Vade Cloud Administrator Guide

Last modified: February 8, 2024

Vade Cloud Administrator Guide

Table of Contents
1. Overview................................................................................... 4
1.1. Recommended architecture...........................................................................4
1.2. Initial startup..............................................................................................7
1.3. Support..................................................................................................... 8

2. Clients....................................................................................... 92.1. Add a client.............................................................................................. 10
2.2. List of clients............................................................................................ 11
2.3. Providing a license..................................................................................... 122.4. Available subscriptions............................................................................... 13
2.5. Domain configuration................................................................................. 14
2.5.1. Add domains.......................................................................................142.5.2. Inbound............................................................................................. 16
2.5.3. Outbound........................................................................................... 20
2.6. Domain Diagnosis...................................................................................... 24
2.7. User management..................................................................................... 28
2.7.1. Creating users.....................................................................................28
2.7.2. User quarantine...................................................................................48
2.8. Policy Configuration................................................................................... 51
2.8.1. Inbound............................................................................................. 51
2.8.2. Outbound........................................................................................... 59
2.8.3. Exception rules....................................................................................62

3. Statistics..................................................................................67
3.1. Statistics.................................................................................................. 67

4. Customization..........................................................................68
4.1. Customizing the user interface.................................................................... 68
4.2. Customizing the statistics report.................................................................. 69
4.3. Customizing email headers......................................................................... 70

5. Monitoring & Reports............................................................... 71
Copyright © 2024 - Vade

1

Vade Cloud Administrator Guide

5.1. Logs........................................................................................................ 71
5.1.1. Email logs.......................................................................................... 71
5.1.2. Event logs.......................................................................................... 74
5.2. Reports.................................................................................................... 76
5.2.1. Statistics report...................................................................................77
5.2.2. Report Indicators.................................................................................79
5.2.3. Configuration & Customization...............................................................87

6. FAQs........................................................................................ 91
6.1. Configure the platform............................................................................... 91
6.1.1. How to migrate MX records?..................................................................91
6.1.2. How to choose the most appropriate user discovery mode?....................... 97
6.1.3. How to properly configure my domain?................................................... 99
6.1.4. How to update the contact address?..................................................... 100
6.1.5. How does the global inbound quarantine work?...................................... 101
6.1.6. How to import a list of users?.............................................................. 102
6.1.7. How to set inbound and outbound relays?............................................. 103
6.1.8. How to prevent users from accessing their quarantine?........................... 104
6.1.9. How to enable outbound filtering?........................................................ 105
6.1.10. How to reinforce malware protection?................................................. 108
6.2. Use the platform......................................................................................109
6.2.1. How to declare an alias?..................................................................... 109
6.2.2. Does the quarantine content need to be flushed?................................... 111
6.2.3. How to verify that emails are properly sent and received?....................... 112
6.2.4. Can I use a partner's email as the Global Administrator for my client?....... 113
6.2.5. How to read the detailed logs?.............................................................114
6.2.6. How to send a quarantine report to a user?........................................... 115

7. Troubleshooting.....................................................................116
7.1. Why can't I create new domains or users?................................................... 116
7.2. Why are emails rejected after SPF verification?............................................ 117
7.3. Why are emails delayed?.......................................................................... 118
7.4. Why is spam still being received?............................................................... 119
7.5. Why are quarantine reports not sent?......................................................... 120
7.6. How to receive a password for my account?.................................................121

Copyright © 2024 - Vade

2

Vade Cloud Administrator Guide

7.7. Why are my configurations ignored?........................................................... 122

Copyright © 2024 - Vade

3

Vade Cloud Administrator Guide

1. Overview
1.1. Recommended architecture
Vade Cloud™ performs message analysis outside your network so that it delivers
only clean email traffic on your firewall.

Operating architecture of Vade Cloud™

MX Setup
In order for Vade Cloud™ to receive emails, the MX fields have to be configured asindicated below:
MX ListMX

Weightmx01.cloud.vadesecure.com

10

mx02.cloud.vadesecure.com

10

mx03.cloud.vadesecure.com

10

mx04.cloud.vadesecure.com

10

Copyright © 2024 - Vade

4

Vade Cloud Administrator Guide

Using extra MX records, in addition to the ones listed above (forbackup/failover purpose for instance), will result in spam emails bypassing
the filtering platform.
Some DNS hosts require to add a dot at the end of the field in case ofabsolute notation.

Firewall Rules & Network AccessIn order to secure access to the platform, Vade recommends restricting access toport 25 on your firewall to Vade Cloud™ only. As such, you will ensure that no email
traffic can bypass the email protection solution.
To do so, authorize the following sub-networks in your firewall configuration for
inbound flow:

Inbound email flow
Vade Cloud™
Destination
IPs
servers163.172.240.110 Email server
163.172.240.111 LDAP server
135.125.122.66
135.125.122.67

Ports
·
·
·

Comments
TCP/25 (SMTP) French hosters only
TCP/389 (LDAP) Authorize if user LDAP
TCP/636 (LDAPS) verification is activated

If you are using Vade Cloud™ for outbound flow, add the following data in yourfirewall configuration:

Outbound email flow
Sending
serverVade Cloud™ hostnames

Emailserver·smtpfr.cloud.vadesecure.com (French hosters only)·

smtp.cloud.vadesecure.comorCopyright © 2024 - Vade

Port

·

Comments

TCP/25 (SMTP)

To route
directly to
Vade Cloud™
IPs:
217.74.103.2
11
195.154.80.8
2
163.172.55.8
35.181.34.13
5

Vade Cloud Administrator Guide

8
35.181.85.71
52.143.135.9
2

Copyright © 2024 - Vade

6

Vade Cloud Administrator Guide

1.2. Initial startup
To activate your user account on Vade Cloud™, you need to provide the Global
Administrator contact information.
Global Administrator contact
This contact is the network administrator or the IT consultant for the client
account. They have access privileges to the administration interface and holds
responsibility to validate the integration of the client into Vade Cloud. They will
be able to view all user accounts created.
During the integration process, you will receive an email containing your credentials
to login to the platform.
In order to use Vade Cloud™ administration interface, simply log in through the URL
provided in the email using the login and password given in the email.

Copyright © 2024 - Vade

7

Vade Cloud Administrator Guide

1.3. Support
Vade provides technical support by phone or email for Vade Cloud™.
Vade support can be joined 7/7, and 24/24, through:Email:
support@vadesecure.com

Phone:·

France: +33 3 59 61 66 51·

Germany: +49 32 221097669·

Switzerland: +41 31 528 17 38·

Japan: +81-3-4577-7747

Copyright © 2024 - Vade

8

Vade Cloud Administrator Guide

2. Clients

Copyright © 2024 - Vade

9

Vade Cloud Administrator Guide

2.1. Add a client
Upon creating a new client account, you must provide specific contact information forthis account.
1. Click Clients > Add client.
2. Provide the following information:
1.
a. Company informationo Companyo Cityo Countryo Company ZIP code2.
b. Global Administrator informationo First nameo Last nameo Email address: Click Clients→Details→Overview to change the client's
email address later.
o Language: Default language for the client's Vade Cloud™ platform andnotifications.
o Time zone: Default timezone to display dates on the interface
notifications.
o Send credentials to Global Administrator: Check this box to send
credentials by email to your client's Global Administrator.
3. Click Next.
4. Check the Terms and Conditions of the email protection service box.
5. Check the Terms of Use of the outbound flow protection service box if you
want to use the outbound relay.
6. Click Add.
Result: You added a new client.

Copyright © 2024 - Vade

10

Vade Cloud Administrator Guide

2.2. List of clients
The Clients menu lists existing clients.
You can search a client by typing their login or company name in the search bar.
Download your list of client with their basic information by clicking Export.
Create new accounts by clicking Add client.
The Clients table lists all your clients and displays information about their license.
License···None: The client has no license.
Active: The license is active and fully operational for this account.
Suspended: The license has expired the client is no longer protected.

Login
VSC-type login name of the company.
Company
Official name of the company.
Expiration date
Expiration date of the license.
Domains
Number of domains used/Number of domains available.
Users
Number of quarantines used/number of quarantines available.
Details
Access to the company's profile and settings.
Monitoring
Access to the company's logs related to inbound and outbound flows.

Copyright © 2024 - Vade

11

Vade Cloud Administrator Guide

2.3. Providing a license
After creating a new client, you must add a subscription to their account.
1. Click Clients.
2. Click Details on the line of the client you wish to add the subscription for.
3. Click License > New license.
To renew a client's subscription, click Update license instead.
4. Select the new licence under Name among those listed in Listing available
subscriptions.
5. Enter the subscription start and end dates as well as the number of domains
and addresses allowed for this new subscription contract.
6. Click Apply.
Result: You have added a subscription to your client's license.

Copyright © 2024 - Vade

12

Vade Cloud Administrator Guide

2.4. Available subscriptions
Several licences are provisioned by default to your partner account.
For each new account, you can assign one of the following subscriptions:·

Email Security Premium testo 15 days, oro 1 month,·

Email Security Premium 1 year ,·Email Security Premium 3 years.

These subscription all give access to the following features:·Anti-spam,·Anti-phishing,·

Time-of-Click,·

Anti-Spear Phishing,·

Outbound filtering,·Anti-malware,·

Graymail.

For each subscription, you may choose:·

The subscription start and end dates,·

The number of domains to protect,·

The maximum number of email addresses (for all domains).

Copyright © 2024 - Vade

13

Vade Cloud Administrator Guide

2.5. Domain configuration
Click Clients > Details>Domains to display information about the domains of theclients.
Status···None: The client has no license.
Active: The domain is active.
Suspended: The domain has been disabled.

Domain
Domains of the client.
Domain contact
Email addresses for each domain of the client.
Details
Access to domain information and settings.
Down arrow icon·

Diagnostic: Analyze the efficiency of Cloud on the domain.
Connection rejected under Inbound flow: The downstream server did not
respond properly for unknown users. SMTP recipient checking cannot
automatically create user accounts.

··

Edit contact: Edit the email address of the contact.
Delete: Delete the domain.

2.5.1. Add domains
2.5.1.1. Adding a domain
You can add several domains to protect for a given client account.
1. Click Clients→Details→Domains→Add domain.
2. Type in the domain(s) to protect in the popup wizard, using the following
syntax:domain;route1#priority1;route2#priority2;...;Global Administrator email addresso domain must be provided as Fully-Qualified-Domain-Names (FQDN),

Copyright © 2024 - Vade

14

Vade Cloud Administrator Guideo routes (route1, route2...) allow you to route the email traffic to thedownstream server, like the existing downstream email server(s) of theclient.
If the client has multiple downstream email servers, you can add set a
priority for each of them, so that the traffic is either equally routed to eachserver, or primarily sent to one of the servers.
o Contact email address allows you to specify an email for each domain's
Global Administrator.
3. Click Add.
If the Add button is not available, the maximum number of domains tosecure for this account may exceed the number of domains authorized forthe license. If you want to increase this limit, you must upgrade thesubscription for this client by following instructions in Providing a license.
Result: The new domains are displayed in the Domains table.
What to do next: Vade recommends running the Diagnosis tool for each domain, as
described in Domain Diagnosis.

Copyright © 2024 - Vade

15

Vade Cloud Administrator Guide

2.5.2. Inbound2.5.2.1. Setting up downstream mail servers
You must declare your downstream mail servers under Clients > Details > Domains >Details > Inbound > Relays > Add a new relay to specify the destination servers the
SMTP traffic will be sent to after the Vade Cloud™.
DNS name or IPv4 address
The DNS name or IPv4 address the Vade Cloud™ platform will send the filtered trafficto.
The DNS name or IP you provide must be resolvable and accessible
publicly.
MX Priority
In case you have multiple downstream servers, you may set the MX priority to either
direct most of the traffic to a given server (by assigning it the lowest priority), or tobalance the load between multiple servers (by setting equal priorities to all servers
declared).
Click Add once you have provided the hostname/IP address and the priority.

Copyright © 2024 - Vade

16

Vade Cloud Administrator Guide

2.5.2.2. Inbound filtering
This page allows you to configure the desired filtering policy for inbound traffic.
Go to Clients > Details > Domains > Details > Filtering and define what action
Vade Cloud™ should take for each spam category and non-delivery reports.
For maximum filtering efficiency, Vade recommends using the default
settings.

Actions on identified messages
Route
Identified graymails will be delivered to the mailbox of the user.
Tag
This action adds a custom prefix to the identified graymails before delivering them tothe mailbox of the user.
Quarantine (default)
Identified graymails will be retained by the platform in the users' quarantine (or global
inbound quarantine if user accounts are disabled).
Drop
Identified graymails are deleted by the platform, after they have successfullycompleted the SMTP transaction with the sender, so that the sender does not knowthat the message has been deleted.
Vade does not recommend using this option for graymail, as some users
may wish to read some of the graymail content.
RejectIdentified graymails are rejected by the platform at the time the SMTP client sends
the email, so that the sender knows that the message is rejected.
Vade does not recommend using this option for graymail, as some users
may wish to read some of the graymail content.

Copyright © 2024 - Vade

17

Vade Cloud Administrator Guide

2.5.2.3. Senders whitelist
You may provide a list of senders to whitelist, either by providing a specific email or awhole domain.
Please note that overusing whitelist will have a negative impact on filtering accuracy
and efficiency.
1. Click Clients > Details > Domains > Details > Inbound > Whitelist > Add.
2. Enter the address or domain to whitelist:o Type in the email address in the field.
o Type in the domain name without the @ character.
3. Click Add.
Result: You have whitelisted emails or domains which are now no longer filtered by
Vade Cloud™.

Copyright © 2024 - Vade

18

Vade Cloud Administrator Guide

2.5.2.4. Senders blacklist
You may provide a list of senders to blacklist for one of your domains, either by
providing a specific email or a whole domain.
Please note that overusing blacklist will have a negative impact on filtering accuracy
and efficiency. Entries should be created with parsimony.
1. Click Clients > Details > Domains > Details > Inbound > Blacklist > Add.
2. Enter the address or domain to blacklist:o Type in the email address in the field.
o Type in the domain name without the @ character.
3. Click Add.
Result: Vade Cloud™ now blocks all emails coming from the blacklisted emails or
domains.

Copyright © 2024 - Vade

19

Vade Cloud Administrator Guide

2.5.3. Outbound2.5.3.1. Authorizing sender servers for outboundOn this page, you may declare authorized senders' IP addresses to route outboundtraffic through Vade Cloud™ to filter the outbound traffic from your domain.
Please note that you must be able to control the outbound routes on yourmail server in order to route outbound traffic through Vade Cloud™.
Since the Vade Cloud™ platform is not configured as an open relay, you must provide
the list of IP addresses from which your domain will send email traffic.
All email traffic coming from your domain from an IP address which is not registered
here will be rejected.

Configuring the outbound relay
You cannot use the platform as an open relay. Only the domains that havebeen declared on the platform will be able to use it for outbound relaying.
1. Go to Clients > Details > Domains > Details > Outbound > Relays.
2. Click Add a new relay.
3. Type in the relay name (FQDN) and the relay IP address.
You must declare the outbound relay for each domain, in case there are
multiple ones. All public IP addresses that send outbound email traffic must
be declared.
4. Click Add.

Allowing outbound traffic coming from Office 365
You may allow outbound email traffic coming from Office 365 to be filtered by theplatform by attaching the preconfigured group of IP addresses in the Outbound relay
groups section. In order to accept the outbound traffic from Office 365, simply
activate the Attach button for the office 365 group.

Configuring the outbound connector
Edit the configuration of the outbound connector on your downstream messaging
server to add the following routing information:··

smtp.cloud.vadesecure.com
No authentication·

port 8025 by default (also accepts ports 465 and 8025)

Copyright © 2024 - Vade

20

Vade Cloud Administrator Guide

Do not edit the outbound connector before declaring the domains and IP
addresses on the Vade Cloud™ platform.

Configuring the outbound connector on Office 365
In order to route outbound traffic from Office 365 to Vade Cloud™, you need to add acustom connector to the Office 365 Mail configuration.
First, add the connector:
1. Click Mail Flow > Connectors in the left menu in to the Exchange Admin
Center.
2. Click + Add a connector.
3. Select Office 365 under Connection from and Partner organization under

Connection to.
4. Select a name for the connector.
Choose a self-explanatory name, which identifies the flow the connector
applies to (inbound or outbound – outbound in our case), and the Partner
name, e.g. M365 to Vade Cloud Outbound.
1. Select Only when I have a transport rule set up that redirects messages to thisconnector.
2. Select Route email through these smart hosts.
3. Type in the FQDN of the smart host: smtp.cloud.vadesecure.com or an IP
address.
4. Click +.
5. Select Any digital certificate, including self-signed certificates.
6. Enter an email address for an active mailbox that is on your partner domain.
7. Click Create connector.
Then, create a routing rule which uses the connector:
1. Go to Mailflow > Rules > + > Create a new rule... in the Exchange Admin
Center.
2. Choose a name for the rule.
3. Click More options at the bottom.
4. Fill in the rule options as listed below:
Apply this rule if...
The sender...→is external/internal→Inside the organisation→OK.

Copyright © 2024 - Vade

21

Vade Cloud Administrator Guide

You may also add a condition to filter only messages for external-boundmessages by adding a The recipient...→is external/internal→Outside theorganisation→OK.
Do the following...
Redirect the message to...→the following connector.
In the dialog, select the connector you created above (O365 to Vade Cloud
Outbound for example).
5. Click Save.

Copyright © 2024 - Vade

22

Vade Cloud Administrator Guide

2.5.3.2. Outbound filtering
The following parameters allow you to configure the desired filtering policy foroutbound traffic.
Go to Clients > Details > Domains > Details > Outbound > Filtering and define what
action Vade Cloud™ should take for each spam category.
For maximum filtering efficiency, Vade recommends using the default
settings.

Actions on identified messages
Quarantine
Identified spam or malware messages issued by your domain are retained on theplatform, and are stored in the global outbound quarantine for the administrator totake actions on them.
Dropped
Identified spam or malware messages are dropped. No notification is sent to thesender.

Copyright © 2024 - Vade

23

Vade Cloud Administrator Guide

2.6. Domain Diagnosis
Vade Cloud™ provides a domain diagnosis tool which allows you to test theconfiguration of a domain.
Vade recommends running the diagnosis tool every time a new domain isadded and before the email traffic is routed to the Vade Cloud™, so that
there is always a valid email route for that domain.
Go to Clients > Details > Domains >domain.

> Diagnostic to run a diagnosis on a

Inbound FlowMX declaration verification
This test checks the DNS records for the domain, and tests that the MX entries foundpoint to the Vade Cloud™ platform.
··: The MX records were found and point to Vade Cloud™.
: Either no MX records were found for this domain or they do not point to
Vade Cloud™.
This must be fixed so that Vade Cloud™ receives your email traffic.

··: Either additional MX records were found in addition to both Vade Cloud™
MX records, or just 1 MX record was found pointing to Vade Cloud™ IP
address, but not the other.
: The test could not be performed.
This must be fixed so that Vade Cloud™ receives your email traffic.

Inbound flow
This test checks that downstream servers accept SMTP traffic coming from
Vade Cloud™.
··: Downstream servers accept traffic coming from Vade Cloud™.
: Downstream servers reject traffic coming from Vade Cloud™.
This must be fixed before routing your traffic to Vade Cloud™ so that thesolution delivers your emails to the downstream server.

··: At least 1 relay server does not accept traffic from Vade Cloud™ and at
least 1 relay server accepts traffic from Vade Cloud™.
: The test could not be performed.

Copyright © 2024 - Vade

24

Vade Cloud Administrator Guide

You can edit the user email address used to run this test using the fieldvalue and clicking Test again.
Quarantine reports
This test checks that the Vade Cloud™ platform can send quarantine reports from its
quarantine servers to the downstream messaging server declared for this domain.
·

This test checks that the Vade Cloud™ platform can send quarantine reports
from its quarantine servers to the downstream messaging server declared forthis domain.
o: Downstream servers accept traffic coming from Vade Cloud™.

o: Downstream servers reject traffic coming from Vade Cloud™.
The details provided indicate at which SMTP step the transaction failed(HELO, MAIL FROM, RCPT TO, etc.).

o: At least 1 relay server does not accept traffic from Vade Cloud™
and at least 1 relay server accepts traffic from Vade Cloud™.

o: The test could not be performed.

Access Restriction
This test checks that the downstream server rejects connections from IP addresses
other than the Vade Cloud™ ones.
This restriction can only be set if your downstream server is hosted on a
dedicated server you manage, and on which you can control the SMTP
traffic.
··: The downstream server properly rejects connections from foreign IP
addresses.
: The downstream server does not accept SMTP traffic from either
Vade Cloud™ or any other SMTP server.

·: The downstream server does not reject SMTP traffic coming from outside
the Vade Cloud™.
This MUST be fixed as the Vade Cloud™ platform should remain the only
Mail Exchange Server.

Copyright © 2024 - Vade

25

Vade Cloud Administrator Guide·: The access check was not run (in case no downstream server was
declared for instance).

User Discovery
This test checks that your environment (LDAP Server, messaging server) supports
the User Discovery mode you have set up under User Discovery. Depending on the
discovery mode you have chosen, this will check the following:
SMTP
This test checks that your downstream email server rejects unknown recipients(through an SMTP 550 error for the RCPT TO command) and that it replies properly toa known email address (postmaster@<your-domain.com> for instance).
Some downstream SMTP servers, such as Microsoft Exchange Server
2014 and above, do not support the recipient check.
··: The downstream server rejects unknown recipients, which means you

may use the RCPT Check discover mode to automatically retrieve a list ofusers.
: The downstream server does not handle the recipient check. You mustuse another user discovery method to create the user accounts.

LDAP
This test checks the connection to the LDAP server and that the list of LDAP
attributes returned by the directory complies with the User Discovery mode.
·: The LDAP directory returned the expected attributes to use in the User
Discovery mode.
·: There was an error connecting to the LDAP server. Refer to the error
displayed for more information.
·: The LDAP server did not return the expected attributes to try the automatic
user discovery. Please refer to the error displayed for further information.
There is probably means an error in the Base search, Search Attributes or
Search filter fields configured for the LDAP directory.

Outbound Flow
Outbound relays
This test checks that the IP addresses of your messaging server are properly
configured as authorized senders for submitting traffic to Vade Cloud™.

Copyright © 2024 - Vade

26

Vade Cloud Administrator Guide

Before using Outbound filtering, you must configure the IP addresses
authorized to send outbound traffic to the Cloud platform
under Clients→Details→Domains→Details→Outbound→Routing.

You can skip this test's results if you do not want or cannot filter your
Outbound traffic through the Vade Cloud™ platform.
··: The IP addresses allowed to send outbound traffic to the Vade Cloud™
platform are properly configured.
: The IP addresses allowed to send outbound traffic to the Cloud platform
are not properly configured, or not configured at all for outbound filtering.

·: At least one messaging server is not allowed to send outbound SMTP
traffic from your domain to the Vade Cloud™ platform.

SPF record
If you have set up outbound filtering through the Vade Cloud™ platform, youroutbound email traffic will be issued from the Vade Cloud™ platform. If your domain
previously had a SPF record listing the IP addresses authorized to emit email traffic
from your domain, the led will indicate if you need to change this record or not:·: The SPF record entries match the IP addresses of the Vade Cloud™.
·: The SPF record entries point to IP addresses other than Vade Cloud™'s.
This needs to be changed so that remote MX can match your SPF record.
·: No SPF record was found for this domain.

Copyright © 2024 - Vade

27

Vade Cloud Administrator Guide

2.7. User management
2.7.1. Creating users
2.7.1.1. Enabling/Disabling user accounts
The settings on Clients > Details > Administration > Quarantines > Settings control
how user accounts are created.
You may create user accounts and in the meantime, prevent users fromaccessing their account by disabling automatic reports.

Quarantine policy
Enable quarantines
Activate to manually or automatically create user accounts for each newmessage recipient.
Deactivate so neither you nor the platform can create user accounts.
Notify user upon creation of their quarantine
Activate to provide each user a login/password pair by email to log in to theirpersonal quarantine.
Deactivate so the user account quarantines are available through a tokenauthenticated access to the platform.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

User discovery method
No discovery
Recipient check is disabled. Upon receiving an email for an unknown recipient themessage will be placed in the global inbound quarantine. The administrator will haveto manually create the corresponding user account.
SMTP discovery
Recipient check is done through SMTP, by sending a specific request to thedownstream SMTP server.

Copyright © 2024 - Vade

28

Vade Cloud Administrator Guide

Using SMTP Recipient check requires that the downstream server rejects
unknown addresses (SMTP error 550). Some mail servers, such as recent
Exchange servers, do not provide this feature. To make sure yourdownstream server supports it, check the User Discovery diagnosis with
the Domain Diagnosis tool.
LDAP discovery
Recipient check is done by retrieving the list of users from one or several LDAP
directories.
In order to check the list of users against an LDAP directory, you must first
configure an LDAP lookup
under Administration→Quarantines →Settings→Configure LDAP
directories.
Please refer to Configure LDAP directories.

Copyright © 2024 - Vade

29

Vade Cloud Administrator Guide

2.7.1.2. Creating users manually
In addition to discovery mode, you may also create users manually if user accounts
are enabled.
You will not be able to manually create users if user accounts have been
disabled through the options described under Enabling/Disabling user
accounts.
You may create users manually by navigating to Clients > Details > Users.
1. Click Add user.
2. Fill in the form.
3. Click Add.
You can grant the user administrator rights.

Importing a list of users
Before importing a list of users, your partner must enable user creation foryour account. Your partner may do so by clicking Clients > Administration >Quarantines > Settings > Enable user creation.
You may import a list of users by uploading a CSV file to Clients > Details > Users >Add user > Import users.
Importing users this way does not prevent using the account auto-discovery modes. It
simply allows you to do an initial creation of accounts you already know, without
having to wait for a message to be sent to each of these accounts.
Importing users through CSV also allows you to manually register alias addresses tomain addresses, so that the license countdown is optimized, since only main
addresses are counted off of the license plan.
1. Prepare a CSV file with the following structure using your preferred software:
lastname;firstname;mainemail[;alias1;alias2;…]
The default delimiter is the semi-column, but you may use any delimiter you
like.
2. Click Clients > > Details > Users > Add user > Import users.
3. Add your file.
4. Click Upload.

Copyright © 2024 - Vade

30

Vade Cloud Administrator Guide

Once the upload is complete, the list of created users is displayed in the table forreview.
An alias cannot be registered to more than one main address.
The email address of the Global Administrator must NOT be listed in the
CSV file, as it already has an account attached to it, named "Global
Administrator", which gets created by default and can be accessed throughthe user list under the Users menu.

Copyright © 2024 - Vade

31

Vade Cloud Administrator Guide

2.7.1.3. User Discovery
Vade Cloud™ provides different ways to register and create your user accounts
automatically: Import a static list of users, automatically check against yourdownstream SMTP server, or check an LDAP directory.
You must first enable user accounts, as described in Enabling/Disablinguser accounts, or no user account will be created on the platform.

Upon receiving an email for an unknown recipient, Vade Cloud™ can create
the corresponding accounts automatically.
To choose a user discovery mode, go to Clients > Details > > Administration> Quarantines > Settings and choose from the User discovery method dropdown
menu:
No discovery
Recipient check is disabled. Upon receiving an email for an unknown recipient themessage will be placed in the global inbound quarantine. The administrator will haveto manually create the corresponding user account.
SMTP discovery
Recipient check is done through SMTP, by sending a specific request to thedownstream SMTP server.
Using SMTP Recipient check requires that the downstream server rejects
unknown addresses (SMTP error 550). Some mail servers, such as recent
Exchange servers, do not provide this feature.

LDAP discovery
Recipient check is done by retrieving the list of users from one or several LDAP
directories.

In order to check the list of users against an LDAP directory, you must first
configure an LDAP lookup
under Administration→Quarantines→Settings→Configure LDAP directories.

Copyright © 2024 - Vade

32

Vade Cloud Administrator Guide

Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Related information:····

Deleted user accounts
Creating users manually
How to choose the most appropriate user discovery mode?
How to declare an alias?

Copyright © 2024 - Vade

33

Vade Cloud Administrator Guide

2.7.1.4. Add a new administrator
The Clients > Details > Users page allows you to add a new administrator.
1. Click Clients > Details > Users.
2. Click Add user.
3. Fill in the form.
4. Check the Grant Administrator rights box.
5. Click Next.
Result: The administrator rights are displayed.
6. Check the I am aware of the rights I am granting box.
7. Click Grant.
Result: The user receives an activation email valid for 24 hours. The Global
Adminsitrator and all other Administrators are notified by email.
If the user has not received the action email or if the link has expired,click Clients→Details→Users, click the user to resend the email to,click Resend link.

Copyright © 2024 - Vade

34

Vade Cloud Administrator Guide

2.7.1.5. Administrator rights
You can grant administrator rights to your users so they can help you manage users,
domains, settings and more.
Administrator rights:·

Consult email logs·

Consult event logs·

Consult account information·

Manage domains·

Manage users·

Manage configuration·

Manage user quarantine
Administrators cannot access or delete the Global Administrator's account.

Copyright © 2024 - Vade

35

Vade Cloud Administrator Guide

2.7.1.6. Promote a user as an administrator
The Clients > Details > Users page allows you to give administrator rights to a user.
1. Click Clients > Details > Users.
2. Click the user to promote.
3. Click theicon in the User section.

4. Click Manage rights.
5. Check the I am aware of the rights I am granting box.
6. Click Grant.
The user receives an activation email valid for 24 hours.
If the user has not received the action email or if the link has expired,click Clients > Details > Users, click the user to resend the email to,click Resend link.

Copyright © 2024 - Vade

36

Vade Cloud Administrator Guide

2.7.1.7. Demote an administrator as a user
The Clients > Details > Users page allows you demote an administrator as a user.
You must be a VSadmin, partner, global administrator or active administrator to
demote an administrator.
1. Click Clients > Details > Users.
2. Click the administrator to demote.
3. Click theicon in the User section.

4. Click Manage rights.
5. Check the I am aware of the rights I am removing box.
6. Click Remove rights.
Result: The administrator is demoted as a user and is logged out.

Copyright © 2024 - Vade

37

Vade Cloud Administrator Guide

2.7.1.8. Delete an administrator account
The Clients > Details > Users page allows you to delete an administrator account.
You must be a VSadmin, partner, global administrator, or an active administrator todelete an administrator account.
1. Click Clients > Details > Users.
2. Click the administrator account to delete.
3. Click theicon in the Administrator section.

4. Click Delete.
5. Click Delete in the pop-in window.
Result: The administrator account is deleted.
The account of the deleted administrator is placed in the deleted user
accounts.

Copyright © 2024 - Vade

38

Vade Cloud Administrator Guide

2.7.1.9. Manage user alias
You can register one or several alias addresses to an existing user account.
By default, each new address discovered by the platform creates a correspondinguser account. Since the subscription plans are based on the number of user
accounts, you should declare alias addresses for users to prevent extra accounts.
1. Go to Clients > Details > →Users→User quarantines→Details→Alias→Add.
2. Type in the Email address for the new alias.
3. Choose the domain it is registered with.
4. Click Add.

See also·

How to declare an alias?

Copyright © 2024 - Vade

39

Vade Cloud Administrator Guide

2.7.1.10. Handling user accounts
The Clients > Details >Users page allows you to monitor the users created on theplatform, and manage their user account.
Vade recommends setting up user accounts to provide a larger quarantineretention capacity, and customize filtering policy on a per-user basis.
Please refer to Enabling/Disabling user accounts for more information.
Click the dropdown menu next to the Search field and click All, Administrator or Users
to search users by role.
Click

to:

Send a quarantine report
Click to send a quarantine report.
Send access token
Click to use token-based access to the platform for users. The platform will then sendan email containing the platform URL with the access token to the user.
Reset password
Click to reset the user password. The platform will send an email containing the new
password to the user.
If you use an auto-discovery mode for creating user accounts, this accountwill never be recreated, and no account by the same address can becreated again on the platform as long as it is listed under the Deleted user
accounts.

Copyright © 2024 - Vade

40

Vade Cloud Administrator Guide

2.7.1.11. Global Administrator
The Clients > Details > Users page allows you to manage the global administrator's
account.
Click Details to:
Search emails in quarantine
You can apply filters and display All, Spam or Low priority messages. You can also
search for a specific email in the search bar or by applying more filters.
Manage whitelists
Click Whitelist→Add to whitelist an email address or a domain.
Manage blacklists
Click Blacklist→Add to blacklist an email address or a domain.
Manage alias
Click Alias→Add to add an alias.
Manage settings
Click Settings to manage filtering, daily reports and options.
Click

to:

Send a quarantine report
Send the user a quarantine report.
Reset password
Reset the password of a user. The new password will be sent by email to the user.

Copyright © 2024 - Vade

41

Vade Cloud Administrator Guide

2.7.1.12. Global inbound and global outbound
The Clients > Details > Administration page allows you to manage the inbound andoutbound quarantine of all users who don't have an account.
Click Global inbound to manage emails in quarantine that were sent to your users.
Click Global outbound to manage emails in quarantine that were sent by your users.
Search emails in quarantine
You can apply filters and display All, Spam or Low priority messages. You canalso search for a specific email in the search bar or by applying more filters.
Click Parameters to:Manage low priority emails
Configure the action to take on low priority quarantined emails.
Manage daily quarantine report
Select the sending time of the first report and the frequency.
Manage user rights
Enable or Disable their right to manage their alias, blacklist, and low priority
email filtering.

Copyright © 2024 - Vade

42

Vade Cloud Administrator Guide

2.7.1.13. Deleted user accounts
The Clients > Details > Administration > Quarantines > Deleted page lists theaccounts that have been deleted.
Please note that as long as an account is listed here, you will not be able tocreate a user account that uses the same email address, and the autodiscovery mode you may have set up will not be able to create it either.
In order to permanently remove the account from the platform, you must flush thedeleted account by clicking the Delete and the Apply modifications buttons.
Once the deleted accounts have been flushed, you may recreate them manually or
automatically on the platform.
Click the Delete all button to flush all deleted accounts at once.

Copyright © 2024 - Vade

43

Vade Cloud Administrator Guide

2.7.1.14. Configure LDAP directories
LDAP directories are the recommended way to deal to deal with user discovery andautomatic account creation, as it can detect alias addresses and declare themappropriately on the platform.
Go to Clients > Details > Administration > Quarantines > Settings and click Configure
LDAP directories to configure one or more LDAP directories.

Requirements
In order for Vade Cloud™ to use your LDAP directory, you must comply to thefollowing requirements:
LDAP Versions
Vade Cloud™ supports LDAP v2 and v3, and both Open LDAP or Active Directoryformats.
Network accessYour LDAP directory must be reachable on a public IP address.
As you may not want to expose your internal LDAP directory to external
services, you can set up a copy of your directory instead.
Vade recommends setting up a firewall in front of the LDAP server, and towhitelist Vade Cloud™ IP addresses, as described in the Firewall Rules &Network Access section.

LDAPS
If available, enable LDAPS to secure LDAP transactions between Vade Cloud™ andyour directory.

Manage LDAP directory
You can add or delete LDAP directories in Clients > Details > Administration >Quarantines > Configure LDAP directories.
Add a LDAP discovery
Click Add, enter all required information and click Add in the pop-in window to add a
LDAP directory.
Delete a LDAP directory
Click→Delete in the list to delete a LDAP directory.

Copyright © 2024 - Vade

44

Vade Cloud Administrator Guide

LDAP directories
Click Details in the list of LDAP discoveries to display the following information:
Description
Provide a meaningful name to the LDAP connection configured below.
ServerHostname (FQDN) or IP address of the LDAP server.
The LDAP server must be reachable by Vade Cloud™. If you provide ahostname, this hostname must be resolvable publicly as well.
Port
Port used to connect to the LDAP server (TCP 389 or TCP 636).
Search Base
The LDAP search base, for example: ou=xxx,dc=xxx,dc=local.
Login
The login to use to connect to the LDAP server.
Password
The password to use to connect to the LDAP server.
Search Filter
The LDAP search filter, for example:· for OpenLDAP: uid=&s·for Active Directory: (|(mail=%s)(proxyAddresses=smtp:%s))Search attribute
In a standard Active Directory, the search attribute allows to return the main email
address of an account, for example: mail.
Secondary email field
The LDAP attribute to return which contains the user's alias address, for example:
mail.
Priority

Copyright © 2024 - Vade

45

Vade Cloud Administrator Guide

In case you set up multiple LDAP directories, set the priority accordingly to loadbalance the LDAP connections, or to select a main LDAP server.
Domains using this directory
If you wish to restrict the use of this LDAP server to a certain domain, select thedomain name in the list. Otherwise, leave the field empty to use it for All domains.
Additional attributes
Allows you to pass additional criteria to restrict the directory lookup, by passing
company=your_company for instance, where the key must be set to company, andthe value to your_company.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

46

Vade Cloud Administrator Guide

2.7.1.15. User-related options
You may configure several options related to the users under Clients > Details >Administration > Quarantines > Settings under User rights.

User rights
Disable user whitelists edition
Activate to prevent users from editing, adding or deleting whitelists.
Disable user whitelists
Activate to disable user whitelists.
Alias management
Select Enabled in the dropdown menu so users are able to manually attach alias
addresses to their account.
Blacklist management
Select Enabled in the dropdown menu to allow users to manually add entries topersonal blacklists.
For maximum filtering efficiency, Vade recommends using the default
settings.
Low priority emails filtering
Select Enabled in the dropdown menu to allow users to modify their filtering policy for
low priority emails.
You cannot create whitelist rules for global inbound and global outboundquarantine. These restrictions do not apply to whitelists for Global
Administrators, domains, global configuration and exception rules.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

47

Vade Cloud Administrator Guide

2.7.2. User quarantine
2.7.2.1. Messages
2.7.2.1.1. User quarantine
As an administrator, the Clients > Details > Users > Details section allows you to viewand take actions on the filtered emails that were retained in the user quarantine.
You may filter the emails to display by selecting one of the All, Spam or Low priority
filters.
You can apply an action on multiple emails: Select multiple emails at once by clicking
the check box in the list, select one of the actions described below in the Action
dropdown menu, click Save at the bottom and Apply modifications at the top of thepage.
ReleaseSends the email to the mailbox of the user.
DeleteDeletes the email from quarantine. No copy is preserved and it is not delivered to themailbox of the user.
Whitelist
Adds the email sender to the whitelist, so that any future email from this user will bedirectly delivered to the mailbox.
Unsubscribe
Unsubscribes the user from the message emailing campaign.
The unsubscribe option might be disabled for some emails. The lastcolumn indicates which emails you cannot unsubscribe.

See also·

How does the global inbound quarantine work?

Copyright © 2024 - Vade

48

Vade Cloud Administrator Guide

2.7.2.2. Senders whitelist
You may provide a list of senders to whitelist, either by providing a specific email or awhole domain.
Please note that overusing whitelist will have a negative impact on filtering accuracy
and efficiency.
1. Click Clients > Details > Users > Details > Whitelist > Add.
2. Enter the address or domain to whitelista. Add an email address to your whitelist: Type in the email address in thefield and click Add.
b. Add a domain to your whitelist: Type in the domain name, without the@ character, and click Add.
Whitelists are disabled for emails identified as high spam , malware andwhen Time-of-Click is applied. They can be reactivated with the exception
rules created by the administrator.

Copyright © 2024 - Vade

49

Vade Cloud Administrator Guide

2.7.2.3. Senders blacklist
You may provide a list of senders to blacklist for one of your domains, either by
providing a specific email or a whole domain.
Please note that overusing the blacklist will have a negative impact on filtering
accuracy and efficiency.
1. Click Clients > Details > Users > Details > Blacklist > Add.
2. Enter the address or domain to blacklist
a. Add an email address to your blacklist: Type in the email address in thefield and click Add.
b. Add a domain to your blacklist: Type in the domain name, without the@ character and click Add.

Copyright © 2024 - Vade

50

Vade Cloud Administrator Guide

2.8. Policy Configuration
2.8.1. Inbound2.8.1.1. Inbound filtering
The following settings allow you to configure the desired filtering policy for inboundtraffic by navigating to Clients > Details > Administration > Inbound > Filtering.
The following settings control how the user will interact with emails that are filtered by
the platform.

Actions on identified messages
Route
Identified graymails will be delivered to the mailbox of the user.
Tag
This action adds a custom prefix to the identified graymails before delivering them tothe mailbox of the user.
Quarantine (default)
Identified graymails will be retained by the platform in the quarantine of the user (orglobal inbound quarantine if user accounts are disabled).
Drop
Identified graymails are deleted by the platform, after they have successfullycompleted the SMTP transaction with the sender, so that the sender does not knowthat the message has been deleted.
Vade does not recommend using this option for graymail, as some users
may wish to read some of the graymail content.
RejectIdentified graymails are rejected by the platform at the time the SMTP client sends
the email, so that the sender knows that the message is rejected.
Vade does not recommend using this option for graymail, as some users
may wish to read some of the graymail content.

Authentication protocols
Activate DKIM verification
Copyright © 2024 - Vade

51

Vade Cloud Administrator Guide

DKIM verification makes sure the message was signed by a known sender, and thatthe message remained untouched after it was sent.
Activate SPF verification
SPF verification ensures that the message was sent from one of the authorized IP
addresses that were declared for the sender domain.

Other restrictions
Email maximum size (Mb)
Drag the cursor to set the maximum message size you want to allow. Messages
larger than this size will be rejected by Vade Cloud™.
Forbidden filename extensions
You may enter additional file extensions that you wish to forbid for message
attachments. This field uses a regular expression to declare the various extensions,and it defaults to pcre:\(com|exe|pif|bat|scr|cpl|cmd|dll|lnk|inf|msi|sct|vbs|vb|vbe)$.

See also·

User-editable filtering policy

Copyright © 2024 - Vade

52

Vade Cloud Administrator Guide

2.8.1.2. Time-of-Click: URL checking settings
Vade Cloud™ provides a feature to protect users against visiting phishing sites. To
enable and configure the Time-of-Click feature, navigate to
Clients > Details > Administration > Inbound > Time-of-Click.
You may configure the Time-of-Click feature to protect the users against visiting
phishing sites through URLs included in the emails they receive.

Enable Time-of-Click
Active Time-of-Click to rewrite all URLs found in the emails to point to the
Vade infrastructure so that they can be analyzed in real time to check for phishingsites. The link "Proceed to webpage with caution" will be displayed for end users by
default.
Only emails that are DKIM-signed or sent by a whitelisted expeditor willremain unchanged.
Deactivate Time-of-Click to keep the phishing links found in the email
unchanged. The "Proceed to webpage with caution" link will not be displayed for end
users.

Configuration
Rewrite URLs in DKIM-signed emails
Protect your users from phishing attempts sent in DKIM signed emails. This option
does not bypass your whitelists.
Only activate this feature if you deactivated the DKIM protection on all your
SMTP server receiving email flow from Vade Cloud™.

Display the link 'Proceed to webpage with caution'
Enable to display the link 'Proceed to webpage with caution'. End users will be able
to access the phishing link.
Disable to undisplay the link 'Proceed to webpage with caution'. End users will not beable to access the phishing link.

Time out
Set the maximum allowed time for the URL analysis to complete. In case the analysis
takes more than this, the user is redirected to the original target address.

Copyright © 2024 - Vade

53

Vade Cloud Administrator Guide

URL prefix customization
A prefix is added to all rewritten URLs when opening the link. You can customize theprefix (antiphishing.vadesecure.com by default), to point to an address within yournetwork and domain for users to feel more confident about the link. This implies
advanced modification on your network, such as creating a new sub-domain, altering
routing, etc.
To learn more about using a custom prefix for rewritten URLs, click
the URL prefix customization tooltip in the Vade Cloud™ interface.

AlertsEnable alerts
Activate so that the administrator receives alert notifications whenever a user
clicked on a phishing link. The notification email reports whether:· the user eventually visited the phishing site in spite of the alert,·

the user clicked the link but followed the alert and did not visit thephishing site.

Send alerts to email address
Type in the email address of the administrator who will receive the phishingalerts.

Page customization
Whenever a user clicks a link rewritten by Time-of-Click, they land on a series of web
pages, (pending page while Vade backend explores and analyzes the target web
page, loading page, and phishing alert page). You may use the following fields tocustomize the look and feel of these pages:
Header customization
Type in HTML code which will be prepended to the page as a new header.
Footer customization
Type in HTML code which will be appended to the page as a new footer.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

54

Vade Cloud Administrator Guide

2.8.1.3. Spear-phishing settings
Vade Cloud™ provides an optional feature to protect users against targeted spearphishing attacks. To configure anti spear-phishing options, navigate to
Clients > Details > Administration > Inbound > Spear phishing.

Protection against identity spoofing
Activate Identity spoofing protection
Activate the Identity spoofing protection against emails coming to the platformfrom the outside and using your domain name.
If you know you have legitimate traffic that may come from the outsideusing your domain name, you may add exception rules under the Exception
rules tab.
Alias spoofing
Activate to protect against emails trying to fake one of your domain's email
address (the MAIL FROM command does not correspond to the FROM addressprovided in the envelope).

Protection against similar email addresses abuse
Activate protection on calls to action
Activate to protect against emails coming from an address that looks like one ofyour domain's address. You may choose the action to take upon detecting thistype of attack using the Action field below.
ActionSet the action to take upon detecting a threat:
Add a banner (default)
Add a warning banner at the top of the email explaining this might be a spear
phishing attempt, and route the message to the mailbox of the user.
If the user decides to write back to this sender, any further email thread
coming from this sender will not be flagged.
RejectReject the email and notify sender.
Quarantine
Store the email in the user quarantine.
Copyright © 2024 - Vade

55

Vade Cloud Administrator Guide

If in doubt, users can contact:
Customize the email address displayed in the warning banner.

Protection against confidential information and risky
action requests
Activate the protection
Activate to enable protection against email requests asking for personal andconfidential information, wire transfer or other financial information.
ActionSet the action to take upon detecting a threat:
Add a banner (default)
Add a warning banner at the top of the email explaining this might be a spear
phishing attempt, and route the message to the mailbox of the user.
If the user decides to write back to this sender, any further email thread
coming from this sender will not be flagged.
RejectReject the email and notify sender.
Quarantine
Store the email in the user quarantine.
If in doubt, users can contact:
Customize the email address displayed in the warning banner.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

56

Vade Cloud Administrator Guide

2.8.1.4. Inbound whitelists
You may provide a list of senders to whitelist, either by providing a specific email or awhole domain.
Please note that overusing the whitelist will have a negative impact on filtering
accuracy and efficiency.
1. Click Clients > Details > Administration > Inbound > Whitelists > Add.
2. Enter the address or domain to whitelist
a. Type in the email address in the field and click Add.
b. Type in the domain name, without the @ character and click Add.
Whitelists are disabled for emails identified as high spam , malware and when Timeof-Click is applied. They can be reactivated with the exception rules created by theadministrator.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

57

Vade Cloud Administrator Guide

2.8.1.5. User-editable filtering policy
Vade Cloud™ lets you decide whether you want to let users adapt the filtering policy.
Go to Clients > Details >Users > Details > Settings to access the inbound filtering
policy settings.
At the top right corner of the Low priority section, you will notice a dropdown menu
with the following options:Default locked
The option is set on the same settings as the partner, and users cannot edit it.
Disabled locked
The administrator disables the option for all users, and users cannot edit it.
Enabled locked
The administrator enables the option for all users, but users cannot edit it.
Default
The option is set on the same settings as the partner, but users may still enable andedit it themselves.
Disabled
The administrator disables the option for all users, but users may still enable and edit
it themselves.
EnabledThe administrator enables the option for all users, but users may still disable or edit itthemselves.

Copyright © 2024 - Vade

58

Vade Cloud Administrator Guide

2.8.2. Outbound2.8.2.1. Outbound filtering
The following parameters allow you to configure the desired filtering policy foroutbound traffic by navigating to Clients > Details >Administration > Outbound >Filtering.
Filtering outbound traffic make your traffic cleaner, and as such, will
prevent your domain from being blacklisted on external Mail servers for
instance, but will also highlight possible botnets infection your network
users may have.

Actions on identified threats
Quarantine
Identified spam or malware messages are retained on the platform and stored in the
global outbound quarantine until the administrator takes actions on them.
Dropped
Identified spam or malware messages are dropped. No notification is sent to thesender.

Other restrictions
Email maximum size (Mb)
Drag the cursor to set the maximum message size you want to allow. Messages
larger than this size will be rejected by Vade Cloud™.
Forbidden filename extensions
You may enter additional file extensions that you wish to forbid for message
attachments. This field uses a regular expression to declare the various extensions,and it defaults to pcre:\(com|exe|pif|bat|scr|cpl|cmd|dll|lnk|inf|msi|sct|vbs|vb|vbe)$.

Enable domain filtering
Activate so that only domains configured in the Domains tab will be able to sendoutbound flow.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

59

Vade Cloud Administrator Guide

Related information
How to enable outbound filtering?

Copyright © 2024 - Vade

60

Vade Cloud Administrator Guide

2.8.2.2. Outbound whitelists
You may provide a list of senders to whitelist, either by providing a specific email or awhole domain.
Overusing whitelist will have a negative impact on filtering accuracy and efficiency.
1. Click Clients > Details > Administration > Outbound > Whitelists > Add.
2. Enter the address or domain to whitelist
a. Type in the email address in the field and click Add.
b. Type in the domain name, without the @ character and click Add.
Whitelists are disabled for emails identified as high spam , malware and when theTime-of-Click is applied. They can be reactivated with the exception rules created by
the administrator.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

61

Vade Cloud Administrator Guide

2.8.3. Exception rules
2.8.3.1. Exception rules
Exception rules allow you to create dynamic filtering rules based on given criteria
under Clients > Details > Administration > Exceptions > Rules.
Click Add on the Exception rules page, fill in the fields and Save to create an
exception rule.
You can create exception groups and use them in an exception rule.

Here is a description of the field entries:
Name
The name of the rule you want to create.
Vade recommends using explicit naming convention to name your rules: for
instance, prefix all IP-based rules with IP_..., etc.
Flow
The traffic flow the rule applies to. Select Inbound to apply the rule on emails sent toyour users only, Outbound to apply the rule to emails sent by your users only, orInbound/Outbound to apply the rule to all traffic flows.
ActionSelect an action to take when emails match this rule's criteria:· Allow: The message is allowed to go through the platform's regularprocessing, to be eventually delivered.
· Deny: The message is rejected by the platform.
Type
The criteria upon which the test will be performed:· Original IP: The original IP address the message was sent from.
· SUBJECT: The message subject.
·

Mail From: The email address of the sender specified during the SMTP MAIL
FROM command.

·

Rcpt to: The email address of the sender specified during the SMTP RCPT TO
command.

Copyright © 2024 - Vade

62

Vade Cloud Administrator Guide·

FROM: The sender's email address (envelope).

·

To: The recipient's email address (envelope).

Operator
Select the operator for the test:· Equals: Checks the value of Type is equal to the value in List of entries.
·

Is in group: Checks that the value in Type is in the group specified in List of
entries; See Exception groups for further information.

·

Not in group: Checks that the value in Type is not listed in the group specified
in List of entries; See Exception groups for further information.

·

Not equals: Checks that the value in Type is not equal to the value specified in
List of entries.

List of entries
Sets:· A single value, in the case the operator is Equals or Not equals.
· A group selector, in case the operator is Is in group or Not in group.
Domains
Select your domains the rule applies to in the dropdown menu. If you select nothing,
the rule applies to all your domains. If you select one of your domains, the rule
applies only to this domain.

Example 1 - Block an email address
Here is an example of the entries to block an email address:
Name

Flow

Action TypeOperator

List of entries

Block anaddress

inboundDeny

Equalsuser@domain.org

(Mail
From)

Domains

Example 2 - Block an IP
Here is an example of the entries to block an IP:
Name

Flow

Action TypeOperator

List of entries

Block anIP

inboundDeny

Equals

198.197.169.12

Copyright © 2024 - Vade

Original
IP

Domains63

Vade Cloud Administrator Guide

Apply an exception rule on a domain, an IP range or a
subject pattern
To apply an exception rule on a domain, an IP range or a subject pattern, you mustuse a regular expression. The regular expression must be prefixed with pcre:
Incorrect regular expression can lead to rejection of legit emails or spam
reception. Please use them carefully and test them on an appropriate
website beforehand.
Here is an example of entries to allow emails from "domain.org" to be delivered:
Name

Flow

Actio
n

Type

Operator

List of entries

Allow
domain.orginboun
d

Allow

(Mail
From
)

Equalspcre:.*@domaine.org

Domains

Manage exception rules
Click the up or down arrow in the Priority column to change the priority of the rule.
To edit or delete an exception rule, click> Edit or> Delete.

Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

64

Vade Cloud Administrator Guide

2.8.3.2. Exception groups
Exception groups can be configured under Clients > Details > Administration >Exceptions > Groups and allow you to create lists which can be used in the exception
rules.
You can create a group named IP_BL which will store IP addresses to blacklist, tolater use this group in the following exception rule:
Name

Flow

ActionType

Operator

bl-IPsinboundDeny

Original IP Is in group

List of entries
IP_BL

Add a group
Click Add, enter the required information and click Add in the pop-in window.

Edit a group
Click Edit in the list of exception groups, and in the group edition dialog, type in thefirst value in the last field, then click Add. Repeat these steps for each value of thegroup.
Click> Delete to delete the exception group of your choice.

Example - Add a group of email addresses to block
1. Click Clients > Details > Administration > Exceptions > Groups > Add.
2. Enter the group name Email addresses to block.
3. Enter an email address to block.
4. Click Add in the middle of the Add group pop-in window.
5. Repeat steps 3 and 4 until all email addresses to block are listed in the pop-in
window.
6. Click Add at the bottom of the pop-in window.
7. Click Clients > Details > Administration > Exceptions > Rules > Add.
8. Enter the following information in the fields of the Add exception rule pop-in
window.
Name

Flow

Action TypeOperator

List of entries

Emails toblock

inbound

Deny

Is in
group

Email addresses
to block

(Mail
From)

Domains

9. Click Save.

Copyright © 2024 - Vade

65

Vade Cloud Administrator Guide

Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

66

Vade Cloud Administrator Guide

3. Statistics
3.1. Statistics
Available via the left menu, Statistics displays the statistics for the Inbound flow and
the Outbound flow.
In the Statistics page, click the Inbound flow or the Outbound flow button to see an
overview of the data.
The following statistics are displayed:·

Threats,·

Legitimate and low priority emails,·

Action on emails,·

Protocol rejects,·

Exception rules.

Copyright © 2024 - Vade

67

Vade Cloud Administrator Guide

4. Customization
4.1. Customizing the user interface
Add the logo of your choice to customize the interface of Vade Cloud™ in
Customization > Interface.
This feature is only available for partners after activation by Vade.

You can restore the original Vade logo anytime by clicking x on the top right of thecustom logo.
Customization of login page logo
Upload a 230x90 .png or .jpg file to display on the login page.
Header logo
Upload a 180x80 .png or .jpg file to display on the header.

Copyright © 2024 - Vade

68

Vade Cloud Administrator Guide

4.2. Customizing the statistics report
Add your own logo to the statistic reports on the Customization > Statistics
report page.
This feature is only available for partners after activation by Vade .

You can restore the original Vade logo anytime by clicking x on the top right of thecustom logo.
Header logo (for email templates)
Upload a 170x170 .png or .jpg file. The logo will be displayed on statistic reports.

Copyright © 2024 - Vade

69

Vade Cloud Administrator Guide

4.3. Customizing email headers
Add your own logo to the email headers which are sent from the platform to the users
on the Customization > Emails page.
This feature is only available for partners after activation by Vade.

You can restore the original Vade logo anytime by clicking on the x button on the top
right of the custom logo.
Header logo (for email templates)
Upload a 170x170 .png or .jpg file. The logo will be displayed on the email notification
templates.

Copyright © 2024 - Vade

70

Vade Cloud Administrator Guide

5. Monitoring & Reports
This pages offers tools making the mail relay operation with filtering as transparent
as possible for the administrator.
To help monitor the Vade Cloud™ platform, two types of logs are available:·

Event logs,·

Filtering logs.

In addition, this chapter covers the use and management of statistic and automatic
reports.

5.1. Logs
5.1.1. Email logs
Email logs provide a way to locate emails that have been sent, filtered or rejected by
the Vade Cloud™ platform.
Go to Clients > Details > Logs > Emails to access the email logs page.
Only messages that have passed through the Vade filter will be logged(protocol steps before RCPT TO cannot be viewed using the log searchpage). Vade Cloud™ has a mechanism that allows rejecting connections
with a bad reputation automatically, which prevents bad messages to evenreach the filtering flow. To monitor logs for such connections, please submit
a request to Vade's technical support.

Log search form
Filtering logs lookup provides multiple search criteria. These criteria are cumulative
and at least 4 criteria have to be selected for the lookup to be triggered. 3 criteria areprovided by default (start date, period and filtering).
From
Sender's email address. Specifying only a domain will match any user from thatdomain: e.g. example.com will match user@example.com, foo@example.com,
etc.
To
Recipient's email address. Specifying only a domain will match any user fromthat domain: e.g. example.com will match user@example.com,
foo@example.com, etc.
Copyright © 2024 - Vade

71

Vade Cloud Administrator Guide

Subject
Email subject.
StatusEmails that belong to a given category:· Legitimate,· Spam,·Bounce,·Malware,·Newsletter,·

Blacklist,·

Whitelist,·

Social,·Spear phishing,·Phishing,

·

Scam,

·

Purchase,·

Travel.

ActionActions taken on the emails:· Route to the downstream server,· Quarantine on the platform's quarantine,·

Tag with a prefix,·

Drop from the platform,·

Reject by the platform.

Type of reject
Emails that were rejected because of:· Failed DKIM tests,· Exceeded message size,·

An attachment containing a forbidden MIME (extension),·

Failed SPF tests,·

RBL match.

Copyright © 2024 - Vade

72

Vade Cloud Administrator Guide

PeriodClick the calendar icon to restrict the lookup to a certain period of time.
Filtering
Click the Inbound / Outbound switch button to display Inbound (emails coming
to your domain) or Outbound (emails emitted from your domain) traffic.
Once the search criteria is filled out, click Filter to run the search, or Reset search toreset all search fields.

Log results
The entries that match the given lookup criteria are displayed in a table that provides
the following information:
View log entries
Click > to view the complete log entries for a given message.
Date
The date the event occurred.
From
The email address of the message sender.
To
The email address of the message recipient.
Subject
The message subject.
StatusThe last column contains icons that describe the action that was taken for themessage, and the status returned by Vade filter for this message. Hover overeach icon for more information.
The platform displays 10,000 results maximum. If you haven't found the log
you were searching for, refine your research.

Copyright © 2024 - Vade

73

Vade Cloud Administrator Guide

5.1.2. Event logs
The event logs page provides log information about all the configuration actions
carried out in the Vade Cloud™ platform, including the login used and a timestamp to
the action.
Click Clients > Details > Logs dropdown menu > Events to access the event logs
page.

Logs available
You may filter the events log displayed by category and date:
Configuration logs
All configuration modifications.
Connexion logs
Logins and connection times.
Domains and relays
All events related to the configuration of domains, such as adding or modifying
a relay, etc.
Users and configuration
All user account creation, modification or deletion.
Scheduler
Events triggered by automated tasks by the platform itself (license cleanup after
expiration, etc.).
Statistics
This limits the log messages displayed to statistics read/write operations.
Database
This limits the log messages displayed to database operations.

Log search formLog lookups can be refined by time (date, hour, minute) as well as the selection of
the exact log file:
Category
Allows you to filter log lookups on a specific log category.
Copyright © 2024 - Vade

74

Vade Cloud Administrator Guide

Start date
Allows you to filter log lookups to entries that occurred after the specified time
(date, hour, minutes).
End date
Allows you to filter log lookups to entries that occurred before the specified time
(date, hour, minutes).

Log Results
The entries that match the given lookup criteria are displayed in a table that provides
the following information:
Date
Date on which the event occurred.
Account
Account for which the event occurred.
ActionGives an indication of the type of event that occurred (session opened, domain
activated, etc.).
The platform displays 10,000 results maximum. If you haven't found the log
you were searching for, refine your research.

Copyright © 2024 - Vade

75

Vade Cloud Administrator Guide

5.2. Reports
Vade Cloud™ provides a simple and easy way to use report generation interface. It
offers a real-time view of the latest traffic flow processed by the platform.

Copyright © 2024 - Vade

76

Vade Cloud Administrator Guide

5.2.1. Statistics report
You may build reports for client account activity by navigating to Clients > Details >Statistics.
Remember you can customize reports frequency and automatic sending by
navigating to Client→Details→Administration→Quarantines→Settings, as
explained in Reports settings. You may as well configure the look and feel of thereports, and add your custom logo for instance, as explained in Customizing thestatistics report
In the Statistics of the day page, click the Inbound flow or the Outbound flow button tosee an overview of the data.
The statistics of the day reset at midnight.

The following statistics are displayed:··

Threats,
Legitimate and low priority emails,·Content analysis,·

Protocol rejects,·

Exception rules.

Create a report
Click Create report in the Statistics of the day page and enter the following
information in the popin window:
Report type
The type of statistic to report.
PeriodThe analysis period time to provide in the report.
The scope of the analysis period scales over time: typically, if setting theperiod to 4:00 PM for the last day, the report will begin from 4:00 PM day -1
to 4:00 PM of the current day.
Language

Copyright © 2024 - Vade

77

Vade Cloud Administrator Guide

The language of the report can be set separately from the language of theinterface.
Click Apply in the popin window.

Copyright © 2024 - Vade

78

Vade Cloud Administrator Guide

5.2.2. Report Indicators
5.2.2.1. Statistics Report
Table 4: Statistics Indicators
ID

Name

Type

1

Message type
distribution

Sectors2

3

Actions
performed

Evolution of
message types
detected

Sectors

Columns

Copyright © 2024 - Vade

Description
Provides a view of all the connections that
Vade Cloud™ has accepted by allowing
distribution by type of email identified, set
out in the form of sector charts. The
following types of emails are presented:··

Legitimate
Spam·

Advertizing·

Social Network notifications·

Malware·Bounce·Whitelist·

Blacklist

Provides a view of all the decision made by
Vade Cloud™ based on the settings in
Settings > Filtering. The following actions
are presented:··

Legitimate
Tagged·Retained·

Deleted·Rejected

Based on the same perimeter as Indicator
1, this indicator lays out a view of the
distribution of traffic over time with theadditional accuracy criterion of black of79

Vade Cloud Administrator Guide

white lists configured by the administrator or
the user.
4

Summary tableof message
types perdomainData table

This table allows displaying raw data used
for building Indicator 3. Having data in thisform allows rebuilding indicators by
integrating them into a global piloting table.

5

Development ofactions
performed

Curve

Based on the same perimeter as Indicator
2, this indicator lays out a view of the
distribution of actions performed over time.

6

Summary tableof message typeidentified

Data table

This table allows displaying raw data of all
the types of messages identified and allows
viewing a summary by domain.

Copyright © 2024 - Vade

80

Vade Cloud Administrator Guide

5.2.2.2. URL Analysis Report: Time-of-Click
This report allows you to view the URL analysis performed by Time-of-Click with a
global view of the results over time and of the users' choices in case of phishing andtimeout.
Table 5: Time-of-Click Indicators
ID NameType

1

Sectors

URL checking→ Analysis of
URLs

2

URL checking→ Analysis of
URLs

Curve

3

Phishing
Attacks → User
choiceSectors

Description

This indicator provides a global vision of theTime-of-Click analysis. The results of theanalysis can be:
·
·

Clean
Time-out·

Phishing

Based on the same perimeter as Indicator 1,
this chart lays out a view of the results overtime.
This indicator provides a global view of theusers' choices when they click on a phishinglink. Choices are:··4

Phishing
Attacks → User
choiceCurve

5

Timeout → User
choiceSectors

Based on the same perimeter as Indicator 3,
this chart lays out a view of the users' choiceover time.
This indicator provides a global view of theusers' choices when the analysis of the link
couldn't be done in less than the time limit(maximum 10 seconds by default). Choices
are:
·
·

Copyright © 2024 - Vade

Quit the page
Access the page anyway

Quit the page
Access the page anyway

81

Vade Cloud Administrator Guide

6

Timeout → User
choiceCurve

Copyright © 2024 - Vade

Based on the same perimeter as Indicator 5,
this chart lays out a view of the users' choices
over time.

82

Vade Cloud Administrator Guide

5.2.2.3. Phishing Attacks Report
This report identifies precisely the phishing attacks and spear phishing attacks with alist in a table form for each type of attack (name).
Table 6:
ID

Name

Type

1

Phishing attacks(Time-of-Click)

Data table

Description
This table displays all phishing links clickedby the users, plus the number of users thatreached the phishing page.
The table indicates the following elements
for each phishing email:
Date
Date when the email was received.
URL
Phishing URL.
Targeted user
Email address of the message
recipient.
ClickedIndicates whether the user clicked on
the link.
Reached phishing page
Indicates whether the user reached thephishing page.

2

Identity theft(SpearPhishing)

Data table

This table displays all spoofing information
blocked by Vade Cloud™: Domain andaddress spoofing.
The table indicates the following elements
for each Spear Phishing email:
Date

Copyright © 2024 - Vade

83

Vade Cloud Administrator Guide

Date when the email was received.
Spoofed address
Email address of the spoofed message
sender.
Targeted user
Email address of the message
recipient.
3

Similar address
abuses (spear
phishing)

Data table

The first table displays all emails in which thesender address is almost similar to a usual
contact of your users.
This table indicates the following elements
for each spear phishing email:
Date
Date when the email was received.
Suspicious address
Unknown sender address.
Targeted user
Email address of the message
recipient.
The second table displays all the outboundemails sent by users to a suspicious
address, almost similar to a usual contact. It
indicates the following elements:
Mailing date
Date when the email was sent.
Targeted user
Email address of user who sent theemail.
Suspicious address

Copyright © 2024 - Vade

84

Vade Cloud Administrator Guide

Email address of the message
recipient.
If the user replied to the suspicious address
despite the waning, he might know thesender. In that case, the banner will not be
displayed next time.
4

Confidential
information andrisky action
requests (spear
phishing)

Data table

This table displays all the emails in which itis requested to give confidential data and/or
to undertake risky actions.
The table indicates the following elements
for each spear phishing email:Datewhen email has been received
Suspicious address
unknown sender address
Targeted user
the recipient of the email
Details
indicates the suspicious element of theemail
The second table displays all the outboundemails sent by users to a suspicious
address, almost similar to a usual contact. It
indicates the following elements:
Mailing datewhen email has been sent
Targeted user
the user that sent the email
Suspicious address
the recipient of the email

Copyright © 2024 - Vade

85

Vade Cloud Administrator Guide

If the user replied or wrote back to thesuspicious address despite the warning, hemight know the sender. In that case, thebanner will not be displayed next time.

Copyright © 2024 - Vade

86

Vade Cloud Administrator Guide

5.2.3. Configuration & Customization

Copyright © 2024 - Vade

87

Vade Cloud Administrator Guide

5.2.3.1. Reports settings
The page Clients > Details > Administration > Quarantines > Settings allows you to
configure the reports sending frequency.

Set report sending frequency
Click Clients > Details > Administration > Quarantines > Settings and configure the
Daily quarantine report:
Sending time of the first report
The time of day at which the first report will be sent. After that, every futurereport dates will be based on this first sending.
Frequency
The frequency at which the platform will send reports.
Minimum frequency
The minimum period of time a user can define. The minimum allowed is 4
hours.

Set user ability to modify report frequency
In the dropdown menu of the Daily quarantine report section, select Customizable toallow users to modify report frequency.
Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

Copyright © 2024 - Vade

88

Vade Cloud Administrator Guide

5.2.3.2. Targeted Attacks report settings
The page at Settings > [client name] > Reporting > Targeted attacks report allows you
to configure the reports sending frequency for phishing and spear phishing attempts.
Receive a report automatically
Set to No to disable phishing and spear phishing reports (not recommended).
Frequency
You can choose to receive the report every week or month.
Send the report toType in the email address that the report should be sent to.
Remember that you can always generate the report whenever you need in
the user interface, as explained in Statistics report.

Copyright © 2024 - Vade

89

Vade Cloud Administrator Guide

5.2.3.3. Customizing the statistics report
Add your own logo to the statistic reports on the Customization > Statistics
report page.
This feature is only available for partners after activation by Vade.

You can restore the original Vade logo anytime by clicking x on the top right of thecustom logo.
Header logo (for email templates)
Upload a 170x170 .png or .jpg file. The logo will be displayed on statistic reports.

Copyright © 2024 - Vade

90

Vade Cloud Administrator Guide

6. FAQs
6.1. Configure the platform
6.1.1. How to migrate MX records?
You are switching to Vade Cloud™ to manage your email protection flow. Before you
start using Vade Cloud™, you must set up your DNS records so that they point to
Vade Cloud™.

Copyright © 2024 - Vade

91

Vade Cloud Administrator Guide

6.1.1.1. DNS Records Overview
A DNS (Domain Name System) name provides a way to easily identify a host zone
with a name that is easier for a physical person to remember and interpret than raw
IP addresses.
A DNS name is associated with one or several IP addresses. This configuration iscarried out by the Registrar: The entity that hosts the domain.

Example:The name example.com is associated with the IP address 93.184.216.34.
DNS records also provide additional configuration elements, such as
setting the destination for emails, SPF field, etc.

Copyright © 2024 - Vade

92

Vade Cloud Administrator Guide

6.1.1.2. Setting up DNS record for email routing
When a mail server sends an email, it sends a DNS request to retrieve the MX (Mail
Exchanger) fields from the domain name of the recipient.
In the example below, the MX fields are displayed as follows for the domain
mail75.com:
mail75.com
re.commail75.com
re.commail75.com
re.commail75.com
re.com

MX preference = 10, mail exchanger = mx01.cloud.vadesecu
MX preference = 10, mail exchanger = mx02.cloud.vadesecu
MX preference = 10, mail exchanger = mx03.cloud.vadesecu
MX preference = 10, mail exchanger = mx04.cloud.vadesecu

Understanding the DNS record
The above example is given for a DNS record of type MX and composed as follows:

DNS Zone (mail75.com)
This is the DNS Zone the parameter applies to.

Weight (10)This is the weight of precedence for the MX field. The weight allows distributing
the load of the email traffic between various DNS entries. The lowest weight willbe the path that emails will take as a priority. Entering two equal weights allows
sharing the email traffic load equally between the hosts.

Hostname (mx01.cloud.vadesecure.com, mx02.cloud.vadesecure.com,
mx03.cloud.vadesecure.com or mx04.cloud.vadesecure.com)

These are the names of the hosts to which emails for the domain mail75.com
will be sent. You may enter either an IP address or a hostname in this field. The
host name is recommended to reduce the impact of changing the IP address
range of the hosts.

Looking up the MX fields for a domain
To find out which MX fields are associated with a domain, you may run the following
commands in a terminal:
On Windows:# nslookup -type=mx example.com
On Linux
Copyright © 2024 - Vade

93

Vade Cloud Administrator Guide$ dig mx example.com

MX fields updates are propagated progressively. Disruption to or loss ofemails should not be expected. For a certain amount of time after themodifications are made, emails may still be routed to the former MXs, andthe new ones simultaneously. As they continue to propagate, DNS servers
from the Internet will use the new route to eventually route all emails forthat domain to Vade Cloud™. The propagation time depends on the TTL
value defined at the DNS level.

Copyright © 2024 - Vade

94

Vade Cloud Administrator Guide

6.1.1.3. Setting up a DNS record for SPF

SPF (for Sender Policy Framework) DNS records allow domain owners to provide alist of authorized IP addresses, aiming to prevent forgery of domain-issued emails
from malicious senders.

The SPF field is a specific type of DNS record, which uses a DNS record of type TXT
attached to the domain. This field includes the IP addresses or hostnames of serversthat are allowed to send email traffic with the domain name as the sender.
If the protected domain name has corresponding SPF records, filtering the outboundemails with Vade Cloud™ requires the SPF record to be modified to add the Vade
servers.
You need to add the following SPF field to your DNS records:
v=spf1include:spf.cloud.vadesecure.com -all

In the examples above, only Vade Cloud™ servers are allowed to send emails using
the domain name as the sender.

Looking up the SPF field for a domain
To find out the SPF field for a given domain (if it exists), you may run the following
commands in a terminal:
On Windows# nslookup -type=txt vadesecure.com
On Linux$ dig txt vadesecure.com

Copyright © 2024 - Vade

95

Vade Cloud Administrator Guide

6.1.1.4. Adding a DNS record to use Vade Cloud™
You must add a new DNS record or modify the existing MX record after you haveconfigured your domain on the Vade Cloud™ administration interface so that theemail traffic gets routed to the Vade Cloud™ platform in the future.
To do so, you will need to add the following MX hostnames to your DNS record:··

mx01.cloud.vadesecure.com
mx02.cloud.vadesecure.com·

mx03.cloud.vadesecure.com·

mx04.cloud.vadesecure.com
Ask your Registrar for the steps to follow on his domain management
console to update your DNS records.

Copyright © 2024 - Vade

96

Vade Cloud Administrator Guide

6.1.2. How to choose the most appropriate user
discovery mode?
To choose a user discovery mode, go to Clients > Details > Quarantines > Settingsand choose from the User discovery method dropdown menu:
To choose a user discovery mode, go to Clients > Details > > Administration> Quarantines > Settings and choose from the User discovery method dropdown
menu:
SMTP discovery
Recipient check is done through SMTP, by sending a specific request to thedownstream SMTP server.
Using SMTP Recipient check requires that the downstream server rejects
unknown addresses (SMTP error 550). Some mail servers, such as recent
Exchange servers, do not provide this feature.

LDAP discovery
Recipient check is done by retrieving the list of users from one or several LDAP
directories.

In order to check the list of users against an LDAP directory, you must first
configure an LDAP lookup
under Administration→Quarantines→Settings→Configure LDAP directories.

Click Save at the bottom of the page and then Apply modifications at the
top right of the page to save your new settings.

See also·

Deleted user accounts·

Creating users manually

Copyright © 2024 - Vade

97

Vade Cloud Administrator Guide·

Copyright © 2024 - Vade

98

Vade Cloud Administrator Guide

6.1.3. How to properly configure my domain?
For a domain to be properly declared on Vade Cloud™, you must declare at least 1
inbound relay (i.e. downstream server) and activate it under Clients > Details >Domains > Details > Inbound > Relays.
DNS name or IPv4 address
The DNS name or IPv4 address the Vade Cloud™ platform will send the filtered trafficto.
The DNS name or IP you provide must be resolvable and accessible
publicly.
MX Priority
In case you have multiple downstream servers, you may set the MX priority to either
direct most of the traffic to a given server (by assigning it the lowest priority), or tobalance the load between multiple servers (by setting equal priorities to all servers
declared).
Click Add once you have provided DNS name or IP address and the priority.
Before switching to production (MX record modification), Vade
recommends running a diagnosis for the inbound traffic.

Copyright © 2024 - Vade

99

Vade Cloud Administrator Guide

6.1.4. How to update the contact address?
As a partner, you may edit the technical contact address of one of your clients.
1. Click Clients then select the client account to edit.
2. Click Overview→Account.
3. Type in the new email address in Email address.
4. Click Save.
You cannot use an email address which is already tied to another account,or an email address which already has a corresponding user account on
the platform. If the address corresponds to an existing user account, youmust first remove the user account.
To remove a user account, click Users then look for the corresponding user, checktheir box and click the Delete button.
Vade recommends using a group or alias address as the contact addressfor an account.

Copyright © 2024 - Vade

100

Vade Cloud Administrator Guide

6.1.5. How does the global inbound quarantine work?
The global inbound quarantine is a specific quarantine account created by default
which can only be accessed by the Global Administrator (or the partner). Thisquarantine account stores all the messages that have been retained due to thefiltering policy in place, for all existing email addresses that do not have a user
account.
The content of the global inbound quarantine is tightly related to the user discovery
policy you have chosen:·

In case of manual user creation (CSV import or else), the content of the global
inbound quarantine will gather all messages that were filtered for recipients
who don't have a user account on the platform yet.

·In case of automated user creation (through SMTP or LDAP check), the global
inbound quarantine will gather all messages for recipients that were willingly
excluded from the list of user accounts (distribution lists, etc.).
The user accounts listed under Administration > Quarantines > Deleted do
not have personal quarantine accounts: their filtered messages will be
stored under the global inbound quarantine.

If the Global Administrator address is outside the client domain, the global
inbound quarantine is empty.

Copyright © 2024 - Vade

101

Vade Cloud Administrator Guide

6.1.6. How to import a list of users?

Importing a list of users
Before importing a list of users, your partner must enable user creation foryour account. Your partner may do so by clicking Clients > Administration >Quarantines > Settings > Enable user creation.
You may import a list of users by uploading a CSV file to Clients > Details > Users >Add user > Import users.
Importing users this way does not prevent using the account auto-discovery modes. It
simply allows you to do an initial creation of accounts you already know, without
having to wait for a message to be sent to each of these accounts.
Importing users through CSV also allows you to manually register alias addresses tomain addresses, so that the license countdown is optimized, since only main
addresses are counted off of the license plan.
1. Prepare a CSV file with the following structure using your preferred software:
lastname;firstname;mainemail[;alias1;alias2;…]
The default delimiter is the semi-column, but you may use any delimiter you
like.
2. Click Clients > > Details > Users > Add user > Import users.
3. Add your file.
4. Click Upload.
Once the upload is complete, the list of created users is displayed in the table forreview.
An alias cannot be registered to more than one main address.
The email address of the Global Administrator must NOT be listed in the
CSV file, as it already has an account attached to it, named "Global
Administrator", which gets created by default and can be accessed throughthe user list under the Users menu.

Copyright © 2024 - Vade

102

Vade Cloud Administrator Guide

6.1.7. How to set inbound and outbound relays?
The Cloud platform will not be able to route messages properly until relays are
declared for a given domain to protect.
The inbound relay can be set at the time you add a domain, through the domain
configuration wizard.
You can modify the inbound or outbound relays at any time under Clients > Details >Domains > Details > Inbound > Relays.
The list of relays is common for all the domains of a given client. Modifying
or deleting relays will take effect immediately on all the domains of theclient account.
The inbound relay usually maps to the downstream messaging server of the client: It
can either be a private server hosted on a public IP address, or a hosted-email
service.
To add an inbound or outbound relay manually, type in the IP address or DNS nameof the downstream server and click Add.

Copyright © 2024 - Vade

103

Vade Cloud Administrator Guide

6.1.8. How to prevent users from accessing their
quarantine?
Vade recommends creating individual user accounts, mostly to increase retention
capacity and to allow user-specific policies.
But please note that you may very well create user accounts and prevent users fromaccessing them at the same time.
If you wish to prevent users from accessing their user accounts, you simply need todisable automatic quarantine report sending: This way, if the users do not receive thereports, they will not know about their quarantine access, and will have no way tointeract with quarantined messages, white lists, etc.
To disable automatic report sending for a user, navigate to Clients > Details > Users> Details > Settings and select Disabled for the Generate daily report option. Click
Apply.
Attention: Make sure the users were not granted a permanent login / password
access to the platform. Automatic sending of the access tokens to the user by theplatform is disabled by default in the Notify user upon creation of their quarantine
option on the Clients > Details > Administration > Quarantines > Settings >Quarantine policy section.
Even though the quarantine report is disabled for users, the administrator
can still generate access tokens for a given user. See How to send aquarantine report to a user? for information on how to proceed.

Copyright © 2024 - Vade

104

Vade Cloud Administrator Guide

6.1.9. How to enable outbound filtering?
Vade Cloud™ protects you against the inbound email flow your domain receives, but
can also filter the outbound email traffic emitted from your domain.
Vade recommends filtering the outbound traffic as well for various reasons:
Precaution
Some of your employees' machines may be infected with malware, botnets, etc.
Filtering the outbound email traffic drastically reduces the amount and speed atwhich these malware propagate.
Responsibility
Vade Cloud™ is a mutualized hosted email platform: This means that it protects
other domains' inbound email traffic in addition to yours. If malware-infected or
spam messages are emitted from your domain, these messages will probably
get filtered by the recipients messaging server.
But depending on the volume your domain emits, these downstream servers
will eventually blacklist your whole domain and/or your IP addresses, to protect
their users, just like Vade Cloud™ does to protect your domain on inboundtraffic.
Security Watch
Once outbound filtering is enabled, the domain administrator has access to theoutbound filtering logs, grouped for every user of the domain in the OutboundQuarantine log. These logs allow you to identify if and which machines are
infected by spam-sending botnets across your network for instance, and locate
their IP addresses. Once you have these IP addresses, you can contact yourend-users to remove potential malware, etc.

Prerequisites
Setting up outbound filtering on Vade Cloud™ is completely independent frominbound filtering. Using the platform as outbound relay requires you to:··

Declare all domains to protect under the Clients > Details > Domains tab of
Vade Cloud™ administration console.
Draw a full list of all public IP addresses which may emit SMTP traffic from thedomains to protect. In order to declare these IP addresses properly, click Add
a new relay under Clients > Details > Domains > Details > Outbound > Relays.

·

Activate the outbound relays by clicking the switch button in the Attachcolumn.

Copyright © 2024 - Vade

105

Vade Cloud Administrator Guide·

Modify the outbound connector on your messaging server to route messages
to the Vade Cloud™ SMTP relay.
The outbound connector MUST NOT be changed before the outboundfiltering configuration is not complete on Vade Cloud™.

Once the domains and IP addresses are properly declared on the administration
console, the platform can accept outbound traffic. In order to switch to production,
modify the outbound connector, as described below, to route all messages to thefollowing destination: smtp.cloud.vadesecure.com.
Do not enable SMTP authentication between the outbound connector andVade Cloud™ as the platform would not be able to handle thisauthentication.

The smtp.cloud.vadesecure.com server listens by default on port 25(standard SMTP port) and also accepts traffic on port 8025.

Configuring the outbound relay
You cannot use the platform as an open relay. Only the domains that havebeen declared on the platform will be able to use it for outbound relaying.
1. Go to Clients > Details > Domains > Details > Outbound > Relays.
2. Click Add a new relay.
3. Type in the relay name (FQDN) and the relay IP address.
You must declare the outbound relay for each domain, in case there are
multiple ones. All public IP addresses that send outbound email traffic must
be declared.
4. Click Add.

Configuring the outbound connector
Edit the configuration of the outbound connector on your downstream messaging
server to add the following routing information:··

smtp.cloud.vadesecure.com
No authentication·

port 8025 by default (also accepts ports 465 and 8025)
Do not edit the outbound connector before declaring the domains and IP
addresses on the Vade Cloud™ platform.

Copyright © 2024 - Vade

106

Vade Cloud Administrator Guide

Copyright © 2024 - Vade

107

Vade Cloud Administrator Guide

6.1.10. How to reinforce malware protection?
Vade filter protects your domain against malware. However, you must comply to thefollowing guidelines for the filter to be efficient, and enable the corresponding options
on the platform.
Most malware are propagated using one or several phishing techniques, includingdomain spoofing. As a reminder, domain spoofing is what the platform detects whena malevolent third-party sender sends a message which seems to be issued fromyour domain.
In order to protect efficiently against malware, you must enable the anti-domain
spoofing feature on the platform:
1. First, make sure you can use the anti-spoofing feature for your domain:
You must ensure that no legitimate emails coming from your own domain goes
through the platform:a. Click the Clients > Details > Logs dropdown menu > Emails menu entry.
b. Run a search on the logs with the following criteria:o Inboundo From: @yourdomain.com
o Date: Yesterday (If necessary, extend this to a few days).
If the search did not yield any result, you may enable the anti-spoofing feature byfollowing the steps below:
2. Click the Administration > Inbound > Spear Phishing menu option.
3. Activate all the switch buttons in order to protect your domains against all
types of spear phishing.
Hover your mouse over the i icon to know specifically which type of spear
phishing is treated.
4. Click Save at the bottom of the page.
5. Click Apply modifications at the top of the page.
For the reasons exposed above, we strongly advise against whitelisting
your whole domain: This would cause the platform filtering to be bypassed,
and as such, would lead to deliver malware and spoofed domain emails toyour end users.

Copyright © 2024 - Vade

108

Vade Cloud Administrator Guide

6.2. Use the platform
6.2.1. How to declare an alias?
Declaring alias addresses optimizes the use of license quota, as only main
addresses are counted off of the license pool.

Register alias manually
1. Go to Clients→Users→User quarantines→Details→Alias→Add.
2. Type in the Email address for the new alias.
3. Choose the domain it is registered with.
4. Click Add.

Importing a list of users
Before importing a list of users, your partner must enable user creation foryour account. Your partner may do so by clicking Clients > Administration >Quarantines > Settings > Enable user creation.
You may import a list of users by uploading a CSV file to Clients > Details > Users >Add user > Import users.
Importing users this way does not prevent using the account auto-discovery modes. It
simply allows you to do an initial creation of accounts you already know, without
having to wait for a message to be sent to each of these accounts.
Importing users through CSV also allows you to manually register alias addresses tomain addresses, so that the license countdown is optimized, since only main
addresses are counted off of the license plan.
1. Prepare a CSV file with the following structure using your preferred software:
lastname;firstname;mainemail[;alias1;alias2;…]
The default delimiter is the semi-column, but you may use any delimiter you
like.
2. Click Clients > > Details > Users > Add user > Import users.
3. Add your file.
4. Click Upload.
Once the upload is complete, the list of created users is displayed in the table forreview.

Copyright © 2024 - Vade

109

Vade Cloud Administrator Guide

An alias cannot be registered to more than one main address.
The email address of the Global Administrator must NOT be listed in the
CSV file, as it already has an account attached to it, named "Global
Administrator", which gets created by default and can be accessed throughthe user list under the Users menu.

Please note that you cannot use automatic alias discovery when using
SMTP recipient check.

Discover alias using LDAP
LDAP discovery
Recipient check is done by retrieving the list of users from one or several LDAP
directories.

In order to check the list of users against an LDAP directory, you must first
configure an LDAP lookup
under Administration→Quarantines→Settings→Configure LDAP directories.

Copyright © 2024 - Vade

110

Vade Cloud Administrator Guide

6.2.2. Does the quarantine content need to be flushed?
Vade Cloud™ uses an automated mechanism which flushes the user quarantines
regularly. Messages which exceed the 30-day retention policy will be automaticallydeleted. This mechanism prevents the user to waste time cleaning his quarantine
manually.

Copyright © 2024 - Vade

111

Vade Cloud Administrator Guide

6.2.3. How to verify that emails are properly sent andreceived?
Detailed filtering logs allow you to trace messages from end to end, i.e. from the timethey arrived on the platform until they were delivered to the downstream messaging
server.
The entries in the detailed logs are row log lines, which require a good understandingof SMTP and messaging techniques.
The entries you may want to check first in the logs are the sender's address (from),
IP addresses, or the response from the downstream server which either accepts or
rejects the message with a self-explanatory error in most cases. Thanks to the log
information, you can ensure that a given message properly went through theplatform, that it was properly processed, and eventually delivered.

Copyright © 2024 - Vade

112

Vade Cloud Administrator Guide

6.2.4. Can I use a partner's email as the Global
Administrator for my client?
The Global Administrator email address may not belong the client's domain toprotect. Indeed, you may type in an email address that belongs to the domain of thepartner for instance, so that the partner preserves full control over the platform
configuration.
You cannot use an email address which is already used for an existing user
account on the platform, or which is used as Global Administrator addressfor another account. No matter the provided address, it is counted off of thenumber of mailboxes to protect for the client license.

Copyright © 2024 - Vade

113

Vade Cloud Administrator Guide

6.2.5. How to read the detailed logs?
Detailed logs for filtering allow you to trace messages from end to end, e.g. from theplatform receiving them to delivering them to the downstream server. Under the
Clients > Logs > Emails page, click the > icon to see the detailed logs.
The first lines show the beginning of the process, and allow you to check which
server presented the message to Vade Cloud™. Every line starts with a timestamp,
providing a way to check processing time.
Information displayed in the detailed logs under Logs > Emails > the > icon are raw
log data, and require a good technical understanding of SMTP.
You may find the classification that was performed by the Vade filter for instance(status and score), as well as the spamcause (encrypted in most cases).
Additionally, you will find all the filtering exceptions triggered by the platform upon
processing the message, such as white or black lists match, file extension
restrictions, or anti spear-phishing detection.
The most frequently requested information are the senders' email addresses(FROM), IP addresses, and the downstream server responses (which usually containa self-explanatory response).

Copyright © 2024 - Vade

114

Vade Cloud Administrator Guide

6.2.6. How to send a quarantine report to a user?
In the list of users under Clients > Details > Users, click
report.

> Send a quarantine

In case you don't have administrator rights on Vade Cloud™, you may still
request that an access token be sent to a user by navigating
to https://cloud.vadesecure.com/console/#/token.

Copyright © 2024 - Vade

115

Vade Cloud Administrator Guide

7. Troubleshooting
7.1. Why can't I create new domains or users?
Condition: I cannot add new domains or user accounts on a given client account.

The license quota has probably been exceeded.
The maximum number of domains and/or users that was first provisioned when theaccount was created has been reached.
Remedy:1. Click Clients.
2. Click Details on the line of the client you wish to add the subscription for.
3. Click License > New license.
To renew a client's subscription, click Update license instead.
4. Select the new licence under Name among those listed in Listing available
subscriptions.
5. Enter the subscription start and end dates as well as the number of domains
and addresses allowed for this new subscription contract.
6. Click Apply.

Copyright © 2024 - Vade

116

Vade Cloud Administrator Guide

7.2. Why are emails rejected after SPF verification?
Condition: If the SPF check is enabled as part of the inbound filtering policy,
Vade Cloud™ can automatically delete emails which did not pass strict senderauthentication tests.

Conditions met for SPF reject
SPF record check will ensure that the message was emitted from IP addresses thatare authorized to send email for the sender's domain. SPF is a reliable source of
information as it is declared at the DNS level by the domain administrator himself.
SPF can be set or not, and if set, can be strict (hard fail) or not. Vade Cloud™ canreject messages because of SPF only if:··

an SPF record was found,the SPF check is strict (configured as hard fail),·the sender's authenticity has not passed the tests.

Copyright © 2024 - Vade

117

Vade Cloud Administrator Guide

7.3. Why are emails delayed?
Condition: The message took too long to be delivered: what is the problem, andwhere can I find the explanation?

Several causes can explain a late message delivery,
which may or may not be related to the Vade Cloud™
processing.
If the delay is related to the message processing within the platform, or if thedownstream server is responsible for the delay, the timestamps and temporary reject
messages in the SMTP logs (4.x.x errors) that you can view on the platform will
provide useful information to help diagnose the problem.
If the logs in Vade Cloud™ do not show any noticeable indication that the delay
occurs on the platform, it probably means that sending servers are at fault.
Remedy: If you notice in the logs that the delay problem is due to the Vade Cloud™,
please contact your support representative.

Copyright © 2024 - Vade

118

Vade Cloud Administrator Guide

7.4. Why is spam still being received?
Condition: I have switched to Vade Cloud™ and I'm still receiving spam. What are thepossible causes?

Is Vade Cloud™ the only declared MX?
First, you have to make sure that only the IP addresses of Vade Cloud™ are declared
as MX for your domain in the DNS records of your Registrar. Any other MX records,
even with a low priority, are a direct pass-through for spam.

Can the downstream server be reached from theInternet?
Make sure that the SMTP flow between Vade Cloud™ and the downstream server islocked, through IP restrictions on the firewall for instance. Your downstream
messaging server should not accept traffic on port 25 from servers other than
Vade Cloud™ and from the Internet. If that's the case, it means spammers can reachyour downstream server directly, as they often use old MX records, without going
through the platform.

Copyright © 2024 - Vade

119

Vade Cloud Administrator Guide

7.5. Why are quarantine reports not sent?
Condition: Why am I not receiving quarantine reports on a daily basis?

No quarantined message
Quarantine reports are sent daily by default, but only if messages were filtered andretained by the platform within the last 24 hours. Therefore, it is possible, and highly
probable, that the reason a user did not receive his report is that there are noquarantined messages to list for that particular day.

Sending frequency is not daily
Quarantine reports are sent daily by default, but the sending frequency can be
modified to reduce it.
Remedy: The account administrator needs to review the report sending frequency
parameters in Clients > Details > Administration > Quarantines > Settings.
Click Clients > Details > Administration > Quarantines > Settings and configure the
Daily quarantine report:
Sending time of the first report
The time of day at which the first report will be sent. After that, every futurereport dates will be based on this first sending.
Frequency
The frequency at which the platform will send reports.
Minimum frequency
The minimum period of time a user can define. The minimum allowed is 4
hours.

Copyright © 2024 - Vade

120

Vade Cloud Administrator Guide

7.6. How to receive a password for my account?
Condition: I don't have a password for my partner (OEMxxx) or client (VRCxxx)
account. What should I do?
Remedy: To receive the password for your OEMxxx or VRCxxx account, simply click
the Forgot password link available on the Cloud authentication pagehttps://cloud.vadesecure.com/.
You will then receive an email with a link asking to confirm the password change.
Once logged in to the platform, you will be able to modify this password if needed, by
clicking the My account icon on the top right corner of the Vade Cloud™
administration console.

Copyright © 2024 - Vade

121

Vade Cloud Administrator Guide

7.7. Why are my configurations ignored?
Condition: I modified my configurations but the modifications are not taken into
account.

Saved modifications pending
The modifications are not implemented right away. You must apply the modifications.
Remedy:1. Click Save at the bottom of the page and then Apply modifications at the top
right of the page to save your new settings.

Copyright © 2024 - Vade

122