IBM AH0QXML User Guide - Page 44

32

Lotus Domino 6 spam Survival Guide for IBM eServer

4.2

Controlling connections from spammers

This section discusses which actions can be taken to control connections from

spammers. The earlier you are able to stop spam messages from entering your

environment, the more benefits you will gain. The features described in this

section aim to stop spam at the Listener task. If you are able to stop spam there,

you often avoid the whole message ever being transmitted over the networks,

which will save network bandwidth and storage. Some of the anti-spam controls

described here consume server system resources; therefore, they may have

performance impacts. If spam is a major problem for your organization, the

benefits of implementing controls here will outweigh the performance costs.

4.2.1

DNS Blacklist filters

DNS Blacklist (DNSBL) filters support allows you to configure the Domino 6

server to query an external DNS Blacklist site to be sure that the mail you are

receiving is from a reputable source.

What is a DNSBL? Well, simply put, it is a list or database containing host names

and IP addresses of known spamming sites or hosts that are susceptible to being

used by a spammer. Hosts that allow relaying, also known as

“

Open Relays,

”

do

not have any security imposed on their systems, allowing any user to send mail

from their systems. These open relays leave their systems open and could be

used by a spammer to flood the Internet with junk mail. Host names and IP

addresses found in DNSBL databases are those of hosts that have failed to pass

certain relay checking requirements, and therefore pose a high probability that

they will be used by a spammer.

The sites that maintain DNSBL databases conduct tests against hosts that are

believed to be open relays. When a host is found to be open, their hostname and

IP address is added to the list until the system passes these relay checks. Often

a host is placed on this list for being an open relay, without the host knowing that

they were left open. If this happens, the owner of the host can work with the

DNSBL site to verify that all open relay capabilities have been closed down.

Note:

For the features described in this section to work effectively, your

Domino SMTP server has to be designated as a direct mail exchange server

(MX server) on the Internet. If you relay messages from an internal SMTP

server to your Domino server, the inbound connection will always be from the

same internal server and the connection checking will always pass. In order

for Inbound Connection controls or DNS Blacklist filters to work, the inbound

connection to your SMTP server must be from an external sending IP address.

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 44

Controlling connections from spammers, 4.2.1 DNS Blacklist filters

Page 44 highlights