IBM AH0QXML User Guide - Page 27

Chapter 2. Preventing unwanted e-mail and spam

15

2.2.5

Managing the ongoing anti-spam campaign

Due to the nature of spam, there is no single configuration setting or secret

notes.ini variable to toggle to have all spam delivery rejected. This is due to the

constant change in the spam content, addresses, and the spammers

themselves. The most effective way to keep your anti-spam configuration

relevant is to monitor your results periodically and revise your configuration

based on new information.

Determine how much time to allocate

Based on how much of a priority spam prevention is in your organization, and

how much of a problem it is to users, you can decide how much time to assign to

your anti-spam efforts.

If blocking spam is your top priority (this usually results from upper management

receiving some particularly offensive spam) then you should plan to put aside

some time daily or weekly to review how effective your configuration is. You may

want to start out by monitoring your new configuration daily and tweaking the

configuration based on the results. After a few days of this you can move to a

weekly analysis. After several smooth weeks you might consider moving to a

biweekly schedule. There are some tasks that you should perform infrequently to

avoid impacting users. These tasks include surveys, user-based rule changes,

and e-mail policy reviews.

How to analyze the effectiveness of your configuration

The daily or weekly tasks should include the following:

±

Review the mail log and see how many rejections you are getting. (You can

use log analysis to filter for

“

rejected.

”

) As these numbers increase your

configuration is becoming more effective. Also scan these rejections for

potential false positives.

±

Scan the mail logs and look for mail with known

“

spam-like qualities

”

getting

through. Things to look for include messages being sent to a large number of

users, subjects such as

“

make money fast

”

, and known spam sender

addresses. You may identify addresses or messages that your rules have

missed.

±

Talk with users that are known to receive large amounts of spam, or analyze

the logs to see whether spam intended for them is being rejected.

±

After reviewing your server rule hits, identify rules that are not being triggered

and consider revising them. For those rules that are being triggered, look for

ways to make them more effective and scan for false positives.

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 27

Managing the ongoing anti-spam campaign, Determine how much time to allocate

Page 27 highlights