eMail Messaging Policy Framework (eMPF)

What it does

eMPF follows a set of administrator-defined rules describing who can message whom. With this, administrators can segregate various parts of their organizations email activities, as well as provide a variety of security-enhancing services. Because of this, eMPF can help to support HIPAA and Sarbanes-Oxley compliance.

How it does it

During an SMTP session, when a sender identifies themselves, either via SMTP_AUTH, or via the message envelope, as well as a recipient, eMPF loads applicable message policies to determine if the sender is allowed to message the sender, and if the recipient is allowed to receive mail from the sender.

What it can't do

Because mail from outside your mail server cannot be authenticated, the policy framework cannot be entirely sure about the identities of senders messaging local users. However, if SMTP authentication is required by local users, eMPF can prevent remote users from masquerading as local users to bypass policies.

What type of license does eMPF fall under?

GNU General Public License (GPL)

What requirements are there to install?

We have only tested eMPF with our own custom tarballs, however, we have packaged eMPF as a tarball with source, and we have provided documentation on patching the qmail source manually. Currently, the patch requires vpopmail, or any backend authentication module which does SMTP authentication with usernames in the format user@domain.

Where can I download the current version of eMPF?

You can download the latest version of eMPF on the install documentation page.

I have made a patch to eMPF, where do I submit it?

Please send all patches to the eMPF mailing list. You can subscribe by sending an email to empf-subscribe@inter7.com.

Mailing List
Subscribe to the mailing lists for annoucements and discussions by sending a blank email to empf-subscribe@inter7.com.

More information

More information can be found at the qmailWiki at http://www.qmailwiki.org/EMPF#A_policy_story