22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Table 11-13 Conflict between denied relay destination and allowed relay source<br />

Field Entry Results<br />

Deny messages to be sent to the<br />

following external internet domains:<br />

(* means all)<br />

Allow messages only from the following<br />

internet hosts to be sent to external<br />

internet domains<br />

New for<br />

Domino 6<br />

516 Lotus Security Handbook<br />

qrs.com No relays are allowed to qrs.com, except<br />

relays originating from relay.abc.com, which<br />

is specifically allowed.<br />

relay.abc.com Relay.abc.com can relay to any destination,<br />

including qrs.com, which is a denied<br />

destination.<br />

Note: This behavior differs from that of Domino Release 5, where if you<br />

denied relays to a destination domain, an allowed source host could not relay<br />

to the denied domain, and a denied source could not relay to any destination.<br />

You can revert to the Release 5 behavior by enabling the variable<br />

SMTPRelayAllowHostsandDomains in the NOTES.INI file.<br />

If the same entry is placed in the list of allowed and denied destinations, or the list<br />

of allowed and denied sources, Domino honors the entry in the Deny list. For<br />

example, Domino rejects relays to xyz.com if you configure the relay controls as<br />

shown in Table 11-14.<br />

Table 11-14 Conflict between allowed and denied relay destinations<br />

Field Entry<br />

Allow messages to be sent only to the following<br />

external internet domains<br />

Deny messages to be sent to the following external<br />

internet domains:<br />

xyz.com, abc.com, qrs.com<br />

xyz.com<br />

Blacklist filters<br />

A blacklist or blackhole list is a list of known open relay servers (for example, the<br />

Open Relay Database and the Spamhaus Project). To prevent unsolicited<br />

commercial e-mail (UCE), or spam, from entering your system, you can set up<br />

Domino to check whether incoming SMTP connections originate from servers<br />

listed in one or more DNS blacklists (DNSBLs). DNSBLs are databases,<br />

maintained by special DNSBL servers, that keep a record of Internet SMTP hosts<br />

that are known sources of spam or permit third-party, open relaying.<br />

When DNS blacklist filters are enabled, for each incoming SMTP connection<br />

Domino performs a DNS query against the blacklists at the specified sites. If a<br />

connecting host is found on the list, Domino reports the event in a console<br />

message and in an entry to the Mail Routing Events view of the Notes Log. Both<br />

the console message and log entry provide the host name (if reverse DNS

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!