IBM AH0QXML User Guide - Page 42

30

Lotus Domino 6 spam Survival Guide for IBM eServer

4.1

How to detect spam

As the Administrator, you will be tasked with determining what messages are

spam. Working closely with your end users, you will get a good idea of the

messages reaching the users

’

mail files.

But what about the messages that never make it to a user and wind up as,

depending on the configuration of your system, DEAD or HELD mail in mail.box?

Dead messages are messages that cannot route to the intended recipient and

cannot route back to the sender. Held messages are undelivered messages held

in mail.box instead of returning them to the sender. Often times, the address of

the sender appears to contain a valid Internet address and the same with the

name if the intended recipient. Viewing document properties, you can obtain

valuable information about each specific message. Each message contains

pertinent information about the sender, the intended recipient, the contents of the

message and the hosts that routed this message. Using the information found in

certain fields you can implement intended inbound recipient controls or even

deny connections from certain hostnames or IP addresses.

4.1.1

Examining the message properties

By analyzing the properties of a message and reviewing several key fields, you

can determine who the sender is, what servers processed this message, and

who the intended recipient is. The fields to examine are:

±

From:

This is the address of the From: RFC822 header, if there was one

added to the message. The From: address is often different than the

SMTPOriginator on spam messages.

±

SMTPOriginator:

This is the address of the sender; it is built from the value

of the MAIL FROM:

±

IntendedRecipient

: This is who the message was originally sent to; often

times the address is invalid.

±

Recipients:

This is the address of whomever the message should be routed

to.

±

Received:

This header contains routing information and the names/IP

addresses of the SMTP servers that processed this message. All SMTP

servers that process this message are required to place a received header on

the message. It

’

s not unusual to have a message that contains multiple

received headers.

To get the document properties of a message:

1.

View the documents in mail.box (or mail1.box, mail2.box, and so forth).

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 42

How to detect spam, 4.1.1 Examining the message properties

Page 42 highlights