Who: SpamTitan Private Cloud customers


When: 2024

 

What: SpamTitan v8 upgrade to v9.


This is a substantial upgrade bringing current SpamTitan Private Clouds into our new SpamTitan Skellig shared environments.

 

SpamTitan Skellig includes: 

 

  • Updated and modern UI.  
  • Advanced anti-spam engine. 
  • Improved navigation and better administrative functions across the board.  
  • Easier onboarding of new users.   


The latest Virus Bulletin Q2 quarterly results demonstrate that the new spam engine has an exceptional catch rate and false positive rate. We're eager to bring our current Private Cloud customers into a SpamTitan Skellig environment to benefit from this, along with the ease of operating the new UI.  


Article available here: https://www.virusbulletin.com/virusbulletin/2024/06/vbspam-comparative-review


How a migration works: 


A migration entails a brand new account created within SpamTitan Skellig for you, using a snapshot of your current SpamTitan Private Cloud at that point in time. This means that your current configurations are all mapped over, and are the basis for your account. Once the account has propagated in the new environment, we then start to relay mail via the MX Record to the new SpamTitan Skellig account. This way we have the most recent version of your SpamTitan Private Cloud (allowed/blocked/pattern filters) as the basis for your account.


The migration team will confirm the IPs, hostname and new MX Record of your new SpamTitan Skellig account via an email.


Steps:

 

  1. Validate that all active domains have the new MX record
    You will find the details for your new MX record in the email from the migration team from ST9upgrade@titanhq.com. You need to replace your current MX record with it. 

  2. Update TLS Cert: Under Settings > TLS > Certificate change to DIGICERT cert. This is temporary, and only applicable between the time you update the MX records and are not yet migrated into the SpamTitan Skellig server.

  3. Firewall rules update: New server IP addresses will also be included in the email. Please ensure that the firewall for all active domains allows communication over port 25 for the provided IPs by adding them. 

  4. Mail server connectors update: If you have connectors in your mail server. Please ensure that your connector also allows emails for the new IPs. Not doing so might result in rate limiting on the mail server and rejection of email.https://support.titanhq.com/en/59614-locking-down-your-office-365-mail-server.html

           Steps if your domains are using Google: https://support.google.com/a/answer/60730?hl=en

           

As part of our validation process, we perform checks to ensure all configurations are done correctly. One crucial step involves sending a test email to a random address associated with each domain on your server. This ensures that everything is in order and helps us prevent any potential issues.


Once the above is complete, you will confirm with the migration team who will then perform a pre-migration check. The team will confirm if the check was successfully run, or not. In the case that the pre-check was not successful we will inform you what was flagged and what changes you need to make. 

 

When the pre-check is successful, the migration will take place during an agreed window the day preceding the above check. Please be assured that there is no downtime or loss in email. 


We will then proceed to power down the version 8 software 30 days after the migration. We will notify you of this and provide enough time for you make any adjustments required.

 

Below is a full list of FAQs explaining more elements of the migration. If you have a question that is not addressed below, please email the team at ST9upgrade@titanhq.com and we will take care of your questions. 



 

FAQ:

 

What is the process for this upgrade? 

You will be provided with the details for your new SpamTitan Skellig before the migration. You will need to update the domain(s) that SpamTitan filters. 

You will also need to add IPs to inbound connectors on your mail server. Not doing so might result in rate limiting on the mail server and rejection of email. 

https://support.titanhq.com/en/59614-locking-down-your-office-365-mail-server.html

You may also want to refer to this article to ensure mail is not marked as spam by Office 365. 

https://support.titanhq.com/en/59681-ensuring-your-email-is-not-marked-as-spam-in-office-365.html

If you're using Google G-Suite as your mail server, the below link will explain how to add the IPs

https://titanhq.freshservice.com/support/solutions/articles/19000110838

Once you have this done, the migration team will run a pre-migration check to ensure that no step has been missed. 

If the pre-migration check is successful your server will be updated within a defined window. Once migrated we will confirm with you and supply the new URL to access the new SpamTitan Skellig account. 

There is no downtime with this, and mail will flow through the new account instantaneously.

How else should I prepare? (MSP)

If you are an MSP that manages multiple domains, we would suggest that you establish Domain Groups in your current SpamTitan Private Cloud. The reason for this is that domains that are set up under a Domain Group will map over to the new second layer of SpamTitan Skellig which is the Customer layer. This will make it easier to manage your unique Customer accounts and associated domains in the new SpamTitan Skellig system. If you don't have Domain Groups established prior to a migration, domains will go under the one 'customer' section, which will inherit the name of the overall account. 

Doc to create Domain Group in SpamTitan Private Cloud: https://docs.titanhq.com/en/8973-creating-domain-groups.html

 

Doc explaining new layers in SpamTitan Skellig: https://support.titanhq.com/en/56985-welcome-to-spamtitan-.html


Will there be changes to mail flow behavior?

As your current SpamTitan Private Cloud settings are being migrated into a new environment and are the basis for your SpamTitan Skellig account, you may notice slight changes in mail flow after a migration, particularly Greylisting. Do not be concerned about this as the new anti-spam engine adjusts itself relatively quickly. You can also disable Greylisting temporarily if required within the Domain Configuration settings for a particular Domain.

What is being migrated over to my new account in SpamTitan Skellig?

Allow/block lists, geoblocking settings, pattern filters, link lock settings, domain policies, user policies, and users will all migrate over.

Note that History and Quarantine don't migrate across.

What about content filters?

Any content filters that are set to allow, quarantine etc will be mapped over as 'Pattern Filters'. However, any content filter set up that bypasses frontline testing or redirects to user or relay, won't be mapped over as there is no function within SpamTitan Skellig for this currently.

What if I have exempted IPs from RBL checks?

RBLs are managed by TitanHQ in the new SpamTitan Skellig servers. We can test the IPs to see if they are on the RBLs in Skellig, but be assured any of these will come over in the back end of your account. After a migration, if a sender is on an RBL and you need to bypass the RBL for a certain IP, you will need to open a support ticket

Is there anything else not being migrated?

The SpamTitan Outlook Add-In is not compatible with the new version in its current state.

History and Quarantine data can't be migrated, but you can still access the SpamTitan Private Cloud environment for a period of time after the migration. We will confirm with you when we're ready to stop and terminate the STPC account

Higher level admin tasks and features such as SPF, DKIM, DMARC are also managed by us. If you have any queries around these, please engage with the ST9 Upgrade team.

Granularity on how you set HELO, notifications to admin (virus, banned attachments), exemptions from greylisting, TLD blocking. If you have made adjustments with any of the above, please engage with the ST9 Upgrade team. 

Web Authentication via LDAP is not present in SpamTitan Skellig.

Ability to view active mail queues is not present in the new environment 

Why are the IPs changing? 

We are updating you to our latest version of SpamTitan, SpamTitan Skellig and it requires us to move you to new servers. 

  

What will happen to my configurations? 

Your configurations will be moved to the new server, not needing you to make changes.  

  

What will happen to my quarantine items? 

The old servers will be left running for the defined quarantine period on your server to allow quarantine to expire. 

If you need to access the quarantine, please access your old server. 


Your users might receive 2 reports on the first day after migration as there might be a quarantined item in both servers, pre and post migration. If you have set 'new items since last report' as the content, this will stop on second day after migration.


If you have set reports to run with 'all items in quarantine' your users may receive 2 reports. One report will come from the older instance, and one from the new Skellig environment. We would recommend going through the quarantine prior to a migration and releasing/deleting mail and/or turning off reports for that domain, if you wish for users to not receive two reports.


As of 17/4/24, we are stopping quarantine reports generating from the SpamTitan Private Cloud 2 days post-migration. This is aligning from feedback we have received during the project. If you wish, your users can still access the old quarantine via the old URL for SpamTitan Private Cloud.   

 

What has changed in Skellig? 

We have revised the levels of access in the environment. This is explained further here: https://support.titanhq.com/en/56985-welcome-to-spamtitan-.html 

 

How will I log in? 

In the new Skellig environment, your ‘admin’ credential will become st_admin@yourdomain and the password will remain the same.


For administrators who were using their main alias as both a Global Admin and User log in, your Global Admin log in will now be alias+admin@domain. EG johndoe+admin@domain.


There will be a new URL to access the new UI provided by the team pre-migration.

 

If you have admins that historically administrate multiple domains, there is a different logic within the new environment for each Domain Group/Customer and Domain. For example, if your login was johndoe@acme.com and you were a 'Domain Group Admin' for Company A, your admin access will now be johndoe+companya@acme.com. For users who were 'Domain Admins' on v8 the Domain Admin on v9 will be johndoe+domain@acme.com. This will allow you to directly access that domain. This aligns with the new layers within Skellig explained here https://support.titanhq.com/en/56985-welcome-to-spamtitan-.html. 


As the system is inherently multi-tenanted and much easier to navigate to a particular Customer or Domain, the ability to define roles which was present in v8 is not necessitated in v9.

 

When will the Private Cloud server be powered down? 

We are using the set quarantine expiry period as the criterion here. 

Once we are satisfied that access is no longer required, we will communicate with you and power down the Private Cloud server. 

 

What is better about Skellig? 

We have enhanced the user experience with a brand new UI, making it easier to navigate and admin. 

It also sees us introduce a new anti-spam engine with exceptional catch rates.


UPDATE April 2024

Within domain policy and user policy, you can now hard block marketing emails.

Multi release/delete in Quarantine.

We're continuously striving to improve all aspects of the product, so you will see a lot of improvements throughout the year.

  

Will I still receive quarantine reports? 

Yes. After the change and while the old infrastructure is active, you may receive two quarantine reports the day after a migration if you have items in the old infrastructure that have not expired and are dependent on quarantine settings. We turn of quarantine reports from the Private Cloud 2 days after the migration 

 

Further information regarding quarantine reports:

Quarantine reports generate once per day in the middle of the night (approx. 12am to 6am) based on your location in relation to server location.

Quarantine Reports will carry the SpamTitan logo.

Alias unification is not possible within the new SpamTitan Skellig just yet, so every unique alias will potentially receive a quarantine report if an item has been quarantined.

  

Will my and my users login details change? 

No. The configurations are going to be replicated and login details are going to be copied as well. 

  

Do I need to update my MX records? 

Yes. The migration team will provide you with new MX records before the migration. 

What is the quarantine period on Skellig? 
21 days 

Does 2FA carry over?

No, you will have to set up on the new Skellig environment once you’re migrated

Why are e-mails appearing in junk folder after migration?

If your mail server is Office 365, as part of your initial onboarding you would have been provided steps to ensure that mail is not marked as spam and placed in your junk folder. The following steps explains what to do in case this happens. https://support.titanhq.com/en/59681-ensuring-your-email-is-not-marked-as-spam-in-office-365.html



Please click the image below to bring you to a demo of the new SpamTitan Skellig environment


https://www.youtube.com/watch?v=2yWIJE51X4k

 

We will also be conducting webinars, so please keep an eye out for an email with updates on this, as well as on this page.