Sender checks allow you to verify whether an email originates from where it claims to come from. Email Security uses DMARC, SPF, DKIM and Header anomalies checks to do this.

• Sophos Website Checker Tool
• Sophos Check Website Category

Sophos Home offers clear and easy to understand subscription pricing. We offer one- and two-year pricing options, and discounts for continuing customers. Renewals are done automatically at the end of the subscription period, with clear communication via email about upcoming renewal events. Overall, Sophos is a great platform. And part of what adds to that greatness is the web filtering options. By default, it gives a bunch of options that can be filtered out by default. However, most of these are suited for a business setting, but it definitely works well of the home environment. The Redirect HTTP to HTTPS checkbox means that the Sophos UTM will still listen on port 80 but it will send the browser a 302 redirect to ensure the traffic is always bumped up to HTTPS. To test, open a browser and connect to You should observe the URL in the address bar changing to HTTPS. Note: Sophos Web Control can perform URI security checks on HTTPS requests if the browser being used supports Server Name Indication (SNI). SNI enabled browsers requests the domain name before the certificate is committed to the server. Website Safety Check is a simple tool that lets you effortlessly answer the question ‘Is this website safe?’. It also indicates which areas of your site are potentially vulnerable to attack by cybercriminals. Use our website reputation checker to prevent problems with hacks. We did our best to create the most convenient and simple tool.

Sender checks are performed in the order they appear in the UI. If an email fails the first sender check, the other checks are not carried out.

You can override the sender checks by allowing domains and email addresses in the Inbound allow list.

DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication policy and reporting protocol. It builds on the DKIM and SPF protocols to detect and prevent email spoofing. You can control what happens to messages that fail DMARC checks.

Select from:

• Conform to sender policy : What happens to the message depends on what the sender stated in their DMARC policy. (This is the default value.)
• Tag subject line: Email Security adds a tag to the message's subject line indicating that it is a spoofed message.
• Quarantine: Message is quarantined.
• Reject: Message is rejected.
• Deliver: Sends the message to the mail server for delivery.

SPF

SPF (Sender Policy Framework) allows you to verify that incoming email comes from an IP address authorized by the sending domain's administrators.

Emails from IP addresses marked as 'fail' by the sending domain's administrators are rejected.

Spam and phishing emails often use forged addresses. This results in an SPF check rejecting the email.

DKIM

DKIM (DomainKeys Identified Mail) is an authentication framework used to sign and validate a message based on the domain of the sender. You can control what happens to messages that fail DKIM checks.

Select from:

• Tag subject line: Email Security adds a tag to the message's subject line indicating that it is a spoofed message. (This is the default value.)
• Quarantine: Message is quarantined.
• Reject: Message is rejected.
• Deliver: Sends the message to the mail server for delivery.

Header anomalies

The Header anomalies check identifies email that appears to come from your own domain but originates from an external domain by checking the from header of the email against the recipient domain, and the from address in the envelope.

• If the domain in the from address matches the recipient's domain, the mail is considered to be spoofed.
• If the from address in the header is different to the from address in the envelope, the mail is considered to be spoofed.

You can control what happens to messages that fail the Header anomalies check.

Select from:

• Tag subject line: Email Security adds a tag to the message's subject line indicating that it is a spoofed message. (This is the default value.)
• Quarantine: Message is quarantined.
• Reject: Message is rejected.
• Deliver: Sends the message to the mail server for delivery.

Configure Kerberos authentication in XG Firewall.

Objectives

Sophos Website Checker Tool

• Specify a hostname for XG Firewall.
• Configure an active directory server.
• Confirm the active directory server is the primary service for authentication.
• Turn on AD SSO for the zones requiring Kerberos authentication.
• Turn on Kerberos authentication for Web authentication.

Configure a Hostname

Services such as Kerberos require a fully qualified hostname to work correctly.

Sophos Check Website Category

1. Go to Administration > Admin settings
2. For Hostname enter an FQDN. Example: SFOS.customer.local
   Note By default, the serial number is used as the hostname if you don't configure a specific FQDN hostname during the initial setup of XG Firewall.
3. Click Apply.