D-Link NetDefendOS User Manual page 451

A whitelist of email addresses can be specified so that any mail from/to those addresses is
allowed to pass through the ALG regardless if the address is on the blacklist or that the mail
has been flagged as Spam.
• Verify MIME type
The content of an attached file can be checked to see if it agrees with its stated filetype. A list
of all filetypes that are verified in this way can be found in Appendix C, Verified MIME filetypes.
This same option is also available in the HTTP ALG and a fuller description of how it works can
be found in Section 6.2.2, "The HTTP ALG".
• Block/Allow filetype
Filetypes from a predefined list can optionally be blocked or allowed as mail attachments and
new filetypes can be added to the list. This same option is also available in the HTTP ALG and
a fuller description of how it works can be found in Section 6.2.2, "The HTTP ALG". This same
option is also available in the HTTP ALG and a fuller description of how it works can be found
in Section 6.2.2, "The HTTP ALG".
• Anti-Virus scanning
The NetDefendOS Anti-Virus subsystem can scan email attachments searching for malicious
code. Suspect files can be dropped or just logged. This feature is common to a number of
ALGs and is described fully in Section 6.5, "Anti-Virus Scanning".
The Ordering for SMTP ALG Processing
SMTP filtering obeys the following processing order and is similar to the order followed by the
HTTP ALG except for the addition of Spam filtering:
1. Whitelist.
2. Blacklist.
3. Spam filtering (if enabled).
4. Anti-virus scanning (if enabled).
As described above, if an address is found on the whitelist then it will not be blocked if it also
found on the blacklist. Spam filtering, if it is enabled, is still applied to whitelisted addresses but
emails flagged as spam will not be tagged or dropped, only logged. Anti-virus scanning, if it is
enabled, is always applied, even though an email's address is whitelisted.
Notice that either an email's sender or receiver address can be the basis for blocking by one of
the first two filtering stages.
451
Chapter 6: Security Mechanisms