IBM AH0QXML User Guide - Page 23

Chapter 2. Preventing unwanted e-mail and spam

11

Educating users about how to avoid giving their addresses to potential spam

sources will help reduce the amount of spam that comes through your systems.

Have a mail policy

Have a mail policy that includes the sending of spam. While you are working very

hard to stop spam from arriving, it's good to make sure that none of your users is

a source of this type of mail. Make sure that users know what the rules are with

e-mail and what constitutes productive use of e-mail in your environment. In

some environments, inboxes are cluttered with jokes and other non-work related

e-mail. If jokes are important to your organization, consider creating a discussion

database for these types of messages; it can help to reduce the clutter.

Also consider using a discussion database or custom database for internal

classified ads. Some users can find the ads and the subsequent threads that can

follow the ads distracting in their inbox. If users want to be notified, you can use

an agent that sends a daily summary of the new items that are in the database.

Users should never respond to spam

People that send spam are looking for a response. Advise your users of this and

what the costs of spam are. Chances are, they are aware of it and dislike it as

much as you do

—

but make sure that they know never to purchase anything from

an unsolicited e-mail. A key reason that spam is a problem is that people

continue to respond to it; if there were no buyers there would be no sellers. Make

sure that your users are not adding to the problem by responding to the e-mail at

all. This includes the

“

opt out

”

links that are often just used to verify whether or

not a valid address has been found.

Ensure that your users understand that many unsolicited e-mail offers are

hoaxes or confidence tricks. Some examples to note are the

“

Nigerian bank

transfer

”

scam, and the

“

Timmy is trapped in the well

”

hoax. Explain to your users

that if an offer or e-mail seems too good to be true, it's probably spam. And many

“

cries for help

”

or

“

secret recipes

”

are just scams to try and create e-mail chaos

and generate more spam.

How to communicate with users about spam

Probably the best way to find out how spam impacts your users is to conduct a

survey. Combine a survey with an information campaign: inform users about

what spam is and how to avoid it while finding out whether it is a problem for

them or not. Knowing how much of a problem spam is for your users will help you

gauge how aggressive a stance to take on stamping it out.

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 23

Have a mail policy, Users should never respond to spam, How to communicate with users about spam

Page 23 highlights