Which installation mode should I use?

Active Directory mode

When installed in Active Directory mode, GFI MailSecurity creates email monitoring rules based on the list of users available in Active Directory. This means that the machine running GFI MailSecurity must be "behind" your firewall and must have access to the Active Directory containing all your email users (i.e., the machine must be part of the Active Directory domain). You can install GFI MailSecurity in Active Directory mode directly on your mail server as well as on any other domain machine which is configured as a mail relay server in your domain.

SMTP mode

In SMTP mode, GFI MailSecurity will create email monitoring rules based on the list of email users/addresses available on your mail server. This means that you MUST install GFI MailSecurity in SMTP mode if your machine does not have access to the Active Directory containing all your email users. This includes machines which are not part of your Active Directory domain (i.e., non-domain machines) as well as machines in a DMZ. However you can still install GFI MailSecurity in SMTP mode on your mail server as well as on any other machine which has access to Active Directory containing all (email) users.

NOTE: Both installation modes have the same scanning features and performance. The only difference between Active Directory and SMTP installation mode is the way that GFI MailSecurity accesses/gathers the list of email users for generating its monitoring/scanning rules and notifications.