NDR SPAM and Backscatter
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
NDR SPAM and Backscatter - 30.Sep.2008 6:50:10 PM
|
|
|
LightningTech
Posts: 1
Joined: 30.Sep.2008
Status: offline
|
We are a solutions Provider and have many deployments of MailEssentials. Many of our clients running the aforementioned software on the latest build have been hit badly with NDR SPAM over the last year.
We have read up on it and confirmed settings re: NDR SPAM and backscatter, and Article ID: KBID003322.
“New Sender” filtering is not an option for many of our clients and although GFI does filter about 70% of the “NDR attacks” (into DNS BL and SURBL folders), 30% of 8000 emails coming into a user’s inbox over a 24 hour period doesn’t seem to be effective enough.
It seems as though the pattern is: a few thousand emails will hit a specific user within a 24 hour period, then subside without intervention and GFI filters up to 70-80% of these attacks.
Is there anything that we might be missing here, settings-wise?
Thanks,
Matt
Lightning Technology
|
|
|
|
|
RE: NDR SPAM and Backscatter - 1.Oct.2008 2:16:17 AM
|
|
|
Hotzenwalder
Posts: 5
Joined: 14.Oct.2007
Status: offline
|
In addition to this... what exactly will activiting the Newsenders option do? I can enable it and tag the messages, but this way all mail with a new sender is still delivered to the clients mailbox, spam or not or will blatant spam be filtered out by filters positioned higher in the module order even when it is a new sender?
|
|
|
|
|
RE: NDR SPAM and Backscatter - 2.Oct.2008 5:50:55 PM
|
|
|
JoeKern
Posts: 285
Joined: 28.Apr.2008
Status: offline
|
All,
It is important to know that not all NDR's are created equal. Mail Essentials is designed to scan NDR emails with attachments. It will scan the attachment (the original email) for spam and if it is, it will then look to the New Senders Actions tab to proccess. This is independent if New Senders is enabled or not. I personally would suggest that you delete them if you do not use the New Senders feature. There is no need to worry about real NDR's getting blocked as the orginal email will not be spam.
As for the un-equal NDR's, some companies do not send attachments with their NDR's. They can also have custom ones. In this case it is important to know that we are treating them as normal email now so the filters will apply. I suggest that you find keywords in the Subject and Body of the NDRS and add them. I suggest Undeliverable: and Delivery Failure... and so on. It is also important to point out that some compaines may have what is called a gray list, where new email senders will be given a real email back (not an NDR) to click a link to approve that you are not a spammer. In this case the many emails that come back are not NDR's and are usually very plain and not of the nature that would be blocked by the spam filter. This means that features like the Bayesian Filter can be used to block them.
I hope this clears some things up. I would suggest that if after following these steps, and you are still having issue, that you verify that you have support and contact our support department by filling out this web form.
http://crm.gfi.com/Customizations/SupportIssue/support.aspx?lcode=en
< Message edited by JoeKern -- 2.Oct.2008 5:53:47 PM >
_____________________________
Joe Kern - JKern@gfi.com
Technical Support Representative - GFI Software - www.gfi.com Messaging, Content Security & Network Security Software
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
