Changes made to RBL handling In MailSite 7 and later, MailSite will automatically drop any hosts listed in any blacklist server (where the lookup smtp hosts in blacklist is enabled) immediately after the connection is established.

Spammers' IP addresses normally find their way on to RBL lists quickly. Mailsite previously would drop a blacklisted IP connection after the 'mail from' command was issued during the SMTP protocol exchange (and the user did not authenticate). This however in some ferocious attacks by spammers led Mailsite to consume a lot of resources. MailSite SMTP would return an error such as:

• 550 5.7.1 This system is configured to reject mail from 127.0.0.1 (Host blacklisted in xxxxx.com)

Where xxxxx.com is the RBL server in question. This error would also be written to the error log flags (protocol command failures) and operation log flags (protocol exchanges) if enabled.

The change implemented now drops the connection at an earlier stage thus consuming less resources. The sender is NOT notified that they are blacklisted, their connection to SMTP is terminated as soon as they try to connect.

If a connection is dropped due to the IP being in an RBL, if you have network connections logging, an entry will be made. The connection termination will otherwise appear silent. The logs will report something similar to:

• ----- SMTPRA log entry made at 09/01/2006 14:27:25 Incoming SMTP call from 10.42.2.106 at 14:27:24. The address 10.42.2.106 () was found in the Realtime Black List. Incoming SMTP call from 10.42.2.106 aborted at 14:27:25 as RBL detected with unauthenticated host.

This reduces the burden on the network/resources, however it does not provide any kind of diagnostic notification to the sender. If you are experiencing a large number of DOS attacks, then this behaviour is better suited for you.

There are now two options available to customers when handling RBL listed host addresses, to implement this new behaviour or to retain the original behaviour.

Default Behaviour

The default behaviour is to drop the connection immediately if found on a blacklist.

Original Behaviour

Can be reset by the steps below.

Registry Connector

• Open the registry editor and navigate to HKLM\System\CurrentControlSet\Services\SMTPRA\Parameters
• Add a New Dword with name - ActOnRBLImmediately
• Set the value to the following.
• Set Value to 0 (this will change the behaviour to wait to see if the host is going to authenticate) [the original behaviour]

NB: Set the value to 1 (to perform RBL check early in the processing cycle) [the new default behaviour]

SQL Server Connector

Set the following values in the MailServerProperties table.

• ServiceName = smtpra
• PropertyName = ActOnRBLImmediately
• ServerRoleID = 0(dependant on your system configuration)
• ProperType = 4
• PropIntValue = 0
• PropStringValue = NULL