IBM AH0QXML User Guide - Page 36

24

Lotus Domino 6 spam Survival Guide for IBM eServer

content. What is perceived to be offensive to one person may not be to another,

and the amount of time an end user takes to delete this message varies from

user to user. Identifying these spam messages and how you choose to act on

them will vary from customer to customer. The features in Domino 6 will help you

fight the battle to eliminate spam from your environment.

3.3.1

Server configuration features

This section introduces the anti-spam features that can be configured on a

Domino 6 server by the Domino administrator. Enabling some or all of these

features will have a performance impact on your Domino server.

Domino 6 has the ability to perform lookups to external sites, to determine if the

connecting host is a known spamming site. This new feature, called

DNS

Blacklist filters

, enables you to specify the name of one or more DNS blacklist

sites (DNSBL) to check the validity of the incoming connection. DNS blacklist

checking consists of utilizing an external source to conduct DNS queries to check

if the inbound SMTP connection is coming from known sources of spam or hosts

that permit third-party, open relaying.

Another new feature is

Verify that Local Domain recipients exist in the Domino

Directory

. This feature verifies that mail received by your SMTP server is actually

intended for a local user in your domain. When enabled, all messages received

via SMTP are looked up based on the value of the RCPT TO field on the

incoming message. If the recipient

’

s address is not a local user, the message is

not accepted and a Non Delivery notification is returned to the sender. This

feature can help prevent messages sent to nonexistent users from accumulating

in MAIL.BOX as dead mail. They are typically spam messages or messages

intended for a user that has left the company.

Inbound connection controls

allow you to specify how the Domino SMTP server

will handle inbound connection requests and which hosts it will allow and deny

connection to this server.

Inbound sender controls

allow you to specify how the Domino SMTP server will

process connections based on the sender address. You can deny and/or allow

messages from specified addresses/domains.

Inbound relay controls

were introduced in Domino Release 5. These options

provide settings to control what servers can use your server as a relay and the

destinations you

’

ll allow mail hosts to relay messages to. Added to the product in

Domino 6 are the

Inbound relay enforcement

options. These features allow you

to further specify how anti-relay checking will occur. You can now enable

anti-relay enforcement to apply to all external hosts, all hosts (internal or

external), or not apply checking at all. You can exclude certain hostnames from

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 36

Server configuration features, Verify that Local Domain recipients exist in the Domino

Page 36 highlights