IBM AH0QXML User Guide - Page 20

8

Lotus Domino 6 spam Survival Guide for IBM eServer

users to not receive spam is to have them avoid having their e-mail addresses

added to a spammer

’

s list in the first place. We discuss how spammers usually

accumulate these e-mail addresses and how you can help your users protect

theirs.

2.1

Spam avoidance techniques

From a server point of view, the most efficient way to handle spam is not to have

it delivered in the first place. This is why, as a Domino server administrator, it is in

your best interest to help inform your users about how to avoid getting on spam

lists in the first place. If they do this effectively it can save time administering

spam rejection tools.

Most users, when confronted with spam, will not understand why they are getting

it. Some users definitely get more spam than others, though, so we know that

there is some user behavior that correlates to the amount of spam that they will

receive. The best way to understand the behavior to avoid is to look at how most

spammers get e-mail addresses in the first place.

2.1.1

Passive harvesting attacks

In this section we introduce some passive harvesting techniques that spammers

use to obtain e-mail addresses. To learn about how to protect your Domino 6

server from harvesting attacks, see 4.5,

“

Protecting your Domino server from

active address harvesting attacks

”

on page 62.

Web harvesting

Spammer Web robots or

“

bots

”

operate like Web search engine bots, except they

look specifically for [email protected] patterns in the Web page text. When an

e-mail address pattern is found they store it with other e-mail addresses for use

in bulk mailing. You can defend against spammer Web-bots by obfuscating mail

addresses when they are placed on Web pages. The best option for defense is

placing e-mail addresses into graphics. Alternatively, you can hide them inside

javascript, or simply provide human-recognizable alterations to the address that

make it invalid for e-mailing, or make it more difficult for the Web-bot to recognize

any e-mail address pattern.

Usenet harvesting

Spammer news-bots use a concept similar to that used by Web search engine

bots. Spammers can subscribe to any usenet group. Then after downloading

posts from a usenet group, the news-bots look for [email protected] patterns in

posted message content and headers. When an e-mail address pattern is found

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 20

Spam avoidance techniques, 2.1.1 Passive harvesting attacks

Page 20 highlights