Badkey Corner | Restricting inbound SMTP connections

Thursday 19th, June 2008

Restricting inbound SMTP connections06/19/2008 09:29 PM

APNIC is one of five Regional Internet Registries currently operating in the world. It provides allocation and registration services which support the operation of the Internet globally. It is a not-for-profit, membership-based organisation whose members include Internet Service Providers, National Internet Registries, and similar organisations. APNIC represents the Asia Pacific region, comprising 56 economies.

APNIC allocates resources in the following ranges within the Asia Pacific region.

Restricting inbound SMTP connections:
Some users and organizations may attempt to send bulk spam mail to your site. You can use Inbound Connection Controls to prevent Domino from accepting unwanted mail and keep your servers from redistributing it.

Complete the following fields on the Router/SMTP - Restrictions and Controls - SMTP Inbound Controls tab in the Configuration Settings document. If you enter an IP address, use brackets -- for example, [205.159.212.144]. You can use an asterisk in an IP address, but only for an entire octet -- for example, [205.159.212.*].

Image:Badkey Corner - Restricting inbound SMTP connections

The following graphic shows an example of how you might fill in these fields:
Image:Badkey Corner - Restricting inbound SMTP connections

Verify sender's domain in DNS: Leave this disabled, this is the 'old' reverse lookup.
Image:Badkey Corner - Restricting inbound SMTP connections

By Chris Linfoot

"First, "Verify connecting hostname in DNS". Leave it disabled!

It is true that enabling it will defeat some spam, but it will also defeat a lot of real email (because too many systems used to send business email still have incorrect or missing DNS). As a corollary to this, it will also accept a lot of spam because so much spam comes from systems that do have well formed DNS but just shouldn't be sending any direct-to-MX email.

"Deny connections from the following SMTP internet hostnames/IP addresses" is an often overlooked feature of D7, distinct as it is from the private blacklist, but is a useful supplement to local and DNS blacklisting.

Why? Because systems blocked by DNS and local blacklists will see your custom error response and thus senders will know why they were blocked. In many cases you want them to know - that is why you use the custom error response - but in some cases you just don't want to accept messages and may not want to say why."

Image:Badkey Corner - Restricting inbound SMTP connections

By Chris Linfoot

"First, "Verify sender's domain in DNS". Turn it on.

This just ensures that inbound mail comes from an envelope sender that can actually accept replies and not something completely bogus. Real senders always want to accept replies. Spammers often do not and may spoof a completely invalid address. Thus the risk of false positives is nil but this will keep out a small amount of spam and some malware."

as a Private Domain fliter:
Image:Badkey Corner - Restricting inbound SMTP connections

Mail from the domain:
host smtp.badkey.com[XXX.XXX.XXX.XXX] said: 554
Your email was not delivered because the host which attempted delivery, is listed in Badkey private DNS blacklist filter.
Please see http://www.badkey.com for more information and assistance. (in reply to MAIL FROM command)

More @ibm.com/developerworks and IBM Redbook: Lotus Domino 6 spam Survival Guide for IBM eServer

Note: For information on how to block or accept connections for specific hosts using a NOTES.INI parameter, refer to the document titled " Preventing SMTP Denial of Service Attacks from Specific IP Addresses" (#1105201).

Supporting Information:
Domino is operating in accordance with RFC 821 and RFC 2821. Any attempts to prematurely disconnect the client/sender violates section 4.1.1 of RFC 821, which explicitly states that disconnection should occur only after a QUIT command is issued by the client. For further information, refer to the following:

RFC 821, section 4.1.1
RFC 2821, section 4.5.3.2

Addressing the challenge of responsible Internet resource distribution in the Asia Pacific region.

More @apnic.net

Note just as an example: (Domino ND8)
*.ru
*.ro
*.in
*.br
*.cn
*.jp
*.il
[58.0.0.*]
[59.0.0.*]
[60.0.0.*]
[61.0.0.*]
[112.0.0.*]
[113.0.0.*]
[114.0.0.*]
[115.0.0.*]
[116.0.0.*]
[117.0.0.*]
[118.0.0*]
[119.0.0.*]
[120.0.0.*]
[121.0.0.*]
[122.0.0.*]
[123.0.0.*]
[124.0.0.*]
[125.0.0.*]
[126.0.0.*]
[169.208.0.*]
[202.0.0.*]
[203.0.0.*]
[210.0.0.*]
[211.0.0.*]
[218.0.0.*]
[219.0.0.*]
[220.0.0.*]
[221.0.0.*]
[222.0.0.*]

Technorati: DNSRBL Firewall Lotus Notes SMTP Spam

Welcome to Badkey Corner The Badkey website is a website on security, IBM/Lotus Domino and Linux. The Badkey Corner Team RSS Feed and Curriculum Vitae
	Full Archive CentOS 5.0	Let us know your comment and information on the Badkey.com site