Enabling DNS blacklist filters for SMTP connections

After you enable the DNS blacklist filters, you can specify the site or sites the SMTP task uses to determine if a connecting host is a "known" open relay or spam source. Specify sites that support IP-based DNS blacklist queries.

If Domino® finds a match for a connecting host in one of the blacklists, it does not continue checking the lists for the other configured sites.

For performance reasons, it is best to limit the number of sites because Domino® performs a DNS lookup to each site for each connection.

You can choose from a number of publicly available and private, paid subscription services that maintain DNS blacklists. When using a public blacklist service, Domino® performs DNS queries over the Internet. In some cases, it may take a significant amount of time to resolve DNS queries submitted to an Internet site. If the network latency of DNS queries made over the Internet results in slowed performance, consider contracting with a private service that allows zone transfer, so that Domino® can perform the required DNS lookups to a local host. During a zone transfer, the contents of the DNS zone file at the service provider are copied to a DNS server in the local network.

Each blacklist service uses its own criteria for adding servers to its list. Blacklist sites use automated tests and other methods to confirm whether a suspected server is sending out spam or acting as an open relay. The more restrictive blacklist sites add servers to their list as soon as they fail the automated tests and regardless of whether the server is verified as a source of spam. Other less restrictive sites list a server only if its administrator fails to close the server to third-party relaying after a specified grace period or if the server plays host to known spammers.

By searching the Internet, you can find Internet sites that provide periodic reports on the number of entries in various DNS blacklist services.

You can configure Domino® to take the following actions when it finds a connecting host on one of the blacklists:

• Log only
• Log and tag message
• Log and reject message

In each case, the server records the following information in the Notes® log: the host's IP address and host name (if a reverse DNS lookup can determine this information) and the name of the site that listed the host.

When tagging messages, Domino® adds a special Note item to messages received from hosts found on a blacklist. After Domino® determines that a connecting host is on the blacklist, it adds the Note item, $DNSBLSite, to each message it accepts from the host before depositing the message in MAIL.BOX. The value of a $DNSBLSite item is the blacklist site in which the host was found. Administrators can use the $DNSBLSite note item to provide custom handling of messages received from hosts listed in a blacklist. For example, you can test for the presence of the item through the use of formula language in an agent or view and provide conditional handling of messages that contain the item, such as moving the messages to a special database.

When considering what action to take when Domino® finds a host on the blacklist, choose an action that's consistent with the policies of the DNS blacklist site you use. For instance, if the service you use is very restrictive, its blacklist may include "false positives"; that is, it may blacklist hosts that are not known sources of spam. As a result, if you take the action of rejecting mail from any host found on the blacklist, it could prevent the receipt of important messages.

Use restraint when taking action, particularly if you use the blacklist of a more restrictive site. The action you select applies to each of the specified blacklist sites. That is, you cannot configure Domino® to deny connections for hosts found on one site's list and log the event only for hosts found on another site's list.

The SMTP task maintains statistics that track the total number of connecting hosts that were found on the combined DNSBL of all sites combined, as well as how many were found on the DNSBL of each configured site. Because the statistics are maintained by the SMTP task, they are cumulative for the life of the task only and are lost when the task stops.

You can view the statistics from the Domino® Administrator or by using the SHOW STAT SMTP command from the server console. You can further expand the statistics to learn the number of times a given IP address is found on one of the configured DNSBLs. To collect the expanded information, you set the variable SMTPExpandDNSBLStats in the NOTES.INI file on the server. Because of the large numbers generated by the expanded set of statistics, Domino® does not record the expanded statistics by default.

Make sure you already have a Configuration Settings document for the server(s) to be configured.