Questions about SPAM filtering and Open Relays
Q.
Blocking inbound messages sounds "pretty radical". What if I'm not sure if I
want to block messages from all of these databases?
A.
WebClean has several configuration options that allow you to configure
InterChange and WebMail to several levels of
protection:
1.
WebClean filter
in “pass through mode” will allow all messages but will still show the
messages in the logs as if they had been blocked. It will also add a field
into the header of the messages in the form of: "Blocked: by database
abc.abcd.org (http://www.abcd.org)". This information comes from the databases
that are defined in WebClean. You can then use your e-mail programs rules to
sort messages that were marked as "blocked:".
2.
You can add,
remove, or deselect any or all of the open relay and spam databases that are
defined. This allows your server to be as aggressive or passive as you decide
toward spammers.
3.
You can add your
own "block" and "allow" lists:
o
Blocked IP
addresses even if not in databases
o
Allowed IP
addresses even if in databases
o
Blocked MAIL
FROM addresses even if not in databases
o
Allowed MAIL
FROM addresses even if in databases
o
Blocked RCPT TO
addresses even if not in databases
o
Allowed RCPT TO
addresses even if in databases
Q. Are these
databases “free” for anyone to use?
A. While many are “free”, at
least for the time being, some require a subscription to use their
information. You will need to check each database that you are interested in
using to get their particular usage information (and to check their particular
rejection criteria).
Q. Can you explain
an open relay and why my messages will be rejected if I'm using one? I mean,
why is an open relay so bad?
A. An "open relay" means that
ANYONE can use your server to send e-mail to ANYONE else. Your server that is
sending the mail is not requiring "authentication" for the users and so open
relay servers are a target for unethical entities to steal services for
sending unsolicited e-mail (SPAM) messages to, sometimes, thousands of
mailboxes. It amounts to theft at several levels. Because this problem has
become so large, many sites are now checking databases of open relays and
refusing to accept mail from them.
Q. What causes it? I'm using InterChange. Is it
vulnerable?
A. A mis-configured mail server
usually causes it. In the case of InterChange, it is most likely caused by an
"alias" list that has things like "*@mydomain.com = *@mydomain.com" or you
have a "Remote Domain" setup to catch messages that are addressed wrong or you
are not requiring SMTP Authentication for users to send out through your
server. In any event, it is one of the easiest ways to get on Internet "server
blacklists".
Q. I have configured Remote E-Mail
Retrieval/Forwarding enabled to Remote forward Mailbox mydomain.com@127.0.0.1=>myaddress@mydomain.com.
I believe we did this so I would get any misaddressed e-mail for my users. I
get several per month. If I disabled this switch would I not cease to be an
open relay?
A. Maybe. Sorry. But as mentioned
above, there are several ways to be configured as an open relay.
Q. Ok. So. How do I fix it?
A. That is one of the reasons we
created WebClean. If you are using InterChange and have "alias" or "Remote
Domain" issues causing the open relay, then this is the only way short of
removing the capability that those features give you. This is the only way
that we know of to close the hole. The good news is that it not only will
close the relay, but it will block inbound SPAM. Many times ALL of the inbound
SPAM.
Q. I understand that WebClean will fix MY
server and close my open relays. What about all of the thousands of open
relays that exist on the Internet?
A. While we would like to fix them
all, the reality is that some of the existing open relay servers are that way
so that "Spammers" can use them to send Unsolicited E-mail to you and the rest
of us. As mentioned above, WebClean will block mail coming from servers listed
in the open relay databases that are defined (or that you define) and also can
be used to check databases of "known SPAM sites".
Q. Do I need
WebClean to do all of this?
A. We highly recommend that you spend
the time to properly configure InterChange so that it is secured or other
sites will start rejecting your messages. WebClean offers a simple solution
with the benefits of closing your open relay, allowing some management options
of alias definitions, and blocking open relays from sending to you. You can
get it from us to stop the problem (and block SPAM for you).
