Network Requirements
DeepFilter is a gateway that sits in front of your organization's email traffic. For that reason both the connections coming into the server from the internet and the connections leaving the server for the outside have to be opened correctly. This page contains the information you need in order to prepare firewall rules and DNS records before installation.
Inbound Connections (Internet → DeepFilter)
The following ports must be opened from the internet towards the server. If the server sits behind a firewall, a NAT device or a cloud provider's security group, the rules have to be defined there as well.
| Port | Protocol | Purpose | Required |
|---|---|---|---|
| 25 | TCP | Email reception (SMTP). The product's core function depends on this port. | Yes |
| 80 | TCP | Redirection to HTTPS and Let's Encrypt certificate validation and automatic renewal (HTTP-01 method). | Yes with the HTTP-01 method |
| 9443 | TCP | Management panel. The interface where administrators configure settings. | Yes |
| 9445 | TCP | End user portal. The interface where users see their own quarantine. | Yes |
| 22 | TCP | Server administration over SSH. | Optional |
Port 25 must be open to everyone; sending email servers do not come from a known list of IP addresses. If you obtain the Let's Encrypt certificate with the HTTP-01 method, port 80 must also be open to everyone and stay open permanently: the certificate validation service does not come from a known list of IP addresses either, and automatic renewal also goes through this port. With the Cloudflare DNS (DNS-01) method, port 80 does not need to be open to the outside (see SSL Certificate). Ports 9443, 9445 and 22, by contrast, should be restricted to your organization's management network or to IP addresses you define.
DeepFilter interfaces are not served over 443, the standard HTTPS port. The management panel is on
9443 and the user portal is on 9445. Attempts made without specifying a port, such as
https://server-address, therefore fail. When writing firewall rules, make sure you open 9443 and
9445 rather than 443.
If Multi-Server is used, 9441/TCP must be open in both directions between the paired DeepFilter servers, only between the server addresses; this port is not opened to the internet. On an installation without pairing, 9441 is not listened on. For details, see the Multi-Server page.
Outbound Connections (DeepFilter → Internet)
The product does not work in environments where the server's outbound access is closed. Traffic to the destinations below must be allowed.
| Destination | Port | Purpose |
|---|---|---|
| Your organization's destination email server | 25/TCP | Delivery of emails that pass scanning |
| The internet (DNS root and authoritative servers) | 53/UDP and 53/TCP | The local DNS resolver runs fully recursive: RBL, SPF and MX lookups are made from here |
| central.deepfilter.io | 443/TCP | License validation, software updates, ML model, GeoIP and spam database synchronization |
| Antivirus signature servers | 443/TCP | Antivirus signature updates |
| Phishing database service | 443/TCP | Phishing database update every 6 hours |
| Let's Encrypt | 443/TCP | Obtaining and automatically renewing a free SSL certificate |
| NTP servers | 123/UDP | Keeping the system clock synchronized |
A local DNS resolver runs on DeepFilter and sends its queries directly to authoritative servers on the internet. A common mistake is to allow outbound port 53 only to the internal corporate DNS server. In that case reputation (RBL) lookups fail silently and the spam catch rate drops noticeably.
Summary for the Security Team
These are the items you need to pass on to your security team before installation:
- From the internet to the server: 25/TCP open to everyone; 80/TCP also open to everyone if the Let's Encrypt HTTP-01 method will be used.
- From the management network to the server: 9443/TCP, 9445/TCP and (if it will be used) 22/TCP.
- From the server to the destination email server: 25/TCP.
- From the server to the internet: 53/UDP, 53/TCP, 443/TCP and 123/UDP.
- The server must have a static public IP address, and it must be possible to define a reverse DNS (PTR) record for that IP.
- It must be confirmed that outbound email traffic is not restricted by the provider; some cloud providers keep outbound port 25 closed by default and open it on request.
The installer downloads software from remote package repositories and reaches central.deepfilter.io for license validation. Installation cannot complete on an isolated network without internet access. Even after the product is installed, it needs continuous internet access for signature, model and database updates.
DNS Records
The following records must be defined in your domain's DNS management panel. Replace the alanadi.com
and SUNUCU_IP values with your own information.
| Record | Example Value | What It Does |
|---|---|---|
| A | mail.alanadi.com → SUNUCU_IP | Gives your server a name. The MX record and the certificates are based on this name. |
| MX | alanadi.com → mail.alanadi.com, priority 10 | Makes email sent to your domain reach DeepFilter. |
| PTR | SUNUCU_IP → mail.alanadi.com | Makes the IP address resolve back to a name. It is critical for the receiving side's trust in outbound email; it is requested from the service provider that owns the IP block. |
| SPF (TXT) | alanadi.com → v=spf1 ip4:SUNUCU_IP ~all | Declares which server is authorized to send email on behalf of your domain. |
A PTR record cannot be defined from your DNS panel; it is created through a request opened with the data center or cloud provider you obtained the IP address from. If this record is missing, many receiving servers may reject your outbound email or mark it as spam.
There can be only one SPF record for a domain. If you already have an SPF record, add your server's IP address to the existing record rather than adding a new TXT record. Two separate SPF records cause validation to fail completely.
Pre-Installation Verification
Once the server is ready you can run the checks below. The commands are run on the server.
Check that DNS resolution works:
dig +short A mail.alanadi.com
dig +short MX alanadi.com
Check that the server can reach the outside:
curl -sI https://central.deepfilter.io | head -1
Check that the reverse DNS record is defined (replace SUNUCU_IP with your own address):
dig +short -x SUNUCU_IP
If all of these checks return the expected values, the network side is ready for installation.