Domains. Administrator Guide

Transcription

1 Domains Administrator Guide

2 Domains Administrator Guide Documentation version: 1.0 Legal Notice Legal Notice Copyright 2013 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo and are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. Symantec Corporation 350 Ellis Street Mountain View, CA Clients are advised to seek specialist advice to ensure that they use the Symantec services in accordance with relevant legislation and regulations. Depending on jurisdiction, this may include (but is not limited to) data protection law, privacy law, telecommunications regulations, and employment law. In many jurisdictions, it is a requirement that users of the service are informed of or required to give consent to their being monitored or intercepted for the purpose of receiving the security services that are offered by Symantec. Due to local legislation, some features that are described in this documentation are not available in some countries. Configuration of the Services remains your responsibility and entirely in your control. In certain countries it may be necessary to obtain the consent of individual personnel. Symantec advises you to always check local legislation prior to deploying a Symantec service. You should understand your company s requirements around electronic messaging policy and any regulatory obligations applicable to your industry and jurisdiction. Symantec can accept no liability for any civil or criminal liability that may be incurred by you as a result of the operation of the Service or the implementation of any advice that is provided hereto. The documentation is provided "as is" and all express or implied conditions, representations, and warranties, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement, are disclaimed, except to the extent that such disclaimers are held to be legally invalid. Symantec Corporation shall not be liable for incidental or consequential damages in connection with the furnishing, performance, or use of this documentation. The information that is contained in this documentation is subject to change without notice. Symantec may at its sole option vary these conditions of use by posting such revised terms to the website.

3 Technical support If you need help on an aspect of the security services that is not covered by the online Help or administrator guides, contact your IT administrator or Support team. To find your Support team's contact details in the portal, click Support > Contact us.

4 Contents Technical support... 3 Chapter 1 Domains overview... 5 Managing your domains... 5 Prerequisites for adding a domain... 6 About TXT records... 6 Requesting a Domain Transfer... 7 Chapter 2 Domains wizard... 9 Domains wizard - Welcome... 9 Domains wizard - Your Domain Domains wizard - Validate Domain Ownership Domains Wizard - Inbound Routes Domains wizard - Service Settings Domains wizard - Register Addresses Domains wizard - Next Steps... 16

5 Chapter 1 Domains overview This chapter includes the following topics: Managing your domains Prerequisites for adding a domain About TXT records Requesting a Domain Transfer Managing your domains You can access the Domains page in the portal at Services > Services > Domains. The domains wizard helps you to add your organization's domains and associated information such as inbound routes and addresses. You must add your organization's domains to enable the Security service to scan and route your incoming s. Launch the wizard by clicking Add New Domain. Note: Your portal account needs to have the Manage Domains custom role assigned. If you can't launch the wizard, you may need to contact your Support provider to have this role added to your account. The wizard helps you to validate domain ownership and associate your organization's domains with your account. You must add your inbound routes, which are the external IP addresses or fully qualified domain names to which your inbound traffic is directed. For example, an inbound route can be for a mail server or an inbound mail gateway. If your organization uses Address Registration, you can use the wizard to register addresses for your domain. Later, you can have your organization s outbound scanned by adding your sending IP addresses or hosted service in the Outbound Routes section of the portal.

6 Domains overview Prerequisites for adding a domain 6 Domains that are in the process of being checked are listed under Inactive Domains. Domains that have passed our checks and that are active are listed under Active Domains. Clicking the Audit Data link takes you to the Report Requests page in the portal, where you can request an audit log report for any added or deleted domains. Prerequisites for adding a domain To prove your organization's ownership of the domain being added to your cloud security services account, you must have administration access. Specifically, you must have access to either edit your organization's DNS settings or have access to your organization's administration addresses. Before we can add a new domain to your account, you need to gather the following information. You need to provide this information when setting up a new domain using the guided steps in the Domains section of the portal. The fully qualified domain name for your domain. The inbound route for your domain. (An inbound route is the externally facing IP address or fully qualified host name to which your traffic is directed.) A list of the addresses that you want to set up for receiving scanned through the cloud security services infrastructure. This list is required for use with the Address Registration service. Note: Once you have successfully added a domain to your cloud security services account, you must update your MX records. Do not update your MX records until we have told you that it is safe to do so. Otherwise, is not delivered to your domain. About TXT records In the context of the Domain Name System (DNS), a TXT record is a largely human-readable string of informational text. A TXT record is often used to store Sender Policy Framework (SPF) information, which is used to prevent the spoofing of your organization's . You can use the TXT record to store almost any text-based information you choose. When adding a new domain to your cloud security services account, you need to prove ownership of the domain. We provide you with a TXT record to add to your DNS settings. Once you have added the TXT record to your DNS settings, we verify that the TXT record is present and valid in your DNS settings.

7 Domains overview Requesting a Domain Transfer 7 Requesting a Domain Transfer The Domain Transfer Form is used to request the transfer of a domain from one account to another. The Domain Transfer Form is located in the portal at Dashboard > Administration > Domain Transfer. Complete the form in its entirety to ensure that no information is missed during the domain transfer. Note that some fields may be pre-populated with your portal account information. Table 1-1 Requester Details Customer name Account ID User requesting Contact address Contact telephone number The name of the organization requesting the domain transfer. The account ID of the organization requesting the domain transfer. Your portal user ID. Your address. Your telephone number. Table 1-2 Transfer From/To Transfer direction Select the direction of transfer, either from your account to another account, or from another account to your account. The source account is the account that is the current owner of the domain being transferred. The destination account is the account to which the domain is transferred. If the source account and destination account are associated with the same organization, select the Yes option. If the domain is transferred between two accounts in the same organization, any registered addresses can be retained. Before you submit a request to transfer a domain from another account to your account, you must obtain permission from the source account. An authorized contact from the source account must send an to domain_transfers@symantec.com. The must quote the domain name in the subject line and provide written authorization of the transfer request.

8 Domains overview Requesting a Domain Transfer 8 Table 1-2 Transfer From/To (continued) Source account name Source account ID The name of the source account that currently owns the domain. The account ID of the source account that currently owns the domain. Table 1-3 Domain Details Domain name Required transfer date Inbound route Add Domain The name of the domain being transferred. The required date of the domain transfer. Select the required option for the inbound route configuration. You can choose to keep your existing inbound route configuration, or provide a new inbound route. An inbound route is the external IP address or fully qualified host name to which your inbound traffic is directed. Note that for each domain transfer request, only the service settings that are active on both the source account and destination account can be transferred. Once you have added the domains and inbound route, click the Add Domain button. You can add up to 50 domains with this form. Table 1-4 Additional Notes Provide any additional information in the text box. Check the box to confirm the source account has sent an authorization to order_services@symantec.com. Once you have completed all required fields, click Submit.

9 Chapter 2 Domains wizard This chapter includes the following topics: Domains wizard - Welcome Domains wizard - Your Domain Domains wizard - Validate Domain Ownership Domains Wizard - Inbound Routes Domains wizard - Service Settings Domains wizard - Register Addresses Domains wizard - Next Steps Domains wizard - Welcome The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned. The Domains wizard walks you through the process of adding a domain. To prove your organization's ownership of the domain being added to your cloud security services account, you must have administration access. Specifically, you must have access to either edit your organization's DNS settings or have access to your organization's administration addresses. You need to prepare the following

10 Domains wizard Domains wizard - Your Domain 10 prerequisite information before you add a new domain to your account using the wizard: The new domain name you want to add. The inbound route for the domain. (An inbound route is the external IP address or fully qualified host name to which your inbound traffic is directed. The inbound route IP address can be for a mail server or an inbound mail gateway, for example.) A list of valid addresses for the domain to which you want scanned delivered. (Only required if you choose to enhance your protection with the Address Registration service.) Only registered addresses receive scanned . that is directed at non-registered addresses is filtered out. You enter this information as you complete the guided steps of adding a new domain. Once you have completed the guided steps, we make a number of checks on the information provided. The checks include the validation of the domain and verification of your ownership of the domain. When we successfully complete the checks on your domain, we instruct you to update your MX records to point to our infrastructure. Note: You must not update your MX records until we have instructed you to do so. Otherwise, the validation is not delivered and no other can be delivered to your domain. We require a valid contact address to which we send progress updates during the process of adding your domain. Type your address into the box that is provided in the Your Contact Address section of the Welcome page. You can also choose to save the address to your user profile in the portal by selecting the associated check box. You must type an address in valid format, otherwise you cannot proceed to the next step. Domains wizard - Your Domain The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned.

11 Domains wizard Domains wizard - Validate Domain Ownership 11 On the Your Domain page of the guided steps, you enter the domain name you want to add to your account. To instigate our checks on your domain 1 Type the domain name in the box that is provided and then click Check. Note: Enter the domain name only. Any host name prefixes (e.g., "www") are removed automatically in the checks. 2 When you click Check, we verify the current state of the domain and the results of the checks are displayed. Refer to the information that is displayed for instructions on what you are required to do next. When the checks are complete, the screen displays a confirmation message of Finished checking domain "<yourdomain.com>" along with the results of the checks. If there is a problem with the checks, you cannot continue until the problems are rectified. If the checks have completed and have been successful, you can click Next to proceed to the next step in the process. Domains wizard - Validate Domain Ownership The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned. Before we can add the requested domain to your cloud security services account, you must prove that you own the domain. When you submit your domain for checking, we attempt to validate domain ownership. If we detect that a validation string for the domain is present and correct, we confirm that we have validated your ownership of the domain. In this case, you can continue to the next step. If MX records already exist for the domain, you can validate domain ownership by confirmation or by updating the DNS settings. To validate domain ownership by validation, select the validation button. Using the drop-down box provided, select an administrator mailbox that you have access to (postmaster, hostmaster, webmaster, www, abuse, noc, or security).

12 Domains wizard Domains Wizard - Inbound Routes 12 Once you select a mailbox, click Next, and an that contains a validation key is sent to that mailbox. You must then retrieve the and the validation key, which must then be entered at the end of the guided steps. If we cannot detect any MX records for your domain, you must use DNS validation to add your domain. With this method, we provide you with a TXT record that you must add to your domain's DNS settings. To validate domain ownership by updating your DNS records, copy the TXT record from the text box that is provided. Enter that TXT record into the DNS settings for your domain. Note that a TXT record consists of the host name of the root domain and the target address of the TXT record. Table 2-1 Host Example TXT record Domain.exampledomain.com Record T0J1M06491 Note: Due to DNS Time to Live (TTL) caching delays, the validation checks may take up to 24 hours to complete. We add the domain to your account only after these checks have succeeded. Note: As an alternative when adding subsequent domains, you can expedite the process of adding the TXT record to the DNS settings for each domain. The TXT record is the same for all domains that are registered to a particular account. Therefore, you can add the TXT record to the DNS settings before you launch the wizard to add the new domain. The wizard detects the TXT record in the domain's DNS settings and automatically proceeds to the next step. Domains Wizard - Inbound Routes You must add your inbound routes, which are the external IP addresses or fully qualified domain names to which your inbound traffic is directed. For example, an inbound route can be for a mail server or an inbound mail gateway. When you enter an inbound route, we subject it to a series of technical checks before we register it with your domain. Upon completion of the wizard, you can customize or update your inbound routes and outbound routes in the Services section of the portal.

13 Domains wizard Domains wizard - Service Settings 13 Note: When you add your first domain, the inbound route that you specify is used as the default inbound route for your organization's domains. If you add a second domain with the same primary route before the checks have completed on your first domain, the second domain is configured with custom routes. However, once your first domain has been checked, your default inbound routes are registered and can be used for any subsequent domains. If you have at least one domain registered on your account, you are presented with three options to add an inbound route. You can use your registered default inbound routes, copy an inbound route from an existing domain, or add a new inbound route. Note: You must ensure that the domain you want to add is already configured on your organization's inbound mail gateway. The domain must be accessible through the IP address or the fully qualified domain name you have provided for your inbound route. If your inbound route fails our checks, you can re-enter the domains wizard and review the reason(s) for the failure. If the checks failed because we could not establish an SMTP connection, you can disregard the connectivity failure and add the inbound route. However, you must only select this option if you intend to fix the issue preventing connectivity before redirecting your MX records. If you fail to rectify the connectivity problem before you redirect your MX records, mail may not be delivered. Domains wizard - Service Settings The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned. This page lets you view the cloud security service settings for the domain being added. Note: Depending on your account's configuration, you may not see all of the options that are described.

14 Domains wizard Domains wizard - Register Addresses 14 When you add your first domain, the recommended default or best practice service settings are implemented. The services that you have purchased for your account are listed in a table alongside their associated settings. If you have previously added a domain, each subsequent domain that is added to your account inherits your organization's global service settings configuration. The services that you have purchased for your account are listed in a table alongside their associated settings. Once you have reviewed your service settings as they are displayed in the table, click Next. Note: Once you complete the guided steps and successfully provision your domain, you can customize your service settings in the Services section of the portal. Domains wizard - Register Addresses The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned. Note: Depending on your account's configuration, you may not see all of the options that are described. This page of the Domains guided steps lets you register addresses for your domain, which ensures those addresses receive scanned . You must use one of the three methods that are provided to register your addresses with us. Note: If your organization does not use Address Registration, it can be activated in the portal. Navigate in the portal to Services > Services > Platform and click on the Address Registration Protection link.

15 Domains wizard Domains wizard - Register Addresses 15 Note: You must ensure that all mailboxes are registered before you switch your MX records over to the cloud security services infrastructure. Mail is not delivered to mailboxes that are not registered. The first method of registering addresses is the Upload File option. The Upload File option opens by default in the first tab on the Register Addresses page in the wizard. You can upload a.txt or a.csv file containing multiple addresses. Note that each upload has a limit of 250,000 addresses. To upload multiple addresses with the Upload File option 1 Click on the Upload File tab. 2 Click on Choose File. A file open window opens. 3 Navigate your desktop to find the file you want to upload. Select the file for upload, and then click Upload. The file name is displayed in the Choose File box. 4 In the Upload File tab of the guided steps, click the Upload File button. Allow some time for the upload to complete. 5 Review the status messages that are provided. The number of addresses that are successfully added is displayed, along with the number of addresses that were invalid. Also, a table of registered addresses is shown. To check if an address is registered, you can search the Registered Addresses table using the search box. 6 The method that was used to input each of the registered addresses is shown in the Input Method column of the Registered Addresses table. To use the Synchronization Tool to register your addresses 1 Click on the Synchronization Tool tab. 2 Check the box to acknowledge your intention to use the Synchronization Tool to register your addresses. 3 Any registered addresses are shown in the Registered Addresses table. 4 Click Next to move on to the next step. 5 Ensure that you upload your Address List with the Synchronization Tool at a later date.

16 Domains wizard Domains wizard - Next Steps 16 To register addresses individually 1 Click on the Individually tab. 2 Enter an address in the box provided, and click Add. Note: Any addresses that are entered in this box must be in a valid format using ASCII characters. If you want to add an address with non-english characters, you must first convert the characters to punycode. You can enter an address using only the local portion of the address, for example "john_doe". You can also enter a full address as long as the domain is valid. Domains wizard - Next Steps The Domains guided steps wizard is located in the portal at Services > Services > Domains. Click the Add New Domain button to launch the guided steps wizard. Note: If you cannot click the Add New Domain button, you may not have the correct role assigned to your portal account. Refer to the Online Help for assistance with assigning the Manage Domains custom role to your account. You may need to contact your Support provider to have the custom role assigned. This page of the Domains wizard lists any outstanding actions that are necessary to complete the process of adding your domain. If you chose to validate your domain ownership using the validation method, you must now paste the validation key in the box provided. If you did not receive a validation key, you can choose to resend the validation key by clicking the button provided. Once you have reviewed any outstanding actions, click Finish. Your domain appears in the Inactive Domains list until all outstanding actions are complete. You can monitor the progress of your domain configuration in the Inactive Domains list in the portal at Services > Services > Domains. Note: Only update your MX records in your domain's DNS settings once we have instructed you to do so.