Symantec 10490452 Administration Guide - Page 94

94 Configuring email filtering Managing Email Firewall policies lists maintained by Symantec. Sender authentication provides a way to block forged email. Configuring attack recognition Symantec Mail Security for SMTP can detect the following types of attacks originating from a single SMTP server (IP address). Directory harvest attacks Spam attack Virus attack Spammers employ directory harvest attacks to find valid email addresses at the target site. A directory harvest attack works by sending a large quantity of possible email addresses to a site. An unprotected mail server will simply reject messages sent to invalid addresses, so spammers can tell which email addresses are valid by checking the rejected messages against the original list. By default, connections received from violating senders are deferred. A specified quantity of spam messages has been received from a particular IP address. By default, connections received from violating senders are deferred. A specified quantity of infected messages has been received from a particular IP address. By default, connections received from violating senders are deferred. Enable, disable, and configure attack recognition Set up attack recognition as described in the following sections. All attack recognition types are disabled by default, and must be enabled to be activated. To enable or disable attack recognition 1 In the Control Center, click Policies > Attacks. 2 Check the box next to each attack type that you want to enable or disable, or check the box next to Attacks to select all attack types. 3 Click Enable to enable the checked attack types, or click Disable to disable the checked attack types. To configure directory harvest, spam, and virus attack recognition 1 In the Control Center, click Policies > Attacks. 2 Click Directory Harvest Attack, Spam Attack, or Virus Attack.