August 31, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.4.3361

May 16, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.3.2387

July 6, 2021
Discontinued
February 1, 2024
December 31, 2024

10.0.2.2230

April 28, 2021

Deprecated

July 6, 2021
December 31, 2024

10.0.1.2030

November 3, 2020
Discontinued
September 1, 2022
December 31, 2024

10.0.0.1428

April 14, 2020

Deprecated

November 3, 2020
December 31, 2024

8.3.2.11492 September 29, 2023 Discontinued August 1, 2025 December 31, 2025

8.2.6.11305

December 22, 2020
Discontinued February 1, 2025 June 1, 2025

8.2.4.11170

October 31, 2019
Discontinued
March 31, 2022
December 31, 2024

8.2.3.11111

July 2, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.2.11949

February 14, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.1.11863

December 14, 2018
Discontinued
March 31, 2021
December 31, 2024

8.2.0.11849

December 6, 2018

Withdrawn

December 14, 2018
December 31, 2024

MailMarshal ECM (formerly MailMarshal Exchange)

Software Version

Release Date
Support Status
Discontinued Date

7.2.0.9773

March 7, 2017

Active

7.1.7.7380

January 12, 2015
Discontinued
February 1, 2019

MailMarshal Secure Email Server (SES)

Software Version

Release Date
Support Status
Discontinued Date

5.8.1.398

July 24, 2017
By special arrangement only

5.8.0.361

May 30, 2016
By special arrangement only

5.7.2.9723

May 1, 2013

December 31, 2012

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

How to use the Support Tool for MailMarshal SPE

Charles — Wed, 05 Aug 2026 01:58:11 GMT

This article applies to:

MailMarshal SPE

Question:

How do I use the Support Tool for MailMarshal SPE?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about a MailMarshal SPE installation. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about MailMarshal SPE, MailMarshal SEG, IIS, Marshal virus scanners, and the Connector Agent.

Note: For help with the Support Tool for other LevelBlue email products (MailMarshal SEG, LevelBlue ECM, WebMarshal, and MRC), see Q15024.

Installation

The tool is included in current installations of SPE and MailMarshal. You can also download the latest version manually if necessary from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

Copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect to check for updates, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool (latest version 2.x) appears as shown below. This interface is simplified compared to earlier versions. The data gathered is the same.
- For reference, a screenshot of the earlier version of the tool is provided at the end of this article.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Click Gather to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include the SPE database statistics data. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Dark/Light mode

Version 2.0 provides an optional dark theme for the interface. Use the slider at the top to select the theme.

Version: Shows the version of the Support Tool.

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a MailMarshal processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

NOTE: A minimum of 2 days is recommended to ensure that at least one file of each type is included.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.

Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

SPE database

Include the SPE configuration and logging data as CSV files.

Warning: Only select these items if directed by LevelBlue Support. Including the SPE database data can result in a very large file. In some cases it could consume all available disk space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.

In addition to the above items, the following are always gathered by version 2 of the tool:

System Information

Includes a listing of the system hardware and operating system information. 8.3 file naming settings are included.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

Event logs

Includes Windows Event Log information.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
The tool is able to gather information for current versions of all components.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.
The previous version of the tool appears as below:

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles — Wed, 05 Aug 2026 01:57:35 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about installed software and configuration. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal, ECM, or WebMarshal).

Otherwise, download the support tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, download or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool (latest version 2.X) appears as below. This interface is simplified compared to earlier versions. The data gathered is the same.
- For reference, a screenshot of the earlier version of the tool is provided at the end of this article.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click Gather to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Dark/Light mode

Version 2.0 provides an optional dark theme for the interface. Use the slider at the top to select the theme.

Version: Shows the version of the Support Tool.

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

Gather specific message

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

NOTE: A minimum of 2 days is recommended to ensure that at least one file of each type is included.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.
Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

In addition to the above items, the following are always gathered by version 2 of the tool:

System Information: Includes a listing of the system hardware and operating system information. 8.3 file naming settings are included.
Current process details: Includes a listing of processes running on the server.
Configuration details: Includes the XML or text files that define configuration of the selected software.
Marshal Registry: Includes a copy of the registry hive for all components that are present on the server.
Marshal install directory listings: Includes file and version information for files in the installation directories of all selected components.
Event logs: Includes Windows Event Log information.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.
The earlier product interface appears as below:

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles — Wed, 05 Aug 2026 01:57:35 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal, ECM, or WebMarshal).

The current version of the tool is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, download or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool (latest version 2.X) appears as below. This interface is simplified compared to earlier versions. The data gathered is the same.
- For reference, a screenshot of the earlier version of the tool is provided at the end of this article.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click Gather to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Dark/Light mode

Version 2.0 provides an optional dark theme for the interface. Use the slider at the top to select the theme.

Version: Shows the version of the Support Tool.

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

Gather specific message

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

NOTE: A minimum of 2 days is recommended to ensure that at least one file of each type is included.

Marshal Crash Dumps

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

In addition to the above items, the following are always gathered by version 2 of the tool:

System Information: Includes a listing of the system hardware and operating system information. 8.3 file naming settings are included.
Current process details: Includes a listing of processes running on the server.
Configuration details: Includes the XML or text files that define configuration of the selected software.
Marshal Registry: Includes a copy of the registry hive for all components that are present on the server.
Marshal install directory listings: Includes file and version information for files in the installation directories of all selected components.
Event logs: Includes Windows Event Log information.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.
The earlier product interface appears as below:

Documentation for the MailMarshal REST API

Charles — Tue, 04 Aug 2026 22:08:03 GMT

This article applies to:

MailMarshal/SEG 8.0 and above
REST API

Question:

Is there any documentation for the REST API?
What functions are available through the REST API?

Information:

MailMarshal exposes a REST API for management functions.

This API provides all email administration functions, and a limited set of configuration functions.

You can use the API to:

View and act on messages in folders
Manage SQM users and configuration
Commit configuration
Force SpamCensor update
Update user groups and members
Query service and processing statistics
Query DMARC data

The API cannot be used to manage rules and settings.

Caution: DKIM key functionality should be considered "read only".

The API is a HTTPS web interface on the Array Manager server (port 19006 by default).

Security:

In MailMarshal (SEG) 10.0 and above, the API is secured using Bearer tokens derived from Management Console credentials. Windows ACLs are not used. For details, see the API Handler listing document for your version, attached to this article.

Even when you use NTLM to secure the Management Console, you must use the local MailMarshal credentials (not Windows accounts) to access the API.
The one exception to this rule is for API connections from the Array Manager server. These connections can use the local Administrator credential.

In SEG 8.X, the API is secured using Windows credentials and implements the same account permissions as the Console and Configurator.

To use the API, the account must have the permission Log on as a batch job. Administrator accounts have this permission by default. You can grant this permission to other accounts using Group Policy.

Calling Applications:

You can use an application such as Postman to connect to the API for testing purposes.
You can use any scripting language to develop production uses for the API.

Caution:

The REST API is used internally by SEG and SPE. It is exposed for use by customers who have appropriate understanding and skills.
Documentation is limited to the API definitions and this article.
LevelBlue does not provide detailed usage documentation or support for applications that call the API. Development of any such application is at the customer's risk and responsibility.
Test on a test system before deploying to production, and ensure automatic configuration backups are enabled.
Data entered through the API may not be fully validated by SEG. The calling application is responsible to ensure that data is valid and correctly formatted.
- In particular, string data such as object names is only validated in the Configurator.
- See the section Known validation items for details.
API functions are subject to change. Applications should check the interface version or product version before making other calls.

To enable and configure the REST API, use the SEG Server Tool.

To retrieve a list of available functions in the installed version of the API, when logged on to the Array Manager server, use the following URL:
https://localhost:19006/seg/api/debug/handlers/
- The response includes descriptions and definitions of each available call to the API.
- Attached to this article is a formatted copy of this listing updated for SEG 8.2.3, and another updated for a recent version of MailMarshal (SEG) 10.X.
  - Note that the available functions in these releases differ, and future releases are also likely to differ.
- The API can be made available from other locations as with any website, depending on firewall settings. Ensure that this interface is secured against abuse.
Input and output is in JSON format.
Query Parameters are sent as a http querystring. The parameter names are case sensitive.
Variable data in querystrings MUST be URL Encoded. For example, a semi-colon ; must be represented as %3B
Times (integers) are Unix epoch timestamps. The minimum value is 0 and the maximum value is 2147483647. For testing, you can convert times using many free online services. For production, cast the date/time to this format programmatically.
Where the API requires a processMessageKey, this is a JSON object containing the following items that can be retrieved from results of findmessage (all items required):
- blockNumber, edition, folderId, messageName, recipient, serverId, timeLogged

Simple GET examples:

Send a GET request to return information.

Get list of servers
https://localhost:19006/seg/api/services/servers
- Returns information like the "servers" list in the Configurator, including the server ID
Get receiver statistics for server 1
https://localhost:19006/seg/api/console/overview/1/receiver
- Returns similar statistics to the Console Servers | Receiver window.
Get list of groups
https://localhost:19006/seg/api/groups
Get list of members in a group
https://localhost:19006/seg/api/groups/3/members
- Returns details of each user in the group.

Simple POST examples:

Add an email address member to a group

The call is defined as:

 {  "description": "Add member to a group   Post data fields: memberType(int), memberGroupId(int),      memberData(string), touchDate(int)      GroupMemberType: 0 - group, 1 - email, 2 - wildcard",  "method": "POST",  "url": "^groups/usermaintained/(?<groupid>[0-9]+)/members/$" }

The URL to add a member to Group 3 is:
https://localhost:19006/seg/api/groups/usermaintained/3/members

Send a POST request with JSON formatted body, such as:

{      "memberType":1, "memberData":"coo@example.com">", "touchDate":0}

Returns a JSON message (member added, or member already exists)

Kill messages from the Sender queue by recipient, sender, or subject

The call is defined as:

 {  "description": "Kill messages current queued/being delivered by Sender   Post data fields: sender(string,regular expression),     recipient(string,regular expression),      subject(string,regular expression),     speCustomerId(int) - at least one of these is required     bNotify(bool, optional)",  "method": "POST",  "url": "^console/sender/message/killex/(?<serverid>[0-9+]/" }

The URL to kill messages on server 2 is:
https://localhost:19006/seg/api/console/sender/message/killex/2/
Send a POST request with JSON formatted body. For instance, to kill messages to gmail.com and return a notification to the senders:
```
{      "recipient":".*@gmail\\.com$","bNotify":true}
```
Note the double-backslash required as the escape character in JSON representation of regular expressions
Returns a JSON message (number of messages deleted and server number)

Search Mail History (similar to Console search)

The call is defined as:

 {  "description": "Finds message by specified parameters   Post data fields: startTime(int, required), endTime(int, required),     folderId(int), messageName(str), actionType(int), classification(int),
    fromUser(str), fromDomain(str),toOrFrom(bool), toUser(str), 
    toDomain(str), minSize(int), maxSize(int), subject(str), 
    searchHistory(bool), forwards(bool), blockNumber(int64), 
    searchBlankSubject(bool), direction(int)
Query parameters: maxRows(int, required)",  "method": "POST",  "url": "^quarantine/findmessage/$"}

The URL to return up to 5 results is:
https://localhost:19006/seg/api/quarantine/findmessage/?maxRows=5
Send a POST request with JSON formatted body. You must include a start and end time as Unix time integers. You must include the querystring parameter maxRows.
Parameters are case sensitive.
For instance, to find messages sent from gmail.com, from the earliest to the last available time, use this body:
```
{      "startTime":0 , "endTime":2147483647 ,"fromDomain":"gmail.com"  }
```
By default the search only finds messages quarantined in folders. To include history records like "Undeliverable" results, add "searchHistory":true
To understand the other available parameters, see the Search feature in the Console.
To find folder and classification IDs, look them up using other REST calls
Returns a JSON array (details of the matching messages)

Simple PATCH example using a JSON array:

Update IP group membership with addition and deletion in the same call

The call is defined as:

{  "description": "Add membership delta information to an IP group   Patch data fields:     add(array of objects with fields:            ipAddressStart(string), cidr(int),            ipAddressEnd(string, required only when cidr is 0),            name(string), description(string)),     remove(array of objects with fields:            ipAddressStart(string), cidr(int), ipAddressEnd(string))",  "method": "PATCH",  "url": "^ipgroups/(?<groupid>[0-9]+)/delta/$" }

The URL to change membership of Group 15 is:
https://localhost:19006/seg/api/ipgroups/15/delta

Send a PATCH request with JSON formatted body, such as:

{"add":[  {"ipAddressStart":"10.1.1.0","cidr":28,   "name":"Address Item 1","description":"Ten"},  {"ipAddressStart":"12.1.1.0","cidr":28,   "name":"Address Item 2","description":"12"}],"remove":[  {"ipAddressStart":"10.1.2.3","ipAddressEnd":"10.1.2.3","cidr":32}]}

Item names and IP ranges must be unique.
If any one of the operations cannot be performed, the entire call is cancelled
Returns a JSON message (group updated, or member to add already exists, or member to remove does not exist)
Note that for this call both Add and Remove sections are required. However either can be completely blank []

Known validation items

Group names and IP group item entry names must not contain any of the following characters:
( ) / \ ; .
Names using these characters are accepted by the API and do not cause problems with processing. However if you edit an item in the Configurator, you must remove the disallowed characters from the name before saving it.
Quarantine message find commands require a start time and end time, as well as a value for the maxRows parameter. If any of these are missing, no rows are returned.

What is the Product Support Lifecycle for DbProtect and AppDetectivePRO?

Charles — Tue, 04 Aug 2026 21:55:46 GMT

This article applies to:

AppDetectivePRO (All Versions)
DbProtect (All Versions)

Question:

What is the AppDetectivePRO or DbProtect product support lifecycle?
How long is my version of AppDetectivePRO or DbProtect supported for?

Information:

Supported versions of the named products are the latest release, and the two previous releases.

Earlier releases are not supported.
For your convenience, a recent product support matrix is included below. Versions not listed are out of support.

Version upgrades are available to all customers that have current support and maintenance contracts.

Clients running unsupported software are strongly encouraged to plan for an upgrade or fresh installation of their licensed software. Newer releases of software offer better performance, new features and capabilities, and often resolve issues experienced in older releases of software.

As always, new releases of licensed software are available for download at no additional cost for clients with a current and valid maintenance agreement (for DbProtect) or software subscription (AppDetectivePRO).

Important Notes:

If you are running older, unsupported versions of licensed software that are more than two versions behind the current release, please contact dbsssupport@levelblue.com before attempting any in-place upgrade or fresh installation.
Requirements to successfully install AppDetectivePRO and DbProtect may have changed since you last installed software. Please check the relevant README and Installation/Upgrade Guide documents before attempting an upgrade or installation. Please contact dbsssupport@levelblue.com with any questions.

AppDetectivePRO:

Version	Software Release Date
AppDetectivePRO 10.14	July 2026
AppDetectivePRO 10.13	March 2026
AppDetectivePRO 10.12	June 2025

DbProtect:

Version	Software Release Date
DbProtect 6.7.1	July 2026
DbProtect 6.7.0	March 2026
DbProtect 6.6.15	July 2025

How do I check that MailMarshal (SEG) is updating correctly?

Charles — Tue, 04 Aug 2026 20:50:59 GMT

This article applies to:

MailMarshal (SEG)

Question:

How do I check that web updates are working?
Is SpamCensor up to date?
Is SpamProfiler up to date?
Is the Blended Threats Module (BTM) up to date?
Are virus signatures up to date?
Is my IP Reputation Service license up to date?
What websites must be allowed through a firewall for updates to work?

Information:

To check that the MailMarshal (SEG) product automatic updates are working, see the relevant sections below.
Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

For troubleshooting notes see the end of this article

All update functions and TLS - Certificate issues

If service logs show errors related to SSL certificates, your server may be lacking a required SSL Root Certificate (CA Certificate) needed to verify the server certificate. Also, using a proxy server with HTTPS content inspection could cause issues.

Sample error:
SSL certificate problem, verify that the CA cert is OK.
Details: error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
For a resolution, see LevelBlue Knowledge Base article Q13703.
Note also that you must allow HTTP access to Certificate Revocation List servers so that SSL certificates can be validated. For TLS, this requires access via HTTP (port 80) from processing nodes to all certificate authority sites.

Spam Censor

[Updated by the MailMarshal Array Manager service]

The Spam Censor Updates run under the Array Manager Service on the Array Manager server, and they require HTTP and HTTPS access. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access).

Required URLs are:

HTTP:://www.marshal.com
HTTPS://www.marshal.com
HTTPS://cdn-updates.marshal.com
- This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.

If updates are not succeeding, particularly with a proxy, you may need to run the Array Manager service using a Windows account with administrative privilege and proxy permissions.

To check that updates are successful, see the Configurator (MailMarshal Properties > Automatic Updates). You can check that the SpamCensor updates are current by clicking Check for Updates Now.

SpamProfiler

This information applies to all supported MailMarshal versions.

[Updated by MailMarshal SpamProfiler Process]

The Array Manager checks daily to verify licensing of this service. The required URL is https://mailmarshal.licensing.marshal.com/

You can check licensing activity by searching the MMArrayManager log (located in the \Logging folder of the installation).

SpamProfiler updates are retrieved by services running on the MailMarshal processing servers (in an array, each server updates separately). To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

Required URLs are:

HTTP://sigupdates.marshal.com (not used in 12.0 and above)
HTTPS://sigupdates.marshal.com (not used in 12.0 and above)
HTTP://cdn-microupdates.cloudmark.com
HTTPS://cdn-microupdates.cloudmark.com
HTTP://pki.cloudmark.com/
HTTPS://pki.cloudmark.com/
HTTP://lvc.cloudmark.com/
HTTPS://lvc.cloudmark.com/
HTTP://tracks.cloudmark.com/
HTTPS://tracks.cloudmark.com/
HTTP and HTTPS access to the following network range: 208.83.136.0/22

NOTE: HTTPS is the default protocol for most connections. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for all the above URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.

You can check that SpamProfiler is updating by viewing the MMReceiver or MMSpamProfiler log (located in the \logging folder of the installation).

You should see an entry like the following when you first enable spam profiler:

[MICROUPDATE] Successful auto configuration download from network (new serial xx.xx).

and subsequent updates like:

[MICROUPDATE] Successful signatures incremental download from network (new serial xxxxxxx.xxxxxxx)

URL Categorizer Service

[Check performed by the MailMarshal Engine service]

The URL Categorizer check requests are performed in real time by the Engine service on each SEG processing server. To set a proxy and proxy logon information if required, you can use the Configurator (MailMarshal SEG Properties > Internet Access) to set "default access for nodes". You can also set different proxy details for each node.

The default required URLs are:

HTTP://tw-seg-urlcategorizer.cloudapp.net (Located in Americas region)
- also known as urlcategorizer.seg.trustwave.com
HTTP://tw-seg-urlcategorizer-au.cloudapp.net/ (Located in APAC region)

Note that the SEG installation will select an instance based on geography and latency. All installations should have access to both instances.

You can choose to use HTTPS for these requests. See article Q20362.

Blended Threat Service

[Licensing update by Array Manager service]

The Array Manager checks daily to verify licensing of this service.

The required URL is https://mailmarshal.licensing.marshal.com

Note: ALL installations of MailMarshal/SEG 7.1 and above perform this check. It is not limited to installations licensed for the Blended Threats service. Installations without the service still must check in order to determine whether a license has been added.
You can check licensing activity by searching the MMArrayManager log (located in the \logging folder of the installation).
In version 7.1, search for the string BTM Provisioning
In version 7.2 and above, search for the string Licensing

Testing and validation of URLs is performed in real time when the user clicks the URL.

For version 11.1 and earlier:
- URLs are checked through web request to the site scanmail.trustwave.com (from the user's browser)
- Click statistics are retrieved through web request to the site stats.scanmail.trustwave.com (from the Array Manager)
For version 11.2 and later:
- URLs are checked through web request to the site HTTP(S)://urlscanner.mailmarshal.cloud (from the user's browser)
- Click statistics are retrieved through web request to the site HTTPS://stats.btm.protection.mailmarshal.cloud (from the Array Manager)

Licensing/Maintenance display
Marshal IP Reputation Service provisioning

[Licensing update by Array Manager service]

The Array Manager checks daily to verify maintenance entitlement for the product, and checks as required for Marshal IP Reputation Service information.

The required URL is https://mailmarshal.licensing.marshal.com

You can check activity by searching the MMArrayManager log (located in the \Logging folder of the installation).
Search for the string Licensing or RBL Provisioning

Bitdefender for Marshal
McAfee For Marshal
Sophos For Marshal

[Updated by Marshal Bitdefender Updater, Marshal Sophos Updater, or Marshal McAfee Updater services]

These plug-ins update on each processing server. To set a proxy or local update location, use the configuration console for each application. You can check that updates are successful using the configuration console. Update information is also logged to text log files.

Note that the required URLs differ depending on the version installed

For details see the following articles:

Bitdefender for Marshal: Q20561
McAfee for Marshal: Q11360
Sophos for Marshal: Q11906

Entra Connector

[In MailMarshal 11.2 and above; retrieves user group information directly from Microsoft Entra ID]

This connector is implemented by the MailMarshal RPC Proxy service on the Array Manager. For infomation on how to set a proxy, see Knowledgebase article Q21252.

Troubleshooting notes:

If SpamProfiler or Blended Threats (7.1 and above) is not updating as expected:

Verify the internet access settings in TWO locations, even for a single server installation:
- MailMarshal Properties > Internet Access
- Server and Array Configuration > Server Properties for the individual server > Internet access (Customize...)
The customized node setting overrides the main setting, even if you have only one server.

This access setting is also used for retrieval of Certificate Revocation Lists for TLS functionality (version 7.1 and above)

Required URLs for Web Updates

Charles — Tue, 04 Aug 2026 20:48:55 GMT

This article applies to:

MailMarshal SEG
MailMarshal SPE

Question:

What URLs are required for product feature updates?
What URLs are required for product licensing updates?

Information:

The following URLs are used by MailMarshal SEG (MailMarshal) and MailMarshal SPE (Service Provider Edition).

You must allow access through your firewall from the servers as noted.

Note that the URLs may map to dynamic IP addresses. It is not possible to give a definitive list of IP addresses.

The SEG requirements also apply to the processing arrays in a SPE installation.

URL	From Server	Purpose	More Info
HTTP (port 80) to all locations, including (but not limited to) HTTP://crl3.digicert.com HTTP://crl4.digicert.com HTTP://o.lencr.org Note: For correct operation of TLS, the Controller service on all processing nodes must have access to HTTP port 80 without restriction. TLS certificate revocation lists are published over HTTP and there is no definite list of URLs.	All	HTTPS Certificate Checking	Q12992
HTTPS://mailmarshal.licensing.marshal.com	Array Manager	Licensing IP Reputation Service credential	Q12992
HTTP://www.marshal.com HTTPS://www.marshal.com	Array Manager	SpamCensor and processing module updates	Q12992
HTTPS://cdn-updates.marshal.com This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.	Array Manager	SpamCensor and processing module updates (Azure CDN)	Q12992
HTTP://sigupdates.marshal.com HTTPS://sigupdates.marshal.com HTTP://cdn-microupdates.cloudmark.com HTTPS://cdn-microupdates.cloudmark.com HTTP://pki.cloudmark.com/ HTTPS://pki.cloudmark.com/ HTTP://lvc.cloudmark.com/ HTTPS://lvc.cloudmark.com/ HTTP://tracks.cloudmark.com/ HTTPS://tracks.cloudmark.com/ HTTP and HTTPS access to the following network range: 208.83.136.0/22	Processing Nodes	SpamProfiler HTTPS is the default protocol. Version 12.0 and above does not use the "sigupdates" alias. The "cdn-microupdates" alias is the same endpoint. If you use a proxy server that inspects HTTPS content (such as WebMarshal), you should bypass the proxy for these URLs. SpamProfiler licensing and updates will fail if proxy SSL certificates are used.	Q12992
HTTP://scanmail.trustwave.com HTTPS://scanmail.trustwave.com HTTP(S)://urlscanner.mailmarshal.cloud (11.2 and above) (These URLs may redirect or resolve to different IP addresses)	User's workstation	Blended Threat Service URL check	Q12992
HTTPS://stats.scanmail.trustwave.com HTTPS://stats.btm.protection.mailmarshal.cloud (11.2 and above)	Array Manager	Blended Threat Service statistics retrieval	Q12992
HTTP://urlcategorizer.seg.trustwave.com	Processing Nodes	URL Categorizer URL check Note: this service has multiple geographically distributed instances. MailMarshal installations use the best instance based on geography and latency.	Q12992
HTTP://sophos.marshal.com HTTPS://sophos.marshal.com	Processing Nodes	Sophos for Marshal Engine and IDE updates (if installed). HTTPS required from SfM version 1.1. Note that the LiveProtection service (present in version 1.1 and above) performs DNS-based queries and must have access to a DNS server that can query the Sophos DNS servers.	Q11906
HTTP://mcafee.marshal.com HTTPS://mcafee.marshal.com	Processing Nodes	McAfee for Marshal Engine updates (if installed). HTTPS required from MfM version 1.1.	Q11360
HTTP://update.nai.com/	Processing Nodes	McAfee for Marshal definition file updates (if installed)	Q11360
HTTPS://bitdefender.marshal.com HTTPS://agent-av-mirror.trustwave.com	Processing Nodes	Bitdefender for Marshal Engine and signature updates (if installed)	Q20561
HTTP://activations.marshal.com/ HTTPS://activations.marshal.com/	SPE MIA server or Maintenance Agent/Web Console server	SPE licensing and Connector Agent updates	Q12161
HTTPS://login.microsoftonline.com/ HTTPS://graph.microsoft.com/	Array Manager	Entra Connector NEW	Q21252

Note:

You can set a web proxy for these requests.

In SEG, see the Configurator, Tools > SEG Properties > Internet Access
- For the Entra Connector, see the Knowledgbase article linked above.
In SPE:
- For licensing, see the Web Admin Console, System Settings > Proxy
- For SEG arrays, see the properties of each array in the Web Admin Console.

LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Node failing to contact Array Manager in cross domain installation

This article applies to:

Symptoms:

Causes:

Resolution:

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

This article applies to:

Question:

Information:

Notes:

What versions of WebMarshal are currently supported by LevelBlue Technical Support?

This article applies to:

Question:

Information:

Notes:

Latest versions of Unpacker and Filetype for WebMarshal

This article applies to:

Question:

Information:

Latest File Versions

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Current Known Issues for latest released version

This article applies to:

Question:

Resolved Issues:

Known Issues and Limitations:

Fixed Issues:

Notes:

Additions to Release Notes for WebMarshal 8.0

This article applies to:

Question:

Information:

Configuring Encrypted Connections to the WebMarshal Database

This article applies to:

Question:

Procedure:

Notes:

What file types are recognized by WebMarshal 7.X and 8.X?

This article applies to:

Question:

Information:

Archive

Azure IRM Protected Documents

Document

Drawing

Encrypted

Executable

Font

Image

Mail Components

Other

Sound

Video

Web Browsing

Non-Selectable Types

Notes:

Additions to Release Notes for MailMarshal 12.0

This article applies to:

Question:

Information:

Updated release

Additional updates

How do I use Intermediate Certificates with MailMarshal TLS?

This article applies to:

Question:

Procedure:

Notes:

Requesting and installing a signed certificate for TLS

This article applies to:

Workstation Operating Systems
(for server installation)