IBM AH0QXML User Guide - Page 25

Chapter 2. Preventing unwanted e-mail and spam

13

blocking techniques if you are looking to take an aggressive approach against

spam.

2.2.1

At the gateway

It is possible to subscribe to third party services or purchase network devices that

aim to stop spam even before your mail server receives it. These services often

act as a mail relay, and screen incoming mail for content or origin. Many ISPs

and other service providers offer this as a service with a cost per megabyte of

spam. Keep in mind that subscribing to these services may require a change to

your mx (DNS mail delivery) records which, if not handled correctly, could cause

a loss of mail during the transition. If you plan to use a third party or gateway

device or service, be sure that you are aware of the technology that is used and

the potential for false positives or friendly mail rejections. The ideal configuration

rejects all spam while allowing all real mail through. Even if your organization

employs some sort of spam gateway, it may also be a good idea to use other

methods of spam rejection.

2.2.2

At the server

Stopping spam at the server and sending a rejection can be a very effective way

of dealing with these messages. There are several configuration areas in Notes

Domino 6 that can be set to help reject spam, both at the SMTP listener level and

at the Domino router level. At the listener, the following options are available in

Domino 6:

±

Inbound Relay Control and Enforcement

±

Inbound Intended Recipient Controls

±

Disabled SMTP Routing to Groups

±

Inbound Connection Controls

±

Inbound Sender Controls

At the router, the server can be configured to deal with spam using server-based

mail rules. These rules can be used to filter out specific recipient addresses or

other specific criteria.

Inbound authorization settings can be used to reject known spam originators or

known open relays. Open relays are servers that are configured to allow the

sending of third party messages, including spam. You should always configure

your server to not allow open relaying of mail to help fight spam. New in Notes

Domino 6 are server mail rules and DNS blacklist support. Using server mail

rules you can reject messages based on content (including recipient and

originator.) If your server is configured with DNS blacklist lookups enabled, when

a message arrives an external directory is consulted (much like a DNS lookup)

and if the sender

’

s address is found in the directory, the message is considered

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 25

At the gateway, 2.2.2 At the server, Disabled SMTP Routing to Groups

Page 25 highlights