Where are my Login locations?

    We have four web accessible areas that you have access to.
    Below is a short description of each and how to access them ....

I forgot/lost my password.

If you've lost your Barracuda User Account password
1. Go to your Barracuda Server.
2. Enter you full email address in the username field.
3. Click the "Create New Password" button.
4. Your password will be emailed to you.

If you've lost your password to the Report Server
1. It is the same as your Barracuda User Account password.
2. See instructions above..

If you've lost your Administrator password
1. Go to http://tcnoc.com/clientlogin.htm.
2. Go to the "Administration Login" box.
3. click the "?" after the "SUBMIT" button.
4. A Pop-Up help window will display.
5. Enter the administrators full email address.
6. Click the "GO" button.
7. The password will be emailed to the administrator.

If you do not know where your Barracuda or Report Servers are
then please do the following...
1. Go To http://tcnoc.com/clientlogin.htm.
2. Go to the "Domain Information" box.
2. Enter your domain name.
3. Click the "Find Domain" Button.
4. Links to your Barracuda and Report Server will be displayed.

Your domain name is everything after the "@" symbol in your email address.

Adding email addresses to my White and Black lists.

How can I receive mail only listed in my whitelist?

How will my incoming email change?

How do I report spam that I still receive?

What do I do when a message I need is Missing?

Attachments, what is blocked and Why?

One of the primary destructive forces that organizations face is the eMail message with either a VIRUS attached or with a destructive script in an otherwise inocent looking file attachment.

Tangent Barracuda stops all know VIRUS eMail and is updated instantly whenever a new virus is discovered.

Tangent Barracuda also blocks most types of file attachments that can be used in a destructive manner.

Other then ZIP files for some domains we do not BLOCK or [QUAR] any other ARCHIVE type files (ARC, LZH, SIT, etc.) or any document files (DOC, XLS, TXT, PDF, PPT, etc.). We also do not BLOCK or [QUAR] any image files (GIF, JPG, BMP, etc.)

If you are on one of our servers that BLOCKS .ZIP files and need to receive a ZIP file from a sender you can either add the sender to your whitelist on the Barracuda Server or the sender can change the extention of the file from .zip to .zi_

What follows is the complete list of all file attachments that we do BLOCK. If someone needs to send one of these files to your domain they can rename the file (ie: file.pif to file.pi_) which the receiver can then rename back to the correct extension.

The following attachment types are BLOCKED. If these were in your eMail it is 99.99% certain that it was a worm or virus.

pif, scr, vbs

The following attachment types are flaged with [QUAR].


Extreme caution should be used when opening any message containing these file attachments.

acx, ade, adp, app, asp, bas, bat, chm, cmd, cmdl, com, cpl, cpp, crt, dll, eml, exe, hlp, hta, htt, inf, ins, isp, jar, js, jse, lnk, mdb, mde, mhtm, mhtml, msc, msi, msp, mst, ocx, pcd, pl, reg, sct, shb, shs, shtm, shtml,vb, vbe, vbe, vxd, wsc, wsf, wsh, xml

Note : Attachments are always checked even if the sender has been added to a white list. If you have "quarantine" enabled any attachment in the above list will not be delivered but will instead be saved, in your quarantine area on Barracuda, for later delivery.

We block no attachement based on the size of the file.

How do I use the Barracuda Report Server?

What does the block "SPF/Caller ID" mean?

An SPF block is one generated by the SENDING DOMAINS dns server.

The sending domain has posted, using an spf record, the IP addresses of machines allowed to send mail for their domain.

This SPF record tells RECEIVING mail servers to block all mail that comes from any IP address not listed in it offical SPF record.

The mail that is blocked, if legitimate, is usually sent from a home office or from on the road (hotel, starbucks, etc..). In that case the mail will be sent out using the local ISP's mail server instead of the Senders actual Mail Server.

SPF records STOP spammers from spoofing domain names by blocking mail coming from un-authorized mail servers.

There are several ways to "FIX" this problem

1. The sender should set, in their mail client, their outgoing SMTP server to their domains actual mail server. This may require special setups by the domains network administrator. If their domain has webmail access they can use that as well. Webmail sends out mail via the authorized mail server for the domain.

2. The senders domain can remove the SPF record (not a good idea)

3. The senders domain can modify the SPF records to be a warning and not a block. This however defeats the purpose of the SPF record so is also not a good idea.

4. The sending server could add the IP address of the senders home ISP mail server (not really feasible as this can and does vary)

5. The recipient can add the sender domain to their Barracuda white list.

The correct "FIX" is option number one (1). All mail sent out for a domain should be sent out from that domains authorized mail server. That is the correct way to do it. It should never be sent out using a remote ISP's mail server.

Sending out your mail using your local ISP's mail server is the easy way to do mail when at home or on the road but is NOT the correct way. Over time all mail will be required to come from an authorized mail server.

As noted we are not blocking this mail. It is a block requested by the senders domain. We are only honoring their request.

Has our domain been activated for Spam filtering?

How can I administer my domain?

How can I manage my users accounts?

If the user has an account on the Barracuda Server you can log into it, as that user, and change their settings.

If you do not know a users password you can get it from your administration page by entering their email name only (everything before the @ symbol) in the "Display list of a users White and Black list entries" field located in the tools section. The list returned includes their password. This will also tell you wether or not they have an account on the Barracuda Server.

If they do not have an account you can create one for them by doing the following

    1. Log into your administration page
    2. Set "Jumble Passwords" to NO
    3. Set "Send Welcome Message" to NO
    4. Save your settings
    5. Go to http://tcnoc.com/clientlogin.htm
    6. Create their account
    7. Go back to your Administration page
    8. Change above settings back to YES


For security reasons it is important that you only leave the above settings at NO while you are creating the accounts you will be managing. Leaving these settings at YES would allow anyone to create an account, for a users that did not have one, access that account and potentially delete all that users email.

How can I monitor activity for my domain?

I am also using a Local Anti-Spam solution, Is this OK?

Additional anti-spam solutions (software or hardware) will adversely affect Barracuda’s ability to talk with your mail server and receive the responses required in order to instantly relay email. Some examples of such Spam controls are
• Tar-pitting.
  
• Rejection of recipients after X number of invalid recipient requests have been made.
  
• Checks to limit the number of connections from a single IP address.
  
• External or Internal Black lists.

If you are running anti-spam software that does any or all of the above it can result in mail we attempt to deliver being rejected by your server.

IMPORTANT: This does NOT apply to Anti-Virus protection. All email servers should have full anti-virus protection installed. This protects your server from internal as well as external sources of attack.

We are using SPF, Is this OK?

If your mail server is doing SPF testing then your mail server will reject any mail our service filters that comes from a domain with SPF records. This is because the IP address of our server is not listed as a valid address for their domain.

The Fix for this is ...

SPF setups are supposed to have an ignore field where you can add the IP address of any mail server you want the system to ignore when doing its SPF testing.

This does not disable the SPF test. It just tells your system to not test any RECEIVED line that have that IP address in it. It will test all the other RECEIVED lines in the message.

For Example... Here are the received lines for a typical message that passes through our service..

Received: from ms6.tcnoc.com [63.209.10.246] by mail.tangent.com (Rockliffe SMTPRA 4.5.6) with ESMTP id B0000786503@mail.tangent.com for postmaster@tangent.com; Fri, 15 Sep 2006 07:17:08 -0700 Received: from tam.rfpdepot.com [209.90.77.129] by ms6.tcnoc.com (Spam Firewall) with ESMTP id B14A1CDBEF for postmaster@tangent.com; Fri, 15 Sep 2006 07:12:14 -0700 (PDT)

If the sending domain (in this case "tam.rfpdepot.com") has SPF records and the receiving domains mail server did SPF testing it would verify that "63.209.10.246" and "209.90.77.129" were in the SPF records for "tam.rfpdepot.com"

As "63.209.10.246" would not be listed the mail would be bounced. To tell the SPF test to not test the RECEIVED line for "63.209.10.246" you would add it to the exclusion list in the SPF setup. It would still test for "209.90.77.129" which it would find as valid and so would accept the email.

Here is how SPF works

1. SPF records are added to the sending domains DNS server. 2. They list the IP addresses of their legitimate mail servers. 3. Receiving mail servers read the records for the domains sending it mail. 4. If the IP address in the RECEIVED line (ie:ours) is not listed it will deny the message.

For you to use SPF testing you must add the IP address of your Barracuda Server to the exclude list of your SPF testing software.

I am using a MS Exchange mail server. What do I need to know?

I am using a FirstClass mail server. What do I need to know?

One of the problems that occurs when using a hosted service like ours is that all mail delivered to your mail server will come from a single IP address. Many mail servers see this as an attack and as a result will start blocking these connection attempts.

To ensure that mail from our service is accepted by your FirstClass server we recommend that you do the following.

Log in to your FirstClass account either as the ADMIN or w/Admin privileges.

Go into...

    Admin Desktop/
        Internet Services/
            Filters folder


There should be a file called: Allow-White List

open it for editing and Type:

+xxx.xxx.xxx.xxx   <-- Your Primary IP Address
+xxx.xxx.xxx.xxx   <-- Your Secondary IP Address


Save and exit the file

Note the plus sign (+) at the beginning of the IP address. This is very important.

You can find your Primary and Secondary IP addresses on your Barracuda Administration page in the MX record section. Your FirstClass mail server will now accept mail from our service.

How do I change our accounts IP address?

We recommend the following when making making an IP address change...

1. Let us know approximately when the change is going to take place.
(email support@tcnoc.com)

2. About one (1) hour before the change is to take place update the IP address for your account (found on your administration page) which will let us know you are actually making the change.

3. Make the required changes on your end.

We will, at the time of the change, update your IP address and test the connection to see if everything is working. If we have any problems we will call the number of the contact of record (see your administration page for this information)

If there is a different or emergency number that we should call it should be sent to us before the change so we can update your records accordingly

How do I forward mail to my secondary (backup) mail server?

Our service delivers mail to the IP address of your mail server as listed on your Barracuda Administration page. If you mail server is off line we do not switch to a secondary (backup) server. We are your secondary (backup) server and we queue your mail for up to 48 hours if your mail server is off line. After 48 hours the mail is returned to the sender so they can resend if needed.

If you think your mail server is going to be off line for longer then 48 hours and you have a secondary (backup) mail server we recommend changing your mail server IP address on your administration page to this secondary server. We will verify that the new IP address is valid and will then forward your mail to that server.

I am still seeing Spam, Why?

It is impossible to for any Spam Filter Solution to claim or guarantee to block 100% of all Spam.

For example, take the word piss. Parents and kids talk about being pissed off etc to their friends. It is a common phrase around the world. Blocking mail with that keyword string would also block all kinds of legitimate email.

Barracuda almost completely eliminates the massive amount of Spam users receive. We can not be a censor of email but can and do warn people that the email they are getting may have objectionable content. That is what the [QUAR] tag indicates.

Barracuda subject and body filtering is without doubt, the best in the industry. Our engineers sort thru millions of pieces of Spam to determine Spam patterns and then update our subject and body keyword strings on a daily basis.

In joining our Barracuda service you have taken the first step in stopping your spam problem however spam will continue to reach your mail server for some time as spammers send email using old MX records and to email servers directly. Over time, most of your email will be filtered through our system but there will always be those stubborn spammers (those that keep long term records of where mail servers are) that send email and viruses directly to your mail server bypassing all anti-spam services (even local hardware solutions)

To verify whether the Spam you are receiving is bypassing Barracuda, look at the header information for that particular Spam email. If the email in question was filtered through Barracuda, the header information will include lines that say BARRACUDA or X-BARRACUDA. If the Barracuda headers are not present, then that message was sent directly to your mail server bypassing Barracuda.

Here is an example of a header from a message that WAS filtered by the Barracuda system


---------------------------------------- X-Persona: <Support> Received: from ms3.tcnoc.com (ms3.tcnoc.com [63.150.10.30]) by mailsite.tangent.com (Rockliffe SMTPRA 2.1.6) with SMTP id <B0008715519@mailsite.tangent.com> for <Support@tangent.com> Tue, 24 Feb 2004 10:38:30 -0800 X-ASG-Debug-ID: 1077647511-19735-25-0 X-Barracuda-URL: http://ms3.tcnoc.com:80/cgi-bin/mark.cgi Received: from mail.domain.net (mail.domain.net [192.168.69.115]) by ms3.tcnoc.com (Barracuda Spam Firewall) with SMTP id DDC4ED06F3B2 for <support@tangent.com> Tue, 01 Jan 2004 10:38:26 -0800 (PST) ---------------------------------------- viewing header information is done many different ways. See your mail reader documentation for instructions.

With that said there are two additional steps you can take to stop the spammer from sending you spam.

One way, which we strongly recommend, is to remove from your DNS server the MX record for your on-site mail server. Spammers love to send email to every MX record that they find on your DNS server. Removing this MX record will prevent this method of attack. This should be done about two (2) days after joining our service to ensure that mail for your domain is being redirected to our service.

Removing the MX record for your on-site mail server is a good deterrent but many spammers keep their own list of known good mail servers and can still reach you directly via this list. If you want to make sure that all mail is being filtered by Barracuda, then you need to lock down your mail server so that only the Barracuda is allowed to send it email. We strongly recommend that all permanent clients of our service take this next step.

There are two ways to do this:

If you mail server supports it you can set it up to only allow mail from our servers. This is usually done by adding our IP addresses in the relay features of your mail server.

IMPORTANT : This next way should only be done by a qualified network administrator

If your mail server is behind a firewall or router (most are) then you can block port 25 so that only our servers can access it. 1

a. Using your firewall you DENY all incoming SMTP traffic (port 25) to your mail server from any outside IP address.

b. Using your firewall you ALLOW incoming SMTP traffic (port 25) to your mail server ONLY from the Barracuda Primary and Secondary IP addresses 1

Locking down port 25 or your mail server does not affect your users ability to send or receive email (see note below)

VERY IMPORTANT : If you are securing your server you must REMOVE any MX records that point to your Local Mail Server. This is important because if you do not remove these MX records some of the mail for your domain will bounce.

1	YOUR PRIMARY AND SECONDARY BARRACUDA IP ADDRESSES ARE AVAILABLE FROM YOUR BARRACUDA ADMINISTRATION PAGE (CLICK HERE FOR THE LOGIN BOX)

Note on locking down port 25 or your mail server. Anyone, outside your network, trying to use your mail server to send email will not be able to. This would include any of your users who access their mail from off site (home) and who use your mail server for their outgoing mail. There are two fairly simple methods to resolve this problem. The easiest is to just have all off site (home) users send their outgoing mail through their local ISP (company they are using to access the internet ie: DIALUP, CABLE, DSL, etc..). This is done by setting the outgoing SMTP connection in the mail client they are using to their local ISP mail server. A bit more complex solution would be to Institute a VPN (Virtual Private Network) solution. And finally, if available, your users can use your mail servers web interface to access their mail.

It is very important that you notify us when you secure port 25 on your mail server. Failure to do so could result in lost email. To notify us of this change you can either update your administration page (Mail Server Secure) or send an email message to support@tcnoc.com

Taking the precautions above should stop all non-filtered email from reaching your email server from outside your network.

Note that both of the above options will block anyone, except our service, from sending mail directly to your mail server. Any legitimate email that is addressed to your mail server (ie: user@mail.yourdomain.com) instead of to your domain will also be blocked. You can however remedy this by adding MX records for your mail server as you did for your domain. For example.. tangent.com mx 1 scan1.tcnoc.com tangent.com mx 10 scan2.tcnoc.com mail.tangent.com mx 1 scan1.tcnoc.com mail.tangent.com   mx   10   scan2.tcnoc.com Anyone sending mail to either tangent.com or mail.tangent.com will have their mail redirected to our filtering service. IMPORTANT : Our service only filters and delivers mail for the EXACT domain names that have been added. If you add an MX record for your mail server name that points to our service, and it has NOT been added to our service, any mail addressed to that name will be rejected by our service. The above is an example only. DO NOT use these MX (mail server) names for your changes

Global Whitelisting of an Email Address or Domain.

How do I modify my BULK, QUAR and DELETE levels?

How do I change my Mail Server IP Address?

The process for changing an IP address would be to

    1. Set up your server at the new address
    2. Check that it can send out email
    3. Log into your administration page
    4. Change and save your IP address

Your IP address is listed under your MAIL SERVER settings.

When the change is submitted we will verify that everything is working correctly and if it is we will make the required change. If there are any problems we will contact the account administrator.

This change can take up to an hour during which time our service will continue to accept your incoming email. It will be held in our outbound queue and delivered as soon as your IP address change in completed.

We recommend that you send an email notice to support@tcnoc.com the day before the change request. This notice should include the approximate time you will be making your IP address change.

Our outgoing mail rejected for rDNS (PTR) reasons.

Many domains, Like AOL, are using rDNS (PTR) lookups as a method of reducing spam. This is not a good idea as many, many legitimate domains do not have their rDNS set up or have it set up incorrectly.

If your outgoing mail is being blocked because your domain does not have an rDNS entry you will have to create one.

rDNS is a function of your primary DNS server.
Depending on the type of DNS server you have it is either a file you create or an option you select when creating an entry. If it is a file you have to create you will have to find how to create that in your documentation. If it is created when you create the actual record you will, in most cases, have to delete the record in question and re-create it.

The rDNS entry they are looking for is for your MailServer IP address.
It is not for your domain name IP address although it is a very good idea to have one for it as well.

Most DNS "A" records should have an rDNS entry. It speeds up access times and as noted is being used more and more as a validity check.

How does this work? When you send out a piece of email the recipients mail server receives the mail and checks to see if the IP address it received the mail from has a valid rDNS entry.

If there is not an rDNS entry the mail is rejected.

More and more mail servers are using this as a way to reduce spam. Tangent Barracuda does not use this method as there are still far too many legitimate domains that do not have rDNS entries.

We recommend that all domains have the following..

    1. An IP address associated with their DOMAIN name
    2. An rDNS entry for the IP address of their DOMIN name
    3. An rDNS entry for the IP address(s) of their Mail Server


Here is an example of how DNS and rDNS entries work

DNS query on "tangent.com" returns "63.150.10.10"          rDNS query on "63.150.10.10" returns "tangent.com"          DNS query on "mail.tangent.com" returns "63.150.10.221" rDNS query on "63.150.10.221" returns "mail.tangent.com"

Note, Outgoing mail is sent directly from your mail server to the recipients mail server and does not pass through our service, unless we are filtering mail for the recipients domain.

Why do I get Undeliverable or Attachment Deleted messages?

When a mail virus/worm infects someones PC it does its very best to infect others. Because of this many domains are receiving mail of the following types
Undeliverable

This is the result of mail sent out by
virus infected computers using your email
address as the from address. It was sent
to an invalid email address. The recipients
mail server then sends you back a message
saying that your message could not be
delivered.


Attachment Deleted

This is the result of mail sent out by
virus infected computers that use your
email address as the from address. It was
cleaned by the recipients anti-virus software.
This software then sends you back a message
saying it cleaned your attachment.


Note that in both cases above your email address is being spoofed by the virus. There is no way to determine where or who is sending out the messages.

You may ask how did your email address get used (spoofed) by the virus. When the virus infects a computer it looks for the email address book and picks names at random to use when sending out the email. As you can tell this causes major confusion for everyone.

Unfortunately both of the message types above are perfectly legitimate email and under normal situations are very important in tracking down email problems. When a virus hits they turn into major headaches.

What can be done..

You could send a message to the domain sending you the Attachment Deleted message telling them that they are spamming you (having their anti-spam software send out unsolicited email) and that if they do not desist you will report them to several Blacklists. Let them know that viruses spoof sending email addresses and they are telling the wrong person they have a virus.

Note: The above only pertains to Attachment Deleted messages and not to UNDELIVERABLE messages you receive. Most mail servers can not turn off this feature.

You can set up a filter or rule on your mail server that either forwards all Attachment Deleted messages to a unique email account or deletes the mail outright. If forwarded this account can then be purged on a weekly basis.

Why is our mail log filling up with connection attempts?

Why do senders get a "554 Too many connections" error?

This happens with a mail server that routinely mass emails your domain..

We protect your domain from mass email attacks from spammers who can send millions of messages to your domain in just a few minutes resulting in mail server failures and huge bandwidth costs.

Our "Rate Control" blocks prevent this from happening. If however you have services that routinely mass email your domain you need to provide us with the IP address of their outgoing mail servers so that we can add then to our "Rate Control" whitelist.

This will prevent mail from those servers from being blocked when they mass email you. Their mail will however still be scanned for spam and viruses.

Note that most services that mass email domains do not have a problem with these blocks as they retry the message a few times until it is delivered. Our service allows individual domains to connect to your domain up to 25 times every 30 minutes. Each of these connections can deliver up to 30 messages so as you can see even a busy sending domain should be able to deliver mail without any problems after a few attempts.