EmailSentry Setup

EmailSentry™ Setup

These are the options you should consider when first installing EmailSentry. While the recommended layout for EmailSentry config files (FixedConfigFile and LiveConfigFile) makes changing EmailSentry settings and functionality very easy, we recommend reviewing the options below to optimize how EmailSentry works for your organization from day one. They are listed in order of importance, with our recommendations. The options are explained in detail below this top summary.

OPTION: RECOMMENDATION
How to Install: ClickOnce (download) or MSI (push)
User Instructions: Install and MoreInfo Pages
Control EmailSentry: Configuration Files
Configure Buttons: Allowed buttons (Change, Delete, Encrypt, Send)
Config Settings: Common configuration settings
SkipDomains: A list of "safe" domains to skip testing
UI and Language: US-en(glish) prompts and buttons
Proxy: Originate from your IP address space
(only if required by your network)

ClickOnce or MSI

There are two ways to install EmailSentry on user's PCs:

ClickOnce (setup.exe)
Windows Installer (emailsentry.msi)

There are four ways to install the FixedConfigFile (described below) on user's PCs:

An email to COMPANYCODE@Config.EmailSentry.com with COMPANYPASS in the Subject:
Copy to C:\ProgramData\SecurEmailLLC\EmailSentry.xml
Command line arguments to the standard Windows Installer (.msi)
Embedded inside a custom Windows Installer (.msi)

A ClickOnce install is the simplist way to install the EmailSentry Add-in, but it limits you to the first two options for installing the FixedConfigFile. Microsoft says "a ClickOnce application cannot break existing applications". It installs all the parts of the Add-in in a sandbox, including any necessary libraries not already on the PC. These libraries are only accessible by that particular Add-in, and are removed if/when the Add-in is uninstalled. ClickOnce applications work for both 32-bit or 64-bit Outlook automatically.

For interactive installs, users are instructed on an intranet page or in an email to click two links that run setup.exe and then start the configuration email, something like:
Installation LINK
Configuration LINK
The default for these two links are:
https://www.checktls.com/EmailSentry/ClickOnce/setup.exe
mailto:COMPANYCODE@Config.EmailSentry.com?Subject=COMPANYPASS&body=Click%20Send%20to%20complete%20the%20configuration.

For unattended, "push" installs to users, we recommend deploying both the ClickOnce setup.exe and the FixedConfigFile using a Group Policy Object (GPO) or System Center Configuration Manager, or something similar.

Some companies find it easier to get GPO or SCCM to install the .msi. If so, the FixedConfigFile can be installed at the same time with option 3 above, using: msiexec.exe /i EmailSentry.msi CODE=COMPANYCODE PASS=COMPANYPASS

Install and MoreInfo Pages

We provide two webpage templates that you should customize and make available to your users. One tells your users about EmailSentry and the other tells them how to install it.

MoreInfo Page

The EmailSentry PopUp with the Change, Delete, and Send buttons has a "MoreInfo" link. Your users may use this link when they don't know what to do with an unsafe email, or if they have any questions on how EmailSentry works or what it is doing.

The MoreInfo Page is your page. It should look like your other web pages, with your corporate look-and-feel. It should have content specific to your company and your use of EmailSentry.

MoreInfo is where companies instruct their users how to use EmailSentry, and more importantly, what to do if EmailSentry stops an insecure address. This ranges from telling your users

"If you are certain that there is no 'protected information' in the email you may use the 'Send Anyway' menu choice to send the message"

"When you click the 'Send Anyway' button the email will be held in our secure email portal and your recipient will have to login to our website to view their message. Please phone them and let them know if this is the first time you have emailed them."

or even

"When EmailSentry stops and lists one or more domains that are insecure, you may not send any email to this address and you must find another way to send the information."

Your MoreInfo page should:

Inform your users that you are using an Outlook Add-in for email security
Describe what EmailSentry does: checks every recipient for adequate encryption
Instruct users how to use EmailSentry:
- what to do when it stops with a "failed TLS" message
- how you have configured the "Send Anyway" choice (one of):
  - you cannot send to any failed address
  - email is held and the recipient must login to our website to see it
  - email will be PGP encrypted and to contact you to get the key
  - etc.
Have instructions for how to get support for EmailSentry

It can include content from any of these links, or the links themselves:

The page should be hosted on your own website or intranet so you can easily control access to it and the content on it. CheckTLS can host this page for you if you do not want to host it yourself, and we can make simple changes to the page contents for you.
See <MOREINFOURL> in the EmailSentry EmailSentry Configuration for how to tell EmailSentry where this file is located.

No matter where your MoreInfo Page is hosted, it will likely include your EmailSentry password, so it should be protected on a private area of your website or on your private intranet.

We provide a skeletal MoreInfo Page at the MoreInfo link we provided when we setup your subscription. The link to your MoreInfo page is a parameter in your Configuration File, so it can be hosted on your website or intranet.

Install Page

Customers using the ClickOnce install usually send an email to their users telling them to install EmailSentry. We provide an Install template that can be included in this email as a link. As with the MoreInfo page, you can host this page on your website, or we can continue to host it for you.

Configuration File

EmailSentry uses XML config file(s) to store your license key and any custom settings. This file is read every time you start Outlook. We recommend splitting this file into two parts: a FixedConfigFile stored on the user’s PC and a LiveConfigFile that is fetched from a webserver.

The FixedConfigFile is required, and points to the LiveConfigFile. The FixedConfigFile is hard to change, since it requires copying a new file onto every user’s PC. We recommend the FixedConfigFile only contain one field: the URL for your LiveConfigFile.

The LiveConfigFile, since it is centrally stored on a webserver, is much easier to change. Changes in this one central file allow you to change how EmailSentry looks to your users, and behind the scenes, what requirements you have for an address to “pass”; for example by requiring TLS V1.2 and above.

Also, since <DISABLE> is an option in the LiveConfigFile, you can temporarily disable EmailSentry for all your users with a change to this common file. This is useful if your Internet connection is down but you want users to still be able to composei emails and queue them (for sending later).
Obviously, when EmailSentry is disabled, it is not longer protecting your email.

Because the LiveConfigFile is a setting in the FixedConfigFile on each user’s PC, you should decide where the LiveConfigFile will be hosted before you install EmailSentry for your users. Again, changing the FixedConfigFile is hard.

CheckTLS will host your LiveConfigFile for you. And we provide a webpage that lets you make changes to it at any time: EditCsOAConfigFiles. This is a safe choice because if a user’s PC cannot reach a LiveConfigFile on our server, it probably cannot reach any of our servers or even the Internet at all, meaning the user won’t be able to send email anyway.

Button Options

You can disable the "Send This Email Anyway" button, which makes it impossible for a user to send an unsafe email. We recommend leaving the Send Anyway option because your user knows best if the email does not contain any protected information and so is safe to send as plain text. The email "Honey, don't forget to get milk." is safe no matter who or where the recipient is.
See <SENDBUTTON> in the EmailSentry EmailSentry Configuration for more information.

You can add an "Encrypt This Email" button if your back-end email system is able to do additional encryption for selected emails. ENCRYPT config file options let you add a trigger to the email Subject (e.g. the word "ENCRYPT" as the first word), or change the email's Sensitivity, or rewrite some domain names.
See <ENCRYPTOPTION> in the EmailSentry EmailSentry Configuration for more information.

Skip To:s and Skip From:s

You can list domains that you do not have to test with every email here. Your own domain(s) for example, or trading partners you use with separate private network connections, etc. We are happy to add a list of domains to your Configuration Files for you.
See <SKIPDOMAINS> in the EmailSentry EmailSentry Configuration for more information.

You can also configure EmailSentry to completely skip testing of all emails from a certain user.
See <NOTFROM> in the EmailSentry EmailSentry Configuration for more information.

Common Config Settings

Hide Users

EmailSentry tracks license usage by the USERNAME and COMPUTERNAME from each user's PC. These two fields can permanently obfuscated by a one-way hash that turns them into a string of 32 random characters before they are sent to CheckTLS. This hash makes the USERNAME and COMPUTERNAME unrecoverable.
See <NOTFROM> in the EmailSentry EmailSentry Configuration for more information.

We recommend not obfuscating the USERNAME and COMPUTERNAME. These two fields are not much of a security concern, and leaving them as text makes the EmailSentry usage reports much more useful to you. See Sample Usage Report and Sample History Query for more information.

Quick, Partial, or Complete

This specifies the options available in the CheckTLS //email/testTo: ("TestReceiver") test. See the documentation on CheckTLS.com for that test for very specific information about all the options available. There are hundreds.

CheckTLS reports a ConfidenceFactor instead of just a "yes" or "no" answer for a good reason. See This FAQ. It is up to you to decide what to include in the scoring, and what score you consider a "yes".

There are a few CheckTLS settings we recommend you consider when first setting EmailSentry up:

Minimum Score: What value of the ConfidenceFactor means "OK" (default 90)
MXCount: For domains with many MX hosts, how many to test before saying "OK" (default 1)
TimeOut: How long before giving up on slow mailers; retry is often faster (default 11 sec)
IgnoreNoConnect
: Don't worry about off-line MX hosts when there is more than one (default yes)
StopAfter: Stop once we know the answer to TLS yes/no (default yes (EHLO2))
CheckOCSP: Check for revoked certificates; it is slow and never happens (default no)
SSLVersion
: What versions of SSL/TLS are acceptable