> Source: [sk123174](https://support.checkpoint.com/results/sk/sk123174)
# sk123174 - Mail Transfer Agent Update - What's New
| Property | Value |
|----------|-------|
| Solution ID | sk123174 |
| Date Created | 2018-02-27 |
| Last Modified | 2026-03-24 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
## Solution
The**Mail Transfer Agent Engine Update** is an accumulation of new features and bug fixes to the MTA engine.
MTA updates can be installed (as a separate Hotfix) on top of:
* R82 - In R82, all MTA fixes up to and including R81.20 Bundle 13 are already integrated into the base version of R82. Therefore, no separate MTA update bundle exists for R82. Any additional fixes, if required, are provided as specific Hotfixes on top of the R82 basic version, and no further MTA bundles are currently planned.
* R81.20
* R81.10
* R81
* R80.40
* R80.30 and R80.30SP for Maestro
* R80.20 and R80.20SP for Scalable Platforms (Maestro and Scalable Chassis)
* R80.10 with the R80.10 Jumbo Hotfix Accumulator, Take 142 and higher
MTA updates are delivered in the form of a CPUSE Hotfix and can be installed and upgraded manually in Gaia Portal and Gaia Clish commands (on Scalable Platform Security Groups - Gaia gClish commands). It is not necessary to restart Check Point services or reboot. The latest MTA engine update automatically appears as a CPUSE recommended package for MTA Gateways.
These MTA updates do not conflict with the regular Jumbo Hotfix Accumulator and can be updated independently.
The list of resolved issues below describes each resolved issue and provides the Take number of an MTA update, in which the fix was included. A resolved issue is included in the Incremental Hotfix starting from the Take number listed in this table (inclusive). The table also lists the date on which a take was made available.
To check the current version of a Mail Transfer Agent Update:
1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
2. Log in to the Expert mode.
3. Run:
`cat $FWDIR/conf/mta_ver`
**Note:** To download the Offline Updates below, your User Center account needs to have a [Software Subscription or Active Support plan](https://www.checkpoint.com/support-services/support-plans/).
### For R81.20 releases, including Scalable Platforms
|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|---------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 16.05.23 | **81_20_mta Take 13** **[Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=127819)** | 81.20.991002020 (MTA_V1) | * Bug fix * MTA PTC support * Handle postfix issues after GW reboot * Nested emails parsing improvement |
### For R81.10 releases, including Scalable Platforms {#MTA_for_R81_10}
|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 16.05.23 | **81_10_mta Take 17 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=127816)** | 81.10.991002017 (MTA_V15) | * Bug fix * MTA PTC support * Handle postfix issues after GW reboot * Nested emails parsing improvement |
| 22.09.22 | **81_10_mta Take 10 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=124991)** | 81.10.991002006 (MTA_V14) | * Support Sender Policy Framework (SPF) is a validation system that allows ISPs and webmail servers to check if the incoming mail is sent from an authorized server. Feature includes:Ability to allow or reject emails from an unknown SPF. Whitelist domains and IPs to skip SPF validation. * Fixed an issue that might cause missing verdict on emails from Threat Emulation logs. |
| 25.08.21 | **81_10_mta Take 9 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117396)** | 81.10.991002005 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note -- SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
### For R81 releases, including Scalable Platforms {#MTA_for_R81_00}
|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 16.05.23 | **81_mta Take 17 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=127813)** | 81.991002019 (MTA_V15) | * Bug fix * MTA PTC support * Handle postfix issues after GW reboot * Nested emails parsing improvement |
| 03.03.2022 | **81_mta Take 8 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=121786)** | 81.991002013 (MTA_V14) | * **Support Sender Policy Framework (SPF)** * SPF is a validation system that allows ISPs and webmail servers to check if the incoming mail is sent from an authorized server. * Feature includes: * Ability to allow or reject emails from an unknown SPF. * Whitelist domains and IPs to skip SPF validation. * Fixed an issue that might cause missing verdict on emails from Threat Emulation logs. |
| 25.08.21 | **81_mta Take 7 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117394)** | 81.991002011 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note: SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
| 18.02.21 | **81_mta Take 4** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112991) | 81.991002009 (MTA_V12) | * Fixed an issue that might cause inspection of emails containing multiple picture attachments to fail, if Threat Extraction is enabled. * Fixed an issue that caused some email inspections to fail when Threat Extraction is enabled. * Fixed an issue that in rare cases might allow end users to access the original attachment after it is was cleaned by Threat Extraction but before Threat Emulation finished scanning it. * Fixed an issue that caused some Anti-Phishing inspections of emails to fail. * Enhanced protection against URL obfuscation inside emails. |
### For R80.40 releases {#MTA_for_R80_40}
|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 16.05.23 | **80_40_mta Take 21 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=127810)** | 8040.991002045 (MTA_V14) | * Bug fix * MTA PTC support * Handle postfix issues after GW reboot * Nested emails parsing improvement |
| 25.08.21 | **80_40_mta Take 14 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117235)** | 8040.991002047 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note: SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
| 18.02.21 | **80_40_mta Take 13** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112831) | 8040.991002046 (MTA_V12) | * Fixed an issue that might cause inspection of emails containing multiple picture attachments to fail if Threat Extraction is enabled. * Fixed an issue that caused some email inspections to fail when Threat Extraction is enabled. * Fixed an issue that in rare cases might allow end users to access the original attachment after it is was cleaned by Threat Extraction but before Threat Emulation finished scanning it. * Fixed an issue that caused some Anti-Phishing inspections of emails to fail. * Enhanced protection against URL obfuscation inside emails. |
| 1.7.20 | **80_40_mta Take 11** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106733) | 8040.991002041 (MTA_V11) | * **Enhanced Granular Control for Fail-Open / Fail-Close Handling of Emails** * Administrators can now configure the MTA so that in case the following happens: * The general error handling configuration is fail-close AND * A specific error is configured to trigger a fail-open handling Then, the email that will be released due to this error will be the original one, regardless of whether or not the MTA already removed attachments or altered links in it. * An X-header will be added to emails for every error that took place. Until this update, only the first error would generate an X-header. * Support for the following errors: * Attachment size exceeded the configured maximum size * The number of URLs in the email exceeded the configured maximum * The number of headers in the email exceeded the configured maximum * Threat Emulation and/or Anti-Virus failed to scan an attachment * Threat Emulation failed to extract files from an archive * Threat Emulation failed to open a file for inspection * Threat Emulation failed because the number of concurrent emulations exceeded the configured maximum permitted * File type not supported by Threat Emulation * The number of files inside an archive attachment exceeded the configured maximum number * The MTA failed to remove an attachment or a link from the email * The MTA failed to read URLs in the email * The MTA failed to read the email * The MTA failed to send a file to emulation due to an internal error * Signature-based detection failed due to a connectivity issue * Signature-based detection timed out * Signature-based detection failed due to an internal error * Non-categorized failures |
| 24.6.20 | **80_40_mta Take 9** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106503) | 8040.991002039 (MTA_V10) | * **Important Note** -- due to recent infrastructure improvements, MTA gateways that enabled the Early Availability version of Click-Time URL Protection are advised to be upgraded to this MTA update. * Fixed an issue causing Phishing inspection not to run for emails sent to certain users, when the phishing inspection is disabled for the entire organization and enabled only for them. * Fixed an issue that in rare cases might cause a CPU usage increase of up to a couple of minutes on the MTA gateway, during which the inspection of some emails might end in an error (and be delivered or not according to the fail open/close settings). |
| 12.4.20 | **80_40_mta Take 7** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=104572) | 8040.991002037 (MTA_V9) | * Added the ability to exclude emails from specific senders or to specific recipients from being inspected. To do that, follow the instruction in [sk166272: MTA - Exclude emails from specific senders or to specific recipients from being inspected](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166272). * **Early Availability**: The MTA Gateway can now prevent phishing emails, using a new and dedicated engine. * **Early Availability**: The MTA Gateway can now re-write links in the email body, so that they are inspected again with every user click. * Fixed an issue that might cause attachments not to be scanned if the email is sent using a specific non-common email client. * Fixed an issue that might cause the email body to be corrupted (base-64 encoded) if an upstream MTA is added an email header in a non-conventional format. * Fixed an issue that might cause the MTA process to reboot if **ALL** of the following take place: * Threat Extraction is enabled. * The hash of a specific document is excluded from inspection in the Threat Prevention policy (using a Whitelist File exception). * An email arrives with the excluded file. * Fixed an issue that might cause the MTA process to reboot when processing a large document attachment while Threat Extraction is enabled. * Fixed an issue that might cause files to be removed from emails as malicious even though they were specifically excluded in the Threat Prevention policy. |
### For R80.30 and R80.30SP for Maestro releases {#MTA_for_R80_30}
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 25.08.21 | **80_30_mta Take 44 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117233)** | 8030.991002065 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note: SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
| 18.02.21 | **80_30_mta Take 43** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112829) | 8030.991002063 (MTA_V12) | * Fixed an issue that might case inspection of emails containing multiple picture attachments to fail, in case Threat Extraction is enabled. * Fixed an issue that caused some email inspections to fail when Threat Extraction is enabled. * Fixed an issue that in rare cases might allow end users to access the original attachment, after it is was cleaned by Threat Extraction, but before Threat Emulation finished scanning it. * Enhanced protection against URL obfuscation inside emails. |
| 1.7.20 | **80_30_mta Take 42** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106731) | 8030.991002059 (MTA_V11) | * **Enhanced Granular Control for Fail-Open / Fail-Close Handling of Emails** * Administrators can now configure the MTA so that in case the following happens: * The general error handling configuration is fail-close AND * A specific error is configured to trigger a fail-open handling Then, the email that will be released due to this error will be the original one, regardless of whether the MTA already removed attachments or altered links in it. * An X-header will be added to emails for every error that took place. Until this update, only the first error would generate an X-header. * Support for the following errors: * Attachment size exceeded the configured maximum size * The number of URLs in the email exceeded the configured maximum * The number of headers in the email exceeded the configured maximum * Threat Emulation and/or Anti-Virus failed to scan an attachment * Threat Emulation failed to extract files from an archive * Threat Emulation failed to open a file for inspection * Threat Emulation failed because the number of concurrent emulations exceeded the configured maximum permitted * File type not supported by Threat Emulation * The number of files inside an archive attachment exceeded the configured maximum number * The MTA failed to remove an attachment or a link from the email * The MTA failed to read URLs in the email * The MTA failed to read the email * The MTA failed to send a file to emulation due to an internal error * Signature-based detection failed due to a connectivity issue * Signature-based detection timed out * Signature-based detection failed due to an internal error * Non-categorized failures |
| 24.6.20 | **80_30_mta Take 40** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106501) | 8030.991002057 (MTA_V10) | * **Important Note:** due to recent infrastructure improvements, MTA gateways that enabled the Early Availability version of Click-Time URL Protection are advised to be upgraded to this MTA update. * Fixed an issue causing Phishing inspection not to run for emails sent to certain users, when the phishing inspection is disabled for the entire organization and enabled only for them. * Fixed an issue that in rare cases might cause a CPU usage increase of up to a couple of minutes on the MTA gateway, during which the inspection of some emails might end in an error (and be delivered or not according to the fail open/close settings). |
| 12.4.20 | **80_30_mta Take 38** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=104570) | 8030.991002055 (MTA_V9) | * Added the ability to exclude emails from specific senders or to specific recipients from being inspected. To do that, follow the instruction on [sk166272: MTA - Exclude emails from specific senders or to specific recipients from being inspected](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166272). * **Early Availability**: The MTA Gateway can now prevent phishing emails, using a new and dedicated engine. * **Early Availability**: The MTA Gateway can now re-write links in the email body so that they are inspected again with every user click. * Fixed an issue that might cause attachments not to be scanned if the email is sent using a specific non-common email client. * Fixed an issue that might cause the email body to be corrupted (base-64 encoded) if an upstream MTA is added an email header in a non-conventional format. * Fixed an issue that might cause the MTA process to reboot if **ALL** of the below take place: * Threat Extraction is enabled. * The hash of a specific document is excluded from inspection in the Threat Prevention policy (using a Whitelist File exception). * An email arrives with the excluded file. * Fixed an issue that might cause the MTA process to reboot when processing a large document attachment while Threat Extraction is enabled * Fixed an issue that might cause files to be removed from emails as malicious even though they were specifically excluded in the Threat Prevention policy. |
| 22.1.20 | **80_30_mta Take 37** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=102429) | 8030.991002054 (MTA_V8) | * Fixed an issue that causes emails with corrupted attachments to be delivered to end users if the following is configured: * Threat Extraction and Threat Emulation are enabled. * Threat Prevention is configured in fail open mode:(Manage \& Settings -\> Blades -\> Threat Prevention -\> Fail Mode) * Threat Extraction is configured to block corrupted files: (Profile -\> Threat Extraction -\> Advanced -\> Threat Extraction Exceptions) * Fixed an issue that might cause the MTA to reboot in rare cases when Threat Extraction is enabled and exceptions are defined for specific LDAP users / groups: (Profile -\> Mail -\> Exceptions -\> Extraction Exclusion/Inclusion) * Fixed an issue that might cause Anti-Spam logs not to include the email subject. * Fixed an issue that might cause attachments not to be removed from emails even if the attachment file type is configured to be dropped: (Profile -\> Anti-Virus -\> File Types -\> Process Specific File Type Families). These attachments still undergo Anti-Virus and Threat Emulation inspection for malware. * Fixed an issue that might cause large email queues for the last couple of days for some MTA Gateways. |
| 5.11.19 | **80_30_mta Take 34** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=100484) | 8030.991002050 (MTA_V7) | * Modified the configuration of the MTA so that it tries to send bounce messages only once, whether it reaches its destination or not. * Fixed a bug that might cause the MTA to inspect only parts of links containing special characters. * Fixed a bug causing inability to enable the DLP blade on MTA gateways |
| 3.10.19 | **80_30_mta Take 32** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=99683) | 8030.991002047 (MTA_V6) | * Improved Threat Emulation inspection for files behind shortened links (requires the Anti-Virus blade to be enabled) * Fixed a bug causing emails that were released due to timeout to be mistakenly listed as in queue by the CPView utility (see [sk101878](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101878)) * Fixed a bug that might cause a failure to remove malicious links from the email body in rare cases. |
| 25.8.19 | **80_30_mta Take 30** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=98408) | 8030.991002045 (MTA_V5) | * Fixed a bug that might cause URLs in email body not to be inspected in rare cases * Fixed a bug that might cause delay in email delivery in case Threat Extraction, Threat Emulation and Anti-Virus blades are configured in Detect-only mode |
| 17.7.19 | **80_30_mta Take 28** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=95307) | 8030.991002043 (MTA_V4) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing the configured customized subject prefix not to be added to malicious emails in case the MTA is configured to also send a copy of malicious emails to additional mailboxes * Several additional minor fixes |
| 17.6.19 | **80_30_mta Take 27** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=92388 target=) | 8030.991002041 (MTA_V3) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing users not to receive notifications that an email was not delivered to them, in case the email scan could not be completed before the configured timeout * Fixed a bug causing MTA not to add failure headers to the emails, in some cases in which the gateway is configured to add headers only in specific error cases (using [sk145552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145552)) * Additional minor fixes |
| 26.5.19 | **80_30_mta Take 24** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=90387) | 8030.991002038 (MTA_V2) | * **Enhanced Protection against BaseStriker:** MTA Gateways now protect against malicious emails containing URLs using the BaseStriker technique. * Improved disk usage utilization for MTA Gateways. * Fixed a bug that might cause the MTA Live Monitoring dashboard view to mistakenly present 0 as the number of delivered emails. * Fixed a bug in the latest R80.20 MTA engine that caused emails to be delivered only after Threat Emulation is completed, even though their attachment file type is supported for Threat Extraction. * Fixed a bug the might cause emails to be stuck in the Gateway after a Gateway upgrade if the next hop of the Gateway is a DNS name (used to allow for load balancing -- see [sk110369](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110369)). * Fixed a bug that might cause an inaccurate confidence level to be included in an Anti-Virus log and in the "X-Checkpoint-Verdict" email header for emails released by the MTA. * Fixed a bug that might cause MTA to not function properly when Anti-Spam is enabled and emails are received from senders in the Anti-Spam block list. * Various small fixes in the Anti-Spam engine. |
### For R80.20 and R80.20SP for Scalable Platforms (Maestro and Scalable Chassis) releases {#MTA_for_R80_20}
|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 25.08.21 | **80_20_mta Take 69 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117255)** | 8020.991002152 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note: SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
| 18.02.21 | **80_20_mta Take 67** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112827) | 8020.991002149 (MTA_V12) | * Fixed an issue that might case inspection of emails containing multiple picture attachments to fail, in case Threat Extraction is enabled. * Fixed an issue that caused some email inspections to fail when Threat Extraction is enabled. * Fixed an issue that in rare cases might allow end users to access the original attachment, after it is was cleaned by Threat Extraction, but before Threat Emulation finished scanning it. * Enhanced protection against URL obfuscation inside emails. |
| 1.7.20 | **80_20_mta Take 66** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106729) | 8020.991002144 (MTA_V11) | * **Enhanced Granular Control for Fail-Open / Fail-Close Handling of Emails** * Administrators can now configure the MTA so that in case the following happens: * The general error handling configuration is fail-close AND * A specific error is configured to trigger a fail-open handlingThen, the email that will be released due to this error will be the original one, regardless of whether the MTA already removed attachments or altered links in it. * An X-header will be added to emails for every error that took place. Until this update, only the first error would generate an X-header. * Support for the following errors: * Attachment size exceeded the configured maximum size * The number of URLs in the email exceeded the configured maximum * The number of headers in the email exceeded the configured maximum * Threat Emulation and/or Anti-Virus failed to scan an attachment * Threat Emulation failed to extract files from an archive * Threat Emulation failed to open a file for inspection * Threat Emulation failed because the number of concurrent emulations exceeded the configured maximum permitted * File type not supported by Threat Emulation * The number of files inside an archive attachment exceeded the configured maximum number * The MTA failed to remove an attachment or a link from the email * The MTA failed to read URLs in the email * The MTA failed to read the email * The MTA failed to send a file to emulation due to an internal error * Signature-based detection failed due to a connectivity issue * Signature-based detection timed out * Signature-based detection failed due to an internal error * Non-categorized failures |
| 24.6.20 | **80_20_mta Take 64** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106499) | 8020.991002142 (MTA_V10) | * **Important Note** -- due to recent infrastructure improvements, MTA gateways that enabled the Early Availability version of Click-Time URL Protection are advised to be upgraded to this MTA update. * Fixed an issue causing Phishing inspection not to run for emails sent to certain users, when the phishing inspection is disabled for the entire organization and enabled only for them. * Fixed an issue that in rare cases might cause a CPU usage increase of up to a couple of minutes on the MTA gateway, during which the inspection of some emails might end in an error (and be delivered or not according to the fail open/close settings). |
| 12.4.20 | **80_20_mta Take 59** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=104568) | 8020.991002140 (MTA_V9) | * Added the ability to exclude emails from specific senders or to specific recipients from being inspected. To do that, follow the instruction on [sk166272: MTA - Exclude emails from specific senders or to specific recipients from being inspected](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166272). * \[Early Availability\] The MTA gateway can now prevent phishing emails, using a new and dedicated engine. * \[Early Availability\] The MTA gateway can now re-write links in the email body, so that they are inspected again with every user click. * Fixed an issue that might cause attachments not to be scanned, in case the email is sent using a specific non-common email client * Fixed an issue causing the email body to be corrupted (base-64 encoded) in case an upstream MTA added an email header in a non-conventional format * Fixed an issue that might cause the MTA process to reboot, in case ALL of the below took place: * Threat Extraction is enabled * The hash of a specific document is excluded from inspection in the Threat Prevention policy (using a Whitelist File exception) * An email arrives with the excluded file * Fixed an issue that might cause the MTA process to reboot, when processing a large document attachment and Threat Extraction is enabled * Fixed an issue causing files to be removed from emails as malicious, even though there were specifically excluded in the Threat Prevention policy |
| 22.1.20 | **80_20_mta Take 57** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=102431) | 8020.991002139 (MTA_V8) | * Fixed an issue that causes emails with corrupted attachments to be delivered to end users, in case the following is configured: * Threat Extraction and Threat Emulation are enabled * Threat Prevention is configured in fail open mode.(Manage \& Settings -\> Blades -\> Threat Prevention -\> Fail Mode) * Threat Extraction is configured to block corrupted files (Profile -\> Threat Extraction -\> Advanced -\> Threat Extraction Exceptions) * Fixed an issue that might cause the MTA to reboot in rare cases when Threat Extraction is enabled and Exceptions are defined for specific LDAP users / groups. (Profile -\> Mail -\> Exceptions -\> Extraction Exclusion/Inclusion) * Fixed an issue that caused Anti-Spam logs not to include the email subject * Fixed an issue that might cause not removing attachments from emails, even if the attachment file type is configured to be dropped. (Profile -\> Anti-Virus -\> File Types -\> Process Specific File Type Families). These attachments still underwent Anti-Virus and Threat Emulation inspection for malware. * Fixed an issue that might have caused large email queues in the last couple of days for some MTA gateways |
| 5.11.19 | **80_20_mta Take 54** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=100482) | 8020.991002135 (MTA_V7) | * Modified the configuration of the MTA so that it tries to send bounce messages only once,whether it reaches its destination or not. * Fixed a bug that might cause the MTA to inspect only parts of links containing special characters. * Fixed a bug causing inability to enable the DLP blade on MTA gateways |
| 3.10.19 | **80_20_mta Take 52** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=99681) | 8020.991002132 (MTA_V6) | * Improved Threat Emulation inspection for files behind shortened links (requires the Anti-Virus blade to be enabled) * Fixed a bug causing emails that were released due to timeout to be mistakenly listed as in queue by the CPView utility (see [sk101878](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101878)) * Fixed a bug that might cause a failure to remove malicious links from the email body in rare cases. |
| 25.8.19 | **80_20_mta Take 49** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=98406) | 8020.991002129 (MTA_V5) | * Fixed a bug that might cause URLs in email body not to be inspected in rare cases * Fixed a bug that might cause delay in email delivery in case Threat Extraction, Threat Emulation and Anti-Virus blades are configured in Detect-only mode |
| 17.7.19 | **80_20_mta Take 47** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=95303) | 8020.991002127 (MTA_V4) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing the configured customized subject prefix not to be added to malicious emails in case the MTA is configured to also send a copy of malicious emails to additional mailboxes * Several additional minor fixes |
| 17.6.19 | **80_20_mta Take 46** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=92386) | 8020.991002125 (MTA_V3) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing users not to receive notifications that an email was not delivered to them, in case the email scan could not be completed before the configured timeout * Fixed a bug causing MTA not to add failure headers to the emails, in some cases in which the gateway is configured to add headers only in specific error cases (using [sk145552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145552)) Additional minor fixes |
| 26.5.19 | **80_20_mta Take 43** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=90385) | 8020.991002122 (MTA_V2) | * **Enhanced Protection against BaseStriker:** MTA Gateways now protect against malicious emails containing URLs using the BaseStriker technique. * Improved disk usage utilization for MTA Gateways. * Fixed a bug that might cause the MTA Live Monitoring dashboard view to mistakenly present 0 as the number of delivered emails. * Fixed a bug in the latest R80.20 MTA engine that caused emails to be delivered only after Threat Emulation is completed, even though their attachment file type is supported for Threat Extraction. * Fixed a bug the might cause emails to be stuck in the Gateway after a gateway upgrade if the next hop of the Gateway is a DNS name (used to allow for load balancing -- see [sk110369](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110369)). * Fixed a bug that might cause an inaccurate confidence level to be included in an Anti-Virus log and in the "X-Checkpoint-Verdict" email header for emails released by the MTA. * Fixed a bug that might cause MTA to not function properly if Anti-Spam is enabled and emails are received from senders in the Anti-Spam block list. * Various small fixes in the Anti-Spam engine. |
| 11.4.19 | **80_20_mta Take 34** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=87047) | 8020.991002114 (MTA_V1) | * **Threat Emulation for Files behind Bitly Links:** The body of an email sometimes includes customized Bitly links pointing to files. With this release, files behind these links will now be scanned by Threat Emulation to detect zero-day attacks. * This capability requires Threat Emulation and Anti-Virus to be enabled and the Gateway to be configured as MTA/ * Fix for bug that might in rare cases cause Threat Emulation not to be able to open some password-protected archive files for scanning, even if the email body contained the password (refer to [sk112821](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112821)). * Fix for bug that might in rare cases cause malicious links in the email body not to be removed. * Various small fixes to the Anti-Spam engine. |
| 4.4.19 | **80_20_mta Take 31** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=86565) | 8020.991002111 | * **Enhanced control over MTA actions in cases of failures:** MTA is often configured to block emails in case SandBlast fails to scan them. Administrators can now configure MTA so that in the event of specific failure types, the emails will bypass SandBlast and not be blocked. The X-Header of emails bypassing SandBlast due to this configuration will include the failure type, allowing administrators to apply specific email rules on them. For details and configuration instructions, refer to [sk145552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145552). * **Additional Details in MTA Timeout Log:** MTA logs indicating that an email scan has timed out now include details about the time it took the different engines to scan the mail. Engines included in the log are Anti-Virus, Threat Emulation, and Threat Extraction * Fixed a bug causing emails whose Threat Emulation scan failed to remain in the MTA queue until their defined timeout instead of being released as failed immediately. * Fixed a bug causing the following logs not to be sent when SandBlast is configured in MTA mode: * Email scan failed and SandBlast is configured to bypass protections in cases of failures. * Anti-Virus Detect logs * Fixed a bug causing Threat Emulation logs to mistakenly state a malicious file was prevented if Threat Extraction sanitized the file. * Fixed a bug causing redundant warning messages to be included under */var/log/maillog.* * Fixed a bug causing the download link for the original file not to appear in the email body if Threat Extraction is enabled and the email body is binary-encoded. * Fixed a bug causing MTA to restart in rare cases when Anti-Spam is enabled together with another engine (e.g., Anti-Virus). * Fixed a bug causing mta_monitor to generate redundant dump files upon the first policy install after it was turned off. * Fixed a bug that might in rare cases cause MTA performance degradation and high memory consumption. |
| 24.2.19 | **R80_20_mta Take 27** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=83025) | 8020.991002106 | * Threat Emulation configuration for exclusion of specific senders / recipients now supports '\*' as wildcard character. Improved failure handling: Failure to inspect attachments will result in applying the set fail-mode (in the Threat Prevention Advanced Settings) -- either allow (fail-open) or drop/replace the attachment (fail-close). Added a separate fail-mode setting for connection failures with ThreatCloud service for Anti-Virus reputation service * Resolved issues: SmartEvent fails to display log when the subject contains emoji characters. The File ID is displayed incorrectly in Threat Extraction logs. |
| 29.1.19 | **R80_20_mta Take 24** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=81287) | 8020.991002098 | * Bug fixes for customers using both Anti-Virus and Threat Emulation. |
| 17.1.19 | **R80_20_mta** **Take 21** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=80583) | 8020.991002094 | * Improve enforcement capabilities for signed emails * Improve CpDiag AV report * Debug enhancement * Bug fixes and enhancements |
| 12.12.18 | **R80_20_mta** **Take 18** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=77745) | 8020.991002090 | * Support Anti-Virus hash (MD5) exceptions for all files (refer to [sk142452](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk142452)) * Bug fixes and enhancements |
| 12.11.18 | **R80_20_mta** **Take 15** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=75627) | 8020.991002086 | * Improved detection for Anti-Virus hash \& URL reputation engines * Customizable port for incoming \& outgoing SMTP sessions * Minor bug fixes and enhancements |
| 24.10.18 | **R80_20_mta** **Take 11** | 8020.991002081 | * Minor bug fixes and enhancements |
| 10.10.18 | **R80_20_mta** **Take 7** | 8020.991002075 | The following are available in R80.20 Gateway \& Management: * Anti-Virus over MTA support * MTA performance improvements * Several fixes and enhancements |
### For R80.10 releases with the R80.10 Jumbo Hotfix Accumulator, Take 142 and higher {#MTA_for_R80_10}
This section applies to R80.10 with the R80.10 Jumbo Hotfix Accumulator, Take 142 and higher.
|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Release | Version | What's New |
| 25.08.21 | **R80_10_mta Take 74 [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=117253)** | 8010.991003096 (MTA_V13) | * Fixed an issue that might cause emails with cleaned attachments (Threat Extraction) not to contain the link to retrieve the original version of the attachments. This would usually happen in emails sent by automated messaging systems, that do not contain a body component. To include the link in these emails, follow this article: [sk175093](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175093) * Fixed an issue causing inability to retrieve the original version of a cleaned attachment in case the attachment name is long and contains spaces. * Fixed an issue that might cause emails to mistakenly fail SPF check. Note -- SPF enforcement is off by default and can be enabled by following this article: [sk146412](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146412) * Fixed an issue that caused Anti-Phishing and Click-Time URL Protection not to be enforced on all users, in case they were previously configured to be enforced only on some of the users and then switched to enforce on all. * Fixed an issue that might cause the body of some emails with removed malicious links or re-written links (Click-Time URL Protection) to be corrupted. |
| 18.02.21 | **R80_10_mta Take 73** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112825) | 8010.991003095 (MTA_V12) | * Fixed an issue that might case inspection of emails containing multiple picture attachments to fail, in case Threat Extraction is enabled. * Fixed an issue that caused some email inspections to fail when Threat Extraction is enabled. * Fixed an issue that in rare cases might allow end users to access the original attachment, after it is was cleaned by Threat Extraction, but before Threat Emulation finished scanning it. * Enhanced protection against URL obfuscation inside emails. |
| 1.7.20 | **80_10_mta Take 72** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106727) | 8010.991003091 (MTA_V11) | * **Enhanced Granular Control for Fail-Open / Fail-Close Handling of Emails** * Administrators can now configure the MTA so that in case the following happens: * The general error handling configuration is fail-close AND * A specific error is configured to trigger a fail-open handling Then, the email that will be released due to this error will be the original one, regardless of whether the MTA already removed attachments or altered links in it. * An X-header will be added to emails for every error that took place. Until this update, only the first error would generate an X-header. * Support for the following errors: * Attachment size exceeded the configured maximum size * The number of URLs in the email exceeded the configured maximum * The number of headers in the email exceeded the configured maximum * Threat Emulation and/or Anti-Virus failed to scan an attachment * Threat Emulation failed to extract files from an archive * Threat Emulation failed to open a file for inspection * Threat Emulation failed because the number of concurrent emulations exceeded the configured maximum permitted * File type not supported by Threat Emulation * The number of files inside an archive attachment exceeded the configured maximum number * The MTA failed to remove an attachment or a link from the email * The MTA failed to read URLs in the email * The MTA failed to read the email * The MTA failed to send a file to emulation due to an internal error * Signature-based detection failed due to a connectivity issue * Signature-based detection timed out * Signature-based detection failed due to an internal error * Non-categorized failures |
| 24.6.20 | **80_10_mta Take 70** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=106497) | 8010.991003089 (MTA_V10) | * **Important Note** -- due to recent infrastructure improvements, MTA gateways that enabled the Early Availability version of Click-Time URL Protection are advised to be upgraded to this MTA update. * Fixed an issue causing Phishing inspection not to run for emails sent to certain users, when the phishing inspection is disabled for the entire organization and enabled only for them. * Fixed an issue that in rare cases might cause a CPU usage increase of up to a couple of minutes on the MTA gateway, during which the inspection of some emails might end in an error (and be delivered or not according to the fail open/close settings). |
| 12.4.20 | **80_10_mta Take 68** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=104566) | 8010.991003087 (MTA_V9) | * Added the ability to exclude emails from specific senders or to specific recipients from being inspected. To do that, follow the instruction on [sk166272: MTA - Exclude emails from specific senders or to specific recipients from being inspected](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166272). * \[Early Availability\] The MTA gateway can now prevent phishing emails, using a new and dedicated engine. * \[Early Availability\] The MTA gateway can now re-write links in the email body, so that they are inspected again with every user click.[](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk162618) * Fixed an issue that might cause attachments not to be scanned, in case the email is sent using a specific non-common email client * Fixed an issue causing the email body to be corrupted (base-64 encoded) in case an upstream MTA added an email header in a non-conventional format * Fixed an issue that might cause the MTA process to reboot, in case ALL of the below took place: * Threat Extraction is enabled * The hash of a specific document is excluded from inspection in the Threat Prevention policy (using a Whitelist File exception) * An email arrives with the excluded file * Fixed an issue that might cause the MTA process to reboot, when processing a large document attachment and Threat Extraction is enabled * Fixed an issue causing files to be removed from emails as malicious, even though there were specifically excluded in the Threat Prevention policy |
| 22.1.20 | **80_10_mta Take 67** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=102433) | 8010.991003086 (MTA_V8) | * Fixed an issue that causes emails with corrupted attachments to be delivered to end users, in case the following is configured: * Threat Extraction and Threat Emulation are enabled * Threat Prevention is configured in fail open mode.(Manage \& Settings -\> Blades -\> Threat Prevention -\> Fail Mode) * Threat Extraction is configured to block corrupted files (Profile -\> Threat Extraction -\> Advanced -\> Threat Extraction Exceptions) * Fixed an issue that might cause the MTA to reboot in rare cases when Threat Extraction is enabled and Exceptions are defined for specific LDAP users / groups. (Profile -\> Mail -\> Exceptions -\> Extraction Exclusion/Inclusion) * Fixed an issue that caused Anti-Spam logs not to include the email subject * Fixed an issue that might cause not removing attachments from emails, even if the attachment file type is configured to be dropped. (Profile -\> Anti-Virus -\> File Types -\> Process Specific File Type Families). These attachments still underwent Anti-Virus and Threat Emulation inspection for malware. * Fixed an issue that might have caused large email queues in the last couple of days for some MTA gateways |
| 5.11.19 | **80_10_mta Take 64** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=100479) | 8010.991003082 (MTA_V7) | * Modified the configuration of the MTA so that it tries to send bounce messages only once, whether it reaches its destination or not. * Fixed a bug that might cause the MTA to inspect only parts of links containing special characters. * Fixed a bug causing inability to enable the DLP blade on MTA gateways |
| 3.10.19 | **80_10_mta Take 62** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=99679) | 8010.991003079 (MTA_V6) | * Improved Threat Emulation inspection for files behind shortened links (requires the Anti-Virus blade to be enabled) * Fixed a bug causing emails that were released due to timeout to be mistakenly listed as in queue by the CPView utility (see [sk101878](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101878)) * Fixed a bug that might cause a failure to remove malicious links from the email body in rare cases. |
| 25.8.19 | **80_10_mta Take 59** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=98404) | 8010.991003076 (MTA_V5) | * Fixed a bug that might cause URLs in email body not to be inspected in rare cases * Fixed a bug that might cause delay in email delivery in case Threat Extraction, Threat Emulation and Anti-Virus blades are configured in Detect-only mode |
| 17.7.19 | **80_10_mta Take 58** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=95305) | 8010.991003075 (MTA_V4) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing the configured customized subject prefix not to be added to malicious emails in case the MTA is configured to also send a copy of malicious emails to additional mailboxes * Several additional minor fixes |
| 17.6.19 | **80_10_mta Take 57** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=92384) | 8010.991003073 (MTA_V3) | * Fixed a bug that might cause some mail scans to fail on reputation problems, even though they did not contain any link * Fixed a bug causing users not to receive notifications that an email was not delivered to them, in case the email scan could not be completed before the configured timeout * Fixed a bug causing MTA not to add failure headers to the emails, in some cases in which the gateway is configured to add headers only in specific error cases (using [sk145552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145552)) * Additional minor fixes |
| 26.5.19 | **80_10_mta Take 53** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=90383) | 8010.991003069 (MTA_V2) | * **Enhanced Protection against BaseStriker** -- MTA gateways now protect against malicious emails containing URLs utilizing BaseStriker technique * Improved disk usage utilization in MTA gateways * Fixed a bug that might cause the MTA Live Monitoring dashboard view to mistakenly present 0 as the number of delivered emails * Fixed a bug in the latest R80.20 MTA engine, causing emails to be delivered only after Threat Emulation is completed, even though their attachment file type is supported for Threat Extraction * Fixed a bug the might cause emails to be stuck on the gateway after a gateway upgrade, in case the next hop of the Gateway is a DNS name (used to allow for load balancing -- see sk110369) * Fixed a bug that might cause inaccurate confidence level to be included in an Anti-Virus log and the "X-Checkpoint-Verdict" email header for emails released by the MTA. * Fixed a bug that might cause MTA to not function properly in case Anti-Spam is enabled and emails are received from senders in the Anti-Spam block list * Various small fixes in the Anti-Spam engine |
| 11.4.19 | **80_10_mta Take 47** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=87045) | 8010.991003061 (MTA_V1) | * **Threat Emulation for Files behind Bitly Links** -- Email body sometimes include customized Bitly links pointing to files With this release, files behind these links will now be scanned by Threat Emulation to detect zero-day attacks * This capability requires Threat Emulation and Anti-Virus to be enabled and the gateway to be configured as MTA * Fixed a bug that might cause Threat Emulation in rare cases not to be able to open some password-protected archive files for scanning, even if the email body contained the password (refer to [sk112821](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112821)) * Fixed a bug that might cause malicious links in the email body not to be removed in rare cases * Various small fixes in the Anti-Spam engine |
| 4.4.19 | **80_10_mta Take 44** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=86563) | 8010.991003058 | * **Enhanced control over MTA actions in cases of failures** - MTA is often configured to block emails in case SandBlast failed to scan them. Administrators can now configure MTA so that in case of specific failure types, the emails will bypass SandBlast and not be blocked. The X-Header of emails bypassing SandBlast due to this configuration will include the failure type, allowing administrators to apply specific email rules on them.More details and configuration instructions are in [sk145552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145552) * **Additional Details in MTA Timeout Log**- MTA logs indicating an email scan has timed out now include details about the time it took the different engines to scan the mail. Engines included in the log are Anti-Virus, Threat Emulation and Threat Extraction * Fixed a bug causing emails, whose Threat Emulation scan failed, to remain in the MTA queue until their defined timeout instead of being released as failed immediately * Fixed a bug causing the following logs not to be sent when SandBlast is configured in MTA mode: * Email scan failed and SandBlast is configured to bypass protections in cases of failures. * Anti-Virus Detect logs * Fixed a bug causing Threat Emulation logs to mistakenly state a malicious file was prevented in case Threat Extraction sanitized the file * Fixed a bug causing redundant warning messages to be included under /var/log/maillog * Fixed a bug causing the link to download the original file not to appear in the email body, in case Threat Extraction is enabled and the email body is binary-encoded. * Fixed a bug causing MTA to restart in rare cases where Anti-Spam is enabled and another engine (e.g., Anti-Virus) * Fixed a bug causing mta_monitor to generate redundant dump files upon the first policy install after it was turned off * Fixed a bug that might cause MTA performance degradation and high memory consumption in rare cases. |
| 24.2.19 | **80_10_mta** **Take 37** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=83023) | 8010.991003050 | * Threat Emulation configuration for exclusion of specific senders / recipients now supports '\*' as a wildcard character. * Improved failure handling: * Failure to inspect attachments will result in applying the set fail-mode (in the Threat Prevention Advanced Settings) - either allow (fail-open) or drop/replace the attachment (fail-close). * Added a separate fail-mode setting for connection failures with ThreatCloud service for Anti-Virus reputation service. * Resolved issues: * SmartEvent fails to display log when the subject contains emoji characters. * File ID is displayed incorrectly in Threat Extraction logs. |
| 29.1.19 | **80_10_mta** **Take 34** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=81285) | 8010.991003044 | * Bug fixes for customers using both Anti-Virus and Threat Emulation. |
| 17.1.19 | **R80_10_mta** **Take 31** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=80567) | 8010.991003041 | * Improve enforcement capabilities for signed emails * Improve CpDiag AV report * Debug enhancement * Bug fixes and enhancements |
| 12.12.18 | **R80_10_mta** **Take 28** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=77747) | 8010.991003037 | * Support Anti-Virus hash (MD5) exceptions for all files (refer to [sk142452](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk142452)) * Bug fixes and enhancements |
| 12.11.18 | **R80_10_mta** **Take 25** [Offline Update](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=75663) | 8010.991003033 | * Improved detection for Anti-Virus hash \& URL reputation engines * Customizable port for incoming \& outgoing SMTP sessions * Minor bug fixes and enhancements |
| 24.10.18 | **R80_10_mta** **Take 21** | 8010.991003028 | * Alignment to R80.20 MTA engine update * Anti-Virus over MTA support * MTA performance improvements * Minor bug fixes and enhancements |
| 26.8.18 | **R80_10_mta** **Take 19** | 8010.991003025 | The following are available in R80.20.M1 Security Management, or by Gateway configurations on pre-R80.20.M1 versions (refer to [sk137572](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137572 "sk137572")): * MTA monitoring (requires R80.20 Management). * Setting a next-hop server by domain name (requires R80.20 Management). * Removing/replacing malicious links and attachments from e-mails with a customizable text. * Adding a customized text to a malicious e-mail's body or subject. * Malicious e-mail tagging using an X-header. * Sending a copy of the malicious e-mail. |
### Installation instructions
**Procedure:**{#Installation instructions - Procedure}
* **Show / Hide instructions for installation in Gaia Portal - using CPUSE (Check Point Update Service Engine)**
* **Offline installation**
**Note:** Either get the offline package from [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html), or export the package from a source Gaia machine, on which this package was already downloaded / installed (for package export instructions, refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "(4-D) "*How to* ..."").
1. Make sure MTA is enabled in the Security Gateway / Cluster object.
2. Install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New) on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
3. Connect to the Gaia Portal on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
4. Navigate to ***Upgrades (CPUSE)*** section \> click the ***Status and Actions*** page.
5. In the upper right corner, click the ***Import Package*** button.
6. In the ***Import Package*** window, click ***Browse...*** - select the CPUSE package (either offline TGZ file, or exported TAR file) - click ***Import***.
7. Above the list of all software packages, click the ***Showing Recommended packages*** button - select***All***.
8. Select the imported package **R80.X Mail Transfer Agent (MTA) update (Take X)** - click the ***More*** button on the toolbar - click ***Verifier*** (or right-click the package and click ***Verifier***).
9. Select this package and click the ***Install Update*** button on the toolbar.
{#Anchor_to_Installation_CPUSE_Gaia_Portal}
{#Anchor_to_Installation_CPUSE_Gaia_Portal}
* **Show / Hide instructions for installation in Gaia Clish - using CPUSE (Check Point Update Service Engine)**
For detailed installation instructions, refer to [CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "*(4) How to work with CPUSE*".
* **Offline installation**
**Note:** Either get the offline package from [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html), or export the package from a source Gaia machine, on which this package was already downloaded / installed (for package export instructions, refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE%20-%20Additional%20How%20To) - section "*(4-D) "How to ..."*").
1. Make sure MTA is enabled in the Security Gateway / Cluster object.
2. Install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New) on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
3. Connect to command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
4. Log in to Gaia Clish.
On a Scalable Platform Security Group, go to Gaia gClish.
5. Acquire the lock over the Gaia configuration database:
***lock database override***
6. Import the package from the hard disk:
**Note:** When import completes, this package is deleted from the original location.
***installer import local \/\.TGZ_or_TAR***
7. Show the imported packages:
***show installer packages imported***
8. Verify that this package can be installed without conflicts:
***installer verify \***
9. Install the imported package:
***installer install \***
{#Anchor_to_Installation_CPUSE_Gaia_Clish}
{#Anchor_to_Installation_CPUSE_Gaia_Clish}
### Uninstall instructions {#Uninstall instructions}
**Important Note:**This Jumbo Hotfix Accumulator removes all its packages during uninstall.
**Procedure:**
* **Show / Hide instructions for uninstall in Gaia Portal - using CPUSE (Check Point Update Service Engine)**
1. [CPUSE Software Updates Policy](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE%20-%20Additional%20How%20To) should be configured to allow self-update of the CPUSE Agent.
Otherwise (and if this machine is offline), users should manually install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New).
2. Connect to the Gaia Portal on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
3. Navigate to the ***Upgrades (CPUSE)*** section \> click the ***Status and Actions*** page.
4. Above the list of all software packages, click the ***Showing Recommended packages*** button \> select ***All***.
5. Right-click the Mail Transfer Agent Update package \> click ***Uninstall***.
* **Show / Hide instructions for uninstall in Gaia Clish - using CPUSE (Check Point Update Service Engine)**
1. [CPUSE Software Updates Policy](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE%20-%20Additional%20How%20To) should be configured to allow self-update of CPUSE Agent.
Otherwise (and if this machine is offline), users should manually install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New).
2. Connect to command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
3. Log in to Gaia Clish.
On a Scalable Platform Security Group, go to Gaia gClish.
4. Acquire the lock over the Gaia configuration database:
***lock database override***
5. Uninstall the package:
***installer uninstall \***
Note: The progress (in percent) appears in Gaia Clish.
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content