IBM AH0QXML User Guide - Page 66

54

Lotus Domino 6 spam Survival Guide for IBM eServer

Most of the server rules in the table contain simple evaluations and simple

actions. When creating rules, keep the evaluation conditions simple. Rules will be

executed on messages that meet the criteria specified including Notes messages

sent to another Notes user, not just SMTP messages.

Be aware of the performance implications that could be imposed on your server

when using rules. Rules should be monitored frequently when first implemented.

You may need to refine the conditions or change the action performed on

messages. Using the

“

Move to Database

”

action, you can further examine the

contents of the messages acted upon and refine rules, as needed.

4.4

Controlling use of your server as a relay

Spammers try to distribute their spam messages to as large an audience as

possible, and they try to cover their tracks by any means. One of their methods is

relaying mail through third party servers to disguise the origin of the messages.

The third party server hardly ever has anything to do with the message content.

Your server may end up on a DNS Blacklist through no direct fault of your system.

This can happen if you have a relay open (you allow anyone relaying mail off your

server) and a spammer has used your server for relaying spam messages.

You need to close your relay and control who can relay mail off your server. This

section describes how you can to do it.

4.4.1

Inbound relay controls

Inbound relay controls provide settings to control which servers can use your

server as a relay, and the destinations you

’

ll allow mail hosts to relay messages

to.

The inbound relay controls settings are where relay restrictions for your Domino

SMTP Server are set. When you initially set up your Domino R5 Server, no relay

restrictions are applied. All hosts are allowed to relay off this server and all

destinations will be allowed to be relayed to. Notice that this has been changed in

Domino 6: when you set up you Domino 6 Server, relaying is denied by default.

Using Allow and Deny destination lists, these controls determine the relay

destinations to which a server can or cannot send mail and the sources from

which the server can and cannot accept relays.

The wording of the field names tends to cause confusion in what setting is for

what functionality. There are four fields on the server configuration document

dealing specifically with the inbound relay controls.

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 66

Controlling use of your server as a relay, 4.4.1 Inbound relay controls

Page 66 highlights