RNDR attacks. 1

[eod]

Is there anyway to stop non-delivery emails without intervention of that one commerical product from cmsconnect? I've disabled sending notifications but it doesn't seem to do anything to stop it. I watch as they bounce emails back out, fill the queue, etc.

Has anyone had any luck with this?

 

[cmeagan656]

I don't know of any non-commercial way to do it. We use XWall

http://www.dataenter.co.at/products/xwall.htm

as a spam filter and it has the ability block almost anything you want. You can also strip the delivery and read receipt flags from legitimate email before it is delivered to mailbox.

Cheers.

 

[eod]

Actually I just got my hands on a copy of Xwall. Right now everything is setup pretty conservative but I'm interested in whatmethod you used to supress the NDR.

 

[cmeagan656]

In the options, under system, flags, check to remove both the return-receipt-to flag and the DSN success flag.

Also, in options, under spam, verify, check the box to verify if the recipient e-mail address is in the address list and do not accept messages if the address is invalid.

When using this option you must either manually add the e-mail addresses to the address list or use ExchImp.exe to import the e-mail addresses from the GAL ( Global Address List ) of Exchange into the address list.

Note: You need to update the address list in XWall every time you add or delete a e-mail address on your Exchange server.

Don't forget any NDRs related to XWall options that are sent (we send them for things like blocked text, blocked subject, etc. so that our legitimate clients will know why their mail was blocked) will be sent by XWall and won't touch your your Exchange queues as it will be handled before it hits Exchange.

Hope this is of some help.

Cheers.

 

[eod]

Complete and total help. Thank you so much for the detailed information. I've been extremely pleased with xwall's feature set for spam, smtp and general protection.

 

[cmeagan656]

Glad I could help.

If you need any more info let me know. After 8 months we've really fine tuned ours. Over 97% of all spam is getting caught now.

Cheers.

 

[zbnet]

Someone needs to write a FAQ for dealing with Reverse NDR spam attacks in Exchange...