McAfee MAP-3300-SWG Product Guide - Page 96

Overview of Email features Email Configuration Table 73 Option definitions (continued) Option When an email has been deferred and is being retried Definition • None - Takes no action. • Deny connection - Adds the sender to the Denied Connections list. • Deny connection and quarantine email - Adds the sender to the Denied Connections list, then forwards the email to a quarantine area. Default value is Deny connection and quarantine email. Response delay When a tarpit action was selected, specifies the delay in responding to this email. Default value is 5 seconds. This is often enough to deter an attack. Maximum number of recipients When a tarpit action was selected, specifies how many recipient addresses each email may have. Default value is 10. Applies a delay if there are too many recipient addresses in the email message. A directory harvesting attack ... Defines this type of attack. Default values are 5 failed recipients and 10% accepted recipients. Email that falls outside this specification is not considered to be an attack, so no action is taken. Bounce Address Tag Validation Use this page to combat backscatter - bounced email that was not originally sent from your organization. Email | Email Configuration | Receiving Email | Bounce Address Tag Validation If an Mail Transfer Agent (MTA) cannot deliver an email message, the MTA returns (or 'bounces') the message to the sender using a return address in the message. Unfortunately, spam email messages often have a forged (or spoofed) return address. The bounced email often goes to an innocent organization. This type of email is known as backscatter. During a spam attack, your organization might receive many such messages. Benefits of using Bounce Address Tag Validation Bounce Address Tag Validation (BATV) enables your organization to ignore any backscatter email message by checking whether your organization was its original sender. The appliance can attach a encrypted digital signature (or tag) to the SMTP MailFrom address on every outgoing email message. When a bounced email arrives, the appliance searches for the digital signature, and rejects any message that has no digital signature or has an invalid digital signature. Such a message cannot be a genuine, bounced email message. For more information about BATV, visit http://mipassoc.org/batv/draft-levine-batv-03.txt. If email is handled by several appliances - for example, one appliance handles outgoing email, while another appliance handles incoming email - all the appliances need information about the signature seeds and signature lifetime. To distribute the information between your appliances, use the import and export features in the interface. 96 McAfee Email and Web Security Appliances 5.6.0 Product Guide