I realize that any mail server these days receives tons of spam and that SBSers use employ several methods to cope up with that, but I think that disabling NDRs is not a wise choice. For those who don't know: NDR stands for Non Delivery Report and its simply that email that you get when the mail cannot reach its destination (or when it is delayed). Some people disable them because sometimes an SBS box can be sending 100's of spam-related NDRs which takes server resources and bandwidth. Why not disable NDRs then? Let me explain...
There are 2 types of NDRs that concerns us:
- An external entity sends an email (either accidentally or on purpose) to a non-existent address in your email domain.
- Someone inside your LAN sends an email and Exchange cannot deliver it for some reason.
Evidently, one would like only to disable “type-1” NDRs (more specifically only for those who do it on purpose, i.e. spammers). However, if you disable NDRs in Exchange this will affect
all of them. This means that if you your boss or an external client sends an important email and mistypes the recipient's address they will never get any notification for that. That's not good (at least in my book).
So, what can you do? Use the Recipient Filtering instead (go to Exchange System Manager -> Global Settings -> Message Delivery-> Properties-> Recipient Filtering tab-> Enable "Filter recipients who are not in the Directory"). This way you server will only accept mail destined to valid addresses on your domain, you keep NDRs working and the boss is happy. Also, now it is the responsibility of the sender's mail server to issue NDRs (so people outside your organization will know when they made a mistake).
The disadvantage of doing this is that someone could probe Exchange (some kind of dictionary attack) and get a list of valid email addresses. However, you can minimize this risk thanks to a recent software update for Exchange which adds a delay to anonymous connections. Check out Sean Daniel's blog for the complete info.
Keep tuned! Since SPAM is such a hot topic... I'm planning to blog soon about other things you can do to help reduce it (and a new way to prevent people from forging your domain name to send spam). If you have a suggestion or want me to cover something in particular let me know.
Posted
Oct 27 2004, 05:14 PM
by
Javier