And this is what the email's recipient will see in the summary of their inbox contents. The individual
user could then decide to set up their own filters in the local client to deal with such tagged emails,
possibly sending it to a separate folder.
Adding X-Spam Information
If an email is determined to be Spam and a forwarding address is configured for dropped emails,
then the administrator has the option to Add TXT Records to the email. A TXT Record is the
information sent back from the DNSBL server when the server thinks the sender is a source of
Spam. This information can be inserted into the header of the email using the X-Spam tagging
convention before it is sent on. The X-Spam fields added are:
•
X-Spam-Flag - This value will always be Yes.
•
X-Spam-Checker-Version - The NetDefendOS version that tagged the email.
•
X-Spam-Status - This will always be DNSBL.
•
X-Spam-Report - A list of DNSBL servers that flagged the email as Spam.
•
X-Spam-TXT-Records - A list of TXT records sent by the DNSBL servers that identified the
email as Spam.
•
X-Spam_Sender-IP - IP address used by the email sender.
These fields can be referred to in filtering rules set up by the administrator in mail server software.
Allowing for Failed DNSBL Servers
If a query to a DNSBL server times out then NetDefendOS will consider that the query has failed
and the weight given to that server will be automatically subtracted from both the Spam and Drop
thresholds for the scoring calculation done for that email.
If enough DNSBL servers do not respond then this subtraction could mean that the threshold values
become negative. Since the scoring calculation will always produce a value of zero or greater
(servers cannot have negative weights) then all email will be allowed through if both the Spam and
Drop thresholds become negative.
A log message is generated whenever a configured DNSBL server does not respond within the
required time. This is done only once at the beginning of a consecutive sequence of response
failures from a single server to avoid unnecessarily repeating the message.
Verifying the Sender Email
As part of the Anti-Spam module, the option exists to check for a mismatch of the "From" address
in the SMTP protocol command with the actual email header "From" address. Spammers can
deliberately make these different to get email past filters so this feature provides an extra check on
email integrity.
If a mismatch is detected, one of two actions can be configured:
•
The email is dropped.
•
Allow the email to pass but tag it using the configured spam tag.
When sender address verification is enabled, there is an additional option to only compare the
domain names in the "From" addresses.
6.2.5. The SMTP ALG
Chapter 6. Security Mechanisms
265
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
