Avoid Domino 4.6 as an SMTP serverIt occurs to me however that I should restate, lest it is not already abundantly clear, that using a Domino 4.6 server as an SMTP server in todays' Internet is not a terribly good idea. In fact I will go further. If you accept my basic premise that the first duty of any responsible administrator, before turning to the important matters of security and abuse prevention, is to ensure that his/her own system itself does no harm, then you should also be aware that using Domino 4.6 itself defeats this aim.
Let me paint a picture for you.
- A high proportion of spam including virtually all of the most pernicious kind comes direct-to-MX from trojaned machines.
- In virtually every case the sender envelope of these messages is spoofed, often using the email address of an innocent third party.
- If your system is closed to relay, or the intended recipient is local and you use a protocol level block to deny the mail, the entire transaction fails at the originating SMTP client and there is no collateral damage.
Unfortunately, Domino 4.6 does not enforce anti relay as a protocol level response (554 relay rejected), but will accept email from anyone, to anyone and decide about relays afterwards. To the casual observer, a Domino 4.6 server may therefore appear to be open to relay even if closed. Consider this scenario:
- Spammer tests Domino 4.6 host for relay. Message is accepted but bounced back to the apparent sender.
- Either the spammer will attempt a spam run through the Domino server, treating it as an open relay
- or the spammer will see that the Domino server can be made to deliver email to third parties by spoofing their address as the sender
In either case, the result will be that spoofed messages are accepted by the Domino 4.6 server and subsequently bounced back to the "sender".
Sure, your users will not see these messages and no reputable relay tester would conclude that your system was open to relay, but the fact remains that you are rebroadcasting abusive messages to innocent parties and there is nothing you can do about it.
Well, there is of course. Upgrade.
Time to be more assertive with those troublesome 4.6 shops that don't want to move...
Category: Domino: Administration
Technorati: Domino: Administration
Unable to post a comment? Please read this for a possible explanation...
- 
