Network Requirements
DeepFilter is a gateway that sits in front of your organization's email traffic. For that reason both the connections coming into the server from the internet and the connections leaving the server for the outside have to be opened correctly. This page contains the information you need in order to prepare firewall rules and DNS records before installation.
Inbound Connections (Internet → DeepFilter)
The following ports must be opened from the internet towards the server. If the server sits behind a firewall, a NAT device or a cloud provider's security group, the rules have to be defined there as well.
| Port | Protocol | Purpose | Required |
|---|---|---|---|
| 25 | TCP | Email reception (SMTP). The product's core function depends on this port. | Yes |
| 80 | TCP | Redirection to HTTPS and Let's Encrypt certificate validation (HTTP-01 method). | Yes |
| 9443 | TCP | Management panel. The interface where administrators configure settings. | Yes |
| 9445 | TCP | End user portal. The interface where users see their own quarantine. | Yes |
| 22 | TCP | Server administration over SSH. | Optional |
Port 25 and port 80 must be open to everyone; sending email servers and the certificate validation service do not come from a known list of IP addresses. Ports 9443, 9445 and 22, by contrast, should be restricted to your organization's management network or to IP addresses you define.
DeepFilter interfaces are not served over 443, the standard HTTPS port. The management panel is on
9443 and the user portal is on 9445. Attempts made without specifying a port, such as
https://server-address, therefore fail. When writing firewall rules, make sure you open 9443 and
9445 rather than 443.
Outbound Connections (DeepFilter → Internet)
The product does not work in environments where the server's outbound access is closed. Traffic to the destinations below must be allowed.
| Destination | Port | Purpose |
|---|---|---|
| Your organization's destination email server | 25/TCP | Delivery of emails that pass scanning |
| The internet (DNS root and authoritative servers) | 53/UDP and 53/TCP | The local DNS resolver runs fully recursive: RBL, SPF and MX lookups are made from here |
| central.deepfilter.io | 443/TCP | License validation, software updates, ML model, GeoIP and spam database synchronization |
| Antivirus signature servers | 443/TCP | Antivirus signature updates |
| Phishing database service | 443/TCP | Phishing database update every 6 hours |
| Let's Encrypt | 443/TCP | Obtaining and automatically renewing a free SSL certificate |
| NTP servers | 123/UDP | Keeping the system clock synchronized |
A local DNS resolver runs on DeepFilter and sends its queries directly to authoritative servers on the internet. A common mistake is to allow outbound port 53 only to the internal corporate DNS server. In that case reputation (RBL) lookups fail silently and the spam catch rate drops noticeably.
Summary for the Security Team
These are the items you need to pass on to your security team before installation:
- From the internet to the server: 25/TCP and 80/TCP open to everyone.
- From the management network to the server: 9443/TCP, 9445/TCP and (if it will be used) 22/TCP.
- From the server to the destination email server: 25/TCP.
- From the server to the internet: 53/UDP, 53/TCP, 443/TCP and 123/UDP.
- The server must have a static public IP address, and it must be possible to define a reverse DNS (PTR) record for that IP.
- It must be confirmed that outbound email traffic is not restricted by the provider; some cloud providers keep outbound port 25 closed by default and open it on request.
The installer downloads software from remote package repositories and reaches central.deepfilter.io for license validation. Installation cannot complete on an isolated network without internet access. Even after the product is installed, it needs continuous internet access for signature, model and database updates.
DNS Records
The following records must be defined in your domain's DNS management panel. Replace the alanadi.com
and SUNUCU_IP values with your own information.
| Record | Example Value | What It Does |
|---|---|---|
| A | mail.alanadi.com → SUNUCU_IP | Gives your server a name. The MX record and the certificates are based on this name. |
| MX | alanadi.com → mail.alanadi.com, priority 10 | Makes email sent to your domain reach DeepFilter. |
| PTR | SUNUCU_IP → mail.alanadi.com | Makes the IP address resolve back to a name. It is critical for the receiving side's trust in outbound email; it is requested from the service provider that owns the IP block. |
| SPF (TXT) | alanadi.com → v=spf1 ip4:SUNUCU_IP ~all | Declares which server is authorized to send email on behalf of your domain. |
A PTR record cannot be defined from your DNS panel; it is created through a request opened with the data center or cloud provider you obtained the IP address from. If this record is missing, many receiving servers may reject your outbound email or mark it as spam.
There can be only one SPF record for a domain. If you already have an SPF record, add your server's IP address to the existing record rather than adding a new TXT record. Two separate SPF records cause validation to fail completely.
Pre-Installation Verification
Once the server is ready you can run the checks below. The commands are run on the server.
Check that DNS resolution works:
dig +short A mail.alanadi.com
dig +short MX alanadi.com
Check that the server can reach the outside:
curl -sI https://central.deepfilter.io | head -1
Check that the reverse DNS record is defined (replace SUNUCU_IP with your own address):
dig +short -x SUNUCU_IP
If all of these checks return the expected values, the network side is ready for installation.