Anti-Spam

  • Blacklisting Offenders
  • Using DNS-based blacklisting
  • Prohibiting Unauthorized Relaying
  • Relay Restrictions and Mobile Users
  • Verifying Return-Path Addresses
  • The Internet is flooded with soliciting E-mail messages distributed to millions of E-mail addresses. These messages are known as "spam".

    Spammers fill your user mailboxes with a huge amount of unwanted messages, not only overloading the Internet and your Server resources, but making mail retrieval very slow and difficult for your users.

    In order to distribute their messages to thousands and even millions E-mail addresses, spammers try to use any SMTP mail server on the internet as a relay: they deliver one copy of the message to each mail server requesting that the server then route it to a hundred addresses. This practice not only overloads your Server resources, but it places you at risk to be recognized as a spammer (since messages come from your server).

    The CommuniGate Pro Server has Anti-Spam Options that can help you to deal with "spam". Use your browser to enter the Anti-Spam Settings page.


    Blacklisting Offenders

    Since your SMTP module can accept incoming TCP connections, your server can be used by spammers as a mail relay engine: they can distribute their messages all over the world using your server. They can also send a lot of soliciting messages to your clients. To protect your site from the known spammer sites, you can place the IP addresses of the offending hosts into the Black List.

    When a host with an address that is included in the Black List connects to your server and tries to submit a message via SMTP, it gets an error message from your SMTP module and mail from that host is not accepted.

    Enter the IP addresses of offending hosts in the BlackList field.

    Each line can contain either one address in the form:
    10.34.56.78
    or a range of addresses in the form:
    10.34.50.01-10.34.59.99

    Blacklisted IP Addresses

    A comment can be placed at the end of a line. Use the semicolon (;) symbol to start a comment. A line starting with the semicolon symbol is a comment line.


    Using DNS-based Blacklisting

    It is difficult to keep the Server "blacklist" current. So-called RBL (Realtime Blackhole List) services can be used to check if an IP address is known as a source of spam.

    Some ISPs have their own RBL servers running, but any RBL server known to have a decent blacklist can be used with your SIMS server. Consult with your provider about the best RBL server available.

    To use an RBL server, select the Use Blacklisting DNS option and enter the exact domain name (not  the IP address!) of that server. Now, when the SMTP module accepts a connection from an IP address aaa.bbb.ccc.ddd and this address is not listed in the Blacklisted and Client Hosts lists, the module composes a fictitious domain name ddd.ccc.bbb.aaa.rbl-server-name, where rbl-server-name is the domain name of the RBL server you have specified.

    The SMTP module then tries to "resolve" this name into an IP address. If this operation succeeds and the retrieved IP address is 127.0.0.2, then the aaa.bbb.ccc.ddd address is considered to be blacklisted.

    Blacklisted IP Addresses
    Use Blacklisting DNS:

    Note: this option results in an additional DNS (Domain Name System) operation and thus it can cause delays in processing of incoming connections.


    Prohibiting Unauthorized Relaying

    If your SMTP module can accept incoming TCP connections, your server can be used by spammers as a mail relay engine: they can distribute their messages all over the world using your server. To protect your site from spammers, the system can restrict its relaying functionality.

    Fill the Client Hosts IP Addresses field with the IP addresses on your LAN, as well as IP addresses of other systems that should be allowed to use your server as a mail relay.

    If you are an ISP and your mail server is used as a back-up mail server and/or as a forwarding mail server for your client systems, enter the IP addresses of your client servers, too.

    If you have dial-up users, enter the range of the IP addresses they use into this field.

    Client Hosts IP Addresses

    A comment can be placed at the end of a line. Use the semicolon (;) symbol to start a comment. A line starting with the semicolon symbol is a comment line.

    Now, when a message is received with the SMTP module via TCP/IP, and the sender IP address is not found in the Client Hosts list, the message is marked as being received "from a stranger". If this message should be relayed by your server to some other host on the Internet, and that host is not listed in the list either, the message is rejected.

    As a result, servers and workstations included into the Client Hosts list can use your Server to send (relay) messages to anybody on the Internet, and any message from the Internet can be relayed to any listed address. But any message coming from an unlisted system and directed to some other unlisted system will be rejected. This will prohibit spammers from using your Server as a mail relay.

    Since this functionality can affect your legitimate users if you do not specify their IP addresses correctly, the Relay for Clients Only option is available in the SMTP Service Settings. The "stranger-to-stranger" messages are rejected only if this option is selected.


    Relay Restrictions and Mobile Users

    If some of your users travel a lot, they may use various ISP to connect to the Internet, and as a result they can connect to you Server from various IP addresses. If those users use your Server as an SMTP mail relay to which they submit all outgoing messages, Relay Restrictions will not allow them to send messages when their IP addresses are not listed in the Client Hosts list.

    To avoid this problem, the POP module of the Server remembers all IP addresses used to make successful connections to a user mailbox. For 30 seconds those IP addresses are considered to be Client Host addresses, so mobile users can send mail via your Server right AFTER they have checked their mailboxes.

    The 30 seconds expiration time is used because of the "dynamic IP address" policies of most ISPs: when a user disconnects from the ISP modems, and some other user connects to the Internet via the same ISP, the same IP address can be assigned to the new user: ISP assigns the first available IP address from the pool they have for their dial-up clients.

    Inform your users about the 30 seconds limit. They should compose all their messages off-line, then they should connect to the Internet using any ISP, check their mailbox on your Server, and only then they can send the queued outgoing messages. If they want to reply to some messages they have just retrieved from the mailbox on your Server, they should use the Get Mail command in their mailer application again, and only then they can send their replies.


    Verifying Return-Path Addresses

    If your SMTP module can accept incoming TCP connections, your server can be used by spammers as a mail relay engine: they can distribute their messages all over the world using your server. To protect your site from spammers, the SMTP module can verify the Return-Path address (specified with the Mail From SMTP command) of incoming messages.

    When the Verify Return-Path option is selected in the SMTP Service Settings, the SMTP module parses the message Return-Path (Mail From) addresses, and the module refuses to receive a message if:

    The SMTP module uses the Server Router after it parses the Mail From address. If that address is an address of a local user, or the address is rerouted with the Server Router, the Mail From address is accepted. This eliminates Domain Name System calls for the addresses "known" to the Server.

    Since addresses routed to ERROR are rejected, you can specify "bad" domains in the Server Router.

    Examples:
    If you do not want to accept mail from any address in the offenderdomain.com domain, put the following line into the Router settings:
    offenderdomain.com = error
    or
    <*@offenderdomain.com> = error
     
    If you do not want to accept mail from all addresses strating with "promo" in the offenderdomain.com domain, put the following line into the Router settings:
    <promo*@offenderdomain.com> = error

    When the Return-Path domain cannot be verified because the Domain Name Server that keeps its records is not available, the module refuses to accept the message, but instead of a "permanent" error code the module returns a "temporary" error code to the sending system. The sending system will try again later.