EmailSentry™ Setup

These are the options you should consider when first installing EmailSentry. While the recommended layout for EmailSentry config files (FixedConfigFile and LiveConfigFile) makes changing EmailSentry settings and functionality very easy, we recommend reviewing the options below to optimize how EmailSentry works for your organization from day one. They are listed in order of importance, with our recommendations. The options are explained in detail below this top summary.

How to Install
ClickOnce (download) or MSI (push)
User Instructions
Install and MoreInfo Pages
Control EmailSentry
Configuration Files
Configure Buttons
Allowed buttons (Change, Delete, Encrypt, Send)
Config Settings
Common configuration settings
A list of "safe" domains to skip testing
UI and Language
US-en(glish) prompts and buttons
Originate from your IP address space
(only if required by your network)

ClickOnce or MSI

There are two ways to install EmailSentry on user's PCs:

  1. ClickOnce (setup.exe)
  2. Windows Installer (emailsentry.msi)

There are four ways to install the FixedConfigFile (described below) on user's PCs:

  1. An email to with COMPANYPASS in the Subject:
  2. Copy to C:\ProgramData\SecurEmailLLC\EmailSentry.xml
  3. Command line arguments to the standard Windows Installer (.msi)
  4. Embedded inside a custom Windows Installer (.msi)

A ClickOnce install is the simplist way to install the EmailSentry Add-in, but it limits you to the first two options for installing the FixedConfigFile. Microsoft says "a ClickOnce application cannot break existing applications". It installs all the parts of the Add-in in a sandbox, including any necessary libraries not already on the PC. These libraries are only accessible by that particular Add-in, and are removed if/when the Add-in is uninstalled. ClickOnce applications work for both 32-bit or 64-bit Outlook automatically.

For interactive installs, users are instructed on an intranet page or in an email to click two links that run setup.exe and then start the configuration email, something like:
Installation LINK
Configuration LINK
The default for these two links are:

For unattended, "push" installs to users, we recommend deploying both the ClickOnce setup.exe and the FixedConfigFile using a Group Policy Object (GPO) or System Center Configuration Manager, or something similar.

Some companies find it easier to get GPO or SCCM to install the .msi. If so, the FixedConfigFile can be installed at the same time with option 3 above, using: msiexec.exe /i EmailSentry.msi CODE=COMPANYCODE PASS=COMPANYPASS

Install and MoreInfo Pages

We provide two webpage templates that you should customize and make available to your users. One tells your users about EmailSentry and the other tells them how to install it.

MoreInfo Page

The EmailSentry PopUp with the Change, Delete, and Send buttons has a "MoreInfo" link. Your users may use this link when they don't know what to do with an unsafe email, or if they have any questions on how EmailSentry works or what it is doing.

The MoreInfo Page is your page. It should look like your other web pages, with your corporate look-and-feel. It should have content specific to your company and your use of EmailSentry.

MoreInfo is where companies instruct their users how to use EmailSentry, and more importantly, what to do if EmailSentry stops an insecure address. This ranges from telling your users

"If you are certain that there is no 'protected information' in the email you may use the 'Send Anyway' menu choice to send the message"


"When you click the 'Send Anyway' button the email will be held in our secure email portal and your recipient will have to login to our website to view their message. Please phone them and let them know if this is the first time you have emailed them."

or even

"When EmailSentry stops and lists one or more domains that are insecure, you may not send any email to this address and you must find another way to send the information."

Your MoreInfo page should:

It can include content from any of these links, or the links themselves:

The page should be hosted on your own website or intranet so you can easily control access to it and the content on it. CheckTLS can host this page for you if you do not want to host it yourself, and we can make simple changes to the page contents for you.
See <MOREINFOURL> in the EmailSentry EmailSentry Configuration for how to tell EmailSentry where this file is located.

No matter where your MoreInfo Page is hosted, it will likely include your EmailSentry password, so it should be protected on a private area of your website or on your private intranet.

We provide a skeletal MoreInfo Page at the MoreInfo link we provided when we setup your subscription. The link to your MoreInfo page is a parameter in your Configuration File, so it can be hosted on your website or intranet.

Install Page

Customers using the ClickOnce install usually send an email to their users telling them to install EmailSentry. We provide an Install template that can be included in this email as a link. As with the MoreInfo page, you can host this page on your website, or we can continue to host it for you.

Configuration File

EmailSentry uses XML config file(s) to store your license key and any custom settings. This file is read every time you start Outlook. We recommend splitting this file into two parts: a FixedConfigFile stored on the user’s PC and a LiveConfigFile that is fetched from a webserver.

The FixedConfigFile is required, and points to the LiveConfigFile. The FixedConfigFile is hard to change, since it requires copying a new file onto every user’s PC. We recommend the FixedConfigFile only contain one field: the URL for your LiveConfigFile.

The LiveConfigFile, since it is centrally stored on a webserver, is much easier to change. Changes in this one central file allow you to change how EmailSentry looks to your users, and behind the scenes, what requirements you have for an address to “pass”; for example by requiring TLS V1.2 and above.

Also, since <DISABLE> is an option in the LiveConfigFile, you can temporarily disable EmailSentry for all your users with a change to this common file. This is useful if your Internet connection is down but you want users to still be able to composei emails and queue them (for sending later).
Obviously, when EmailSentry is disabled, it is not longer protecting your email.

Because the LiveConfigFile is a setting in the FixedConfigFile on each user’s PC, you should decide where the LiveConfigFile will be hosted before you install EmailSentry for your users. Again, changing the FixedConfigFile is hard.

CheckTLS will host your LiveConfigFile for you. And we provide a webpage that lets you make changes to it at any time: EditCsOAConfigFiles. This is a safe choice because if a user’s PC cannot reach a LiveConfigFile on our server, it probably cannot reach any of our servers or even the Internet at all, meaning the user won’t be able to send email anyway.

Button Options

You can disable the "Send This Email Anyway" button, which makes it impossible for a user to send an unsafe email. We recommend leaving the Send Anyway option because your user knows best if the email does not contain any protected information and so is safe to send as plain text. The email "Honey, don't forget to get milk." is safe no matter who or where the recipient is.
See <SENDBUTTON> in the EmailSentry EmailSentry Configuration for more information.

You can add an "Encrypt This Email" button if your back-end email system is able to do additional encryption for selected emails. ENCRYPT config file options let you add a trigger to the email Subject (e.g. the word "ENCRYPT" as the first word), or change the email's Sensitivity, or rewrite some domain names.
See <ENCRYPTOPTION> in the EmailSentry EmailSentry Configuration for more information.

Skip To:s and Skip From:s

You can list domains that you do not have to test with every email here. Your own domain(s) for example, or trading partners you use with separate private network connections, etc. We are happy to add a list of domains to your Configuration Files for you.
See <SKIPDOMAINS> in the EmailSentry EmailSentry Configuration for more information.

You can also configure EmailSentry to completely skip testing of all emails from a certain user.
See <NOTFROM> in the EmailSentry EmailSentry Configuration for more information.

Common Config Settings
Hide Users

EmailSentry tracks license usage by the USERNAME and COMPUTERNAME from each user's PC. These two fields can permanently obfuscated by a one-way hash that turns them into a string of 32 random characters before they are sent to CheckTLS. This hash makes the USERNAME and COMPUTERNAME unrecoverable.
See <NOTFROM> in the EmailSentry EmailSentry Configuration for more information.

We recommend not obfuscating the USERNAME and COMPUTERNAME. These two fields are not much of a security concern, and leaving them as text makes the EmailSentry usage reports much more useful to you. See Sample Usage Report and Sample History Query for more information.

Quick, Partial, or Complete

This specifies the options available in the CheckTLS //email/testTo: ("TestReceiver") test. See the documentation on for that test for very specific information about all the options available. There are hundreds.

CheckTLS reports a ConfidenceFactor instead of just a "yes" or "no" answer for a good reason. See This FAQ. It is up to you to decide what to include in the scoring, and what score you consider a "yes".

There are a few CheckTLS settings we recommend you consider when first setting EmailSentry up:

Minimum Score
What value of the ConfidenceFactor means "OK" (default 90)
For domains with many MX hosts, how many to test before saying "OK" (default 1)
How long before giving up on slow mailers; retry is often faster (default 11 sec)
Don't worry about off-line MX hosts when there is more than one (default yes)
Stop once we know the answer to TLS yes/no (default yes (EHLO2))
Check for revoked certificates; it is slow and never happens (default no)
What versions of SSL/TLS are acceptable

We recommend a minimum ConfidenceFactor of 90. Scores less than 100 but greater than 90 generally indicate a problem with certificates, which doesn't affect whether the email is encrypted or not. A few points off can also indicate one low-priority weak server that won't be used. Generally TLS failures result in scores below 50, so 90 is safe.

We recommend an MXCount of 1. The first, highest priority, MX, is most likely the one that your actual mail will use. Testing other ones slows EmailSentry down (your user waits for all those tests) and doesn't test the one you're going to use anyway. And generally huge mail companies with tens of MX hosts are very safe: all their mailers do TLS all the time. Another option is 50%, as in test half of them.

We recommend a TimeOut of 11 seconds for an interactive test. Emailers are designed to just drop the ball if/when they get busy or find any kind of glitch. They know they will get another chance to receive the email in a few moments when the sender retries. If your users get a FAIL on a domain, they can click Cancel and re-send the email to test it again. This is more palatable to users than waiting up to 30 seconds for a mailer that may have given up.

All of the above options except SSLVersion can be set at once by specifying Quick in the Configuration File. This is the default for EmailSentry. SSLVersion is a changing standard as older versions are deprecated, so we allow clients to set that for themselves.

We can maintain all the above settings for you -- just contact the helpdesk.

Quick, Partial, or Complete

See the EmailSentry EmailSentry Configuration for more information.

Customized User Interface

You can customize all of the prompts and button names in EmailSentry. This is very useful for translating to other languages. The only limitation is the space available on the button or screen line. These are the fields and their default values:

&Change This Email
&Delete This Email
&Send This Email Anyway
Checking Recipient Security
More Information
These domains failed CheckTLS:
If EmailSentry is Turned Off, all email
will be sent without EmailSentry security.

Restart Outlook to re-enable.
For example, a Configuration File entry for T_OK would look like:
<T_OK>très bien</T_OK> And here is the EmailSentry popup in Dutch:
EmailSentry in Dutch

The optional field <T_LogoImageLocation> points to a logo file that replaces the EmailSentry logo in the top left of the popup window next to the title.

Originate From Your IP Address Space

If your corporate network requires user's PCs to connect to the web through a proxy, EmailSentry can be configured to work through it as well, for example:
<PROXYURL></PROXYURL> See WebProxy Class for how to format the proxy string.

Email configuration (see info on Configure Link above) can be done through a proxy by carefully including the PROXYURL in the Subject: of the email like this: Subject:proxy: COMPANYPASS It is important that there is only ONE space character in the entire subject string and that is between the proxy string and the COMPANYPASS.


EmailSentry tests domains by connecting to them and probing their security. These tests are usually launched from the servers. You can find the IP addresses of the servers by doing a DNS search on "".

Very security conscious companies or companies that have very robust Internet mail connectivity and reputation can specify a different IP address space from which to originate these tests.

Use the config file option <a_SOCKS> to specify a SOCKS proxy server which EmailSentry can route connections to Internet port 25 (SMTP). The format is "user:pass@host:port", for example: <a_SOCKS></a_SOCKS>