IBM AH0QXML User Guide - Page 35

Chapter 3. Domino 6 anti-spam architecture

23

7.

Originating SMTP server sends the DATA command to initiate the transfer of

the message contents.

8.

Domino SMTP Listener acknowledges start of DATA.

9.

Originating SMTP server sends END OF DATA to indicate data transfer is

complete. Domino SMTP Listener checks any inbound file size restrictions.

Server mail rules are run, but only

“

Don

’

t accept message

”

action is applied

here.

10.Domino SMTP acknowledges END OF DATA and awaits disconnect or next

message. (Note: Steps 3 through 10 are repeated for additional messages.)

11.Originating SMTP server sends QUIT, initiating close session sequence.

12.Domino SMTP acknowledges QUIT and closes connection.

The earlier in this sequence that you can detect and reject a spam message, the

fewer server resources are wasted by the spam.

3.2.2

Router

Once a message has been received by the SMTP Listener, it is analyzed against

the Server mail rules. The Server mail rules are evaluated against any incoming

message as it is placed into the server MAIL.BOX. Server Mail rules are your

second line of defense. Inbound controls can and should be used to block all mail

to or from specific users and domains. The Server mail rules allow more flexibility

and control by allowing you to specify additional conditions to be tested. You can

also specify additional actions to be taken on the message other than just

denying the delivery of it.

If a message passes all testing in the server rules, it is then processed by the

router for forwarding to another Domino server (which might have a different set

of rules), or for placement into an end-user mail file. The mail file rules are

typically established by the end-user of the mail file. Mail file rules are evaluated

for any incoming messages on the server, before delivering the message to the

user

’

s mail file. Every Domino installation is different, and your particular

circumstances will dictate where and how stringently you control incoming spam.

3.3

Domino 6 anti-spam configuration

The best defense against spam is knowing the options available to you as the

administrator. Being able to identify what messages are considered spam, versus

those that were unsolicited, will help in eliminating it. Spam comes in many

forms, from Web hoaxes, chain letters, and unsolicited sales and marketing

material for a product you

’

d never buy, to the most common, offensive adult-rated

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 35

Router, 3.3 Domino 6 anti-spam configuration, Router

Page 35 highlights