IBM AH0QXML User Guide - Page 68

56

Lotus Domino 6 spam Survival Guide for IBM eServer

You may find that you have certain hosts that are allowed to relay off this Domino

server. You could then add these hosts (name or IP address) to the

“

Allow

messages only from the following internet hosts to be sent to external internet

domains

”

field. Only hosts that are explicitly added to the Allow field will be able

to use this server as a relay.

Internal hosts (those within the same Internet domain) are exempt from relay

checking by default. Any host determined to be part of your local internet domain

will be allowed to relay off this Domino server, regardless of the setting

described.

In Domino Release 5, in order to restrict internal as well as external hosts from

relaying, you would need to set the notes.ini variable

SMTPAllHostsExternal=1

.

This variable treated all connecting hosts as external hosts and all hosts were

subject to relay checking. This allowed Administrators to close down the relay

capability within Domino for all hosts, including internal hosts. If it was

determined that an internal host needed to relay though the Domino server, this

host could be placed in the

“

Allow messages only from the following internet

domain to be routed to external internet domains

”

field.

Conflicts between the destination and source restrictions

Domino 6 handles the conflict that can occur between the destination and source

fields differently than R5 did. In Lotus Domino 5, Deny entries took precedence

over Allow entries; in Lotus Domino 6, Allow entries take precedence over Deny

entries.

For example, let

’

s say that you allow relays from the following host and deny them

to the following domain:

Allow from hosts: 9.95.91.51

Deny to domains:

yahoo.com

On a Domino 5 server, because the Deny entry takes precedence, the named

host, 9.95.91.51, cannot relay to denied destinations. In the example, the

Domino 5 server cannot relay to any address in the yahoo.com domain.

On a Domino 6 server, in the event of a conflict between entries, Allow entries

take precedence. By giving a specific host

“

Allow

”

access, you allow that host to

relay to any destination. In the example, the host 9.95.91.51 can relay to the

yahoo.com domain even though the domain is explicitly denied as a relay

destination.

Similarly, the following configuration denies relays from a specified host and

allows them to a specified domain:

Deny from hosts:

myhost.iris.com

Allow to domains:

hotmail.com

Section	Page
Front cover	1
Contents	5
Notices	7
Trademarks	8
Preface	9
The team that wrote this redbook	9
Become a published author	11
Comments welcome	12
Chapter 1. Introduction	13
1.1 Definition of spam	14
1.2 Categorizing spam	14
Chapter 2. Preventing unwanted e-mail and spam	19
2.1 Spam avoidance techniques	20
2.1.1 Passive harvesting attacks	20
2.1.2 Avoiding harvesting	21
2.1.3 Confusing the harvesters	22
2.1.4 Inform Users	22
2.2 How to block spam	24
2.2.1 At the gateway	25
2.2.2 At the server	25
2.2.3 By the end user	26
2.2.4 Selecting the best approach	26
2.2.5 Managing the ongoing anti-spam campaign	27
2.2.6 Summary	28
Chapter 3. Domino 6 anti-spam architecture	29
3.1 The Domino messaging environment	30
3.2 Domino 6 messaging components	32
3.2.1 SMTP Listener/Server	33
3.2.2 Router	35
3.3 Domino 6 anti-spam configuration	35
3.3.1 Server configuration features	36
3.3.2 User configuration features	37
3.4 Common problems and solutions	37
Chapter 4. Domino 6 Server anti-spam features	41
4.1 How to detect spam	42
4.1.1 Examining the message properties	42
4.1.2 Separating legitimate e-mail from spam based on content	43
4.2 Controlling connections from spammers	44
4.2.1 DNS Blacklist filters	44
4.2.2 Inbound Intended Recipients Controls	48
4.2.3 Disable routing mail to groups	51
4.2.4 Inbound connection controls	53
4.2.5 Inbound sender controls	54
4.3 Controlling delivery of spam	57
4.3.1 Server mail rules	57
4.4 Controlling use of your server as a relay	66
4.4.1 Inbound relay controls	66
4.4.2 Inbound relay enforcement	71
4.5 Protecting your Domino server from active address harvesting attacks	74
4.5.1 SMTP harvesting attacks	74
4.5.2 Spam mail bombing	74
4.5.3 Direct SMTP RCPT TO harvesting	74
4.5.4 Defending against active attacks	75
Chapter 5. Using mail file rules to prevent spam	77
5.1 Distinguishing between spam and legitimate e-mail	78
5.2 Mail file rules	80
5.2.1 Setting up mail file rules	80
5.2.2 Developing anti-spam mail file rules	83
5.2.3 Viewing mail rules and the evaluation sequence	89
5.2.4 Monitoring mail file rules	90
Chapter 6. Third party anti-spam products	93
6.1 Anti-spam products for Notes and Domino	94
6.1.1 spamJam for Lotus Notes and Domino	94
6.1.2 SpamEraser for Lotus Notes and Domino 6	97
6.1.3 iQ.Suite	100
6.1.4 ScanMail for Lotus Notes with eManager	101
6.1.5 XM SpamStop	104
6.1.6 Other anti-spam products for Notes and Domino	106
6.2 Anti-spam server and gateway products and services	106
6.2.1 BrightMail Anti-Spam 4.0 from BrightMail, Inc.	106
6.2.2 ActiveState PureMessage	107
6.2.3 Trend Micro Inc. products	109
6.2.4 Other anti-spam server or gateway products and services	110
Related publications	111
IBM Redbooks	111
Referenced Web sites	111
How to get IBM Redbooks	112
IBM Redbooks collections	112
Index	113

IBM AH0QXML User Guide - Page 68

Conflicts between the destination and source restrictions

Page 68 highlights