# Presentation: 547708

## Exchange 2003 andSPAM Fighting

- Emmanuel Ormancey, Rafal Otto
- Internet Services Group
- Department of Information Technology
- CERN

## Agenda

- Exchange 2003 upgrade
- Mail Gateways upgrade
- Spam Fighting Evolution

## Status of the update

- Update of server software started during summer
- ~2000 (15%) users moved to the new servers
- Migration should end this year
- Transparent: users warned by email to close their client during the night

## New Features

- Webmail:
- New interface, display and navigation speed was improved.
- New features, like creating server side filtering rules (useful for IMAP users).
- Mobile features:
- Pocket PC can synchronize directly with server.
- Cached mode:
- Download headers only (useful when slow connection).
- RPC over HTTP:
- Connect from outside CERN, without VPN or ISA Server.
- Using HTTP over SSL, secure connection.

## Agenda

- Exchange 2003 upgrade
- Mail Gateways upgrade
- Spam Fighting Evolution

## Why a new architecture ?

- Spam and virus attacks were dramatically increasing, something had to be done.
- Floods happened more and more often
- Detection of problems must be quick, and raise alarms when manual intervention is needed.
- Old architecture was very complex, any modification could create unexpected side effects.
- Running on old servers, new hardware was needed.
- 	The mail service was running since many years, was modified by many different teams, many different features were added, stores were migrated to MMM, giving this architecture...

## Old architecture

- Listbox4

- Exchange Back Ends

- smtp4 / mint

- smtp3 / smtp

- mail6

- Other Sendmail

- mail3

- Mmm
- (Front Ends)

- Outside Cern

- Users

- mail8

- mail7

- Antivirus

- Antivirus

- mail5

## New architecture

- Listbox4

- Exchange Back Ends

- Other Sendmail

- Outside Cern

- Users

- cernmxlb

**cernmx01 to 06, load balanced**
- Antivirus, Antispam, Antiflood.

- Authenticated

- Trusted host

- Mmm
- (Front Ends)

## Feature Overview

**Feature Overview**

- Reject

- If score too high

- Reject

- Clean mail with Spam header

- Mail from Internet

- Exchange Back-Ends / Other CERN Mail Servers

- Internet / Outside CERN

- Reject

- If 500 mails in 10 minutes

## Technical Overview

- Incoming Mail

**HELO / EHLO**

**MAIL FROM**

**RCPT TO**

**_EOD**

-  Nothing done at this level, Sinks don’t provide information on sender’s IP.

***Command***

***Event Sink action***

- End Of Data

-  If IP is Back-End server, abort checks. **(currently all CERN IPs)**.
-  _IP checks: _
-  Reject if IP is listed in IPBadBoys.
** ****Reject if no Reverse DNS configured for IP.**
-  Reject if domain (given by reverse DNS) if listed in SpamDomains.
-  Reject if IP is currently Flooding.
-  _From (envelope From) checks:_
-  Reject if From listed in Spammers.
-  Reject if no MX configured for From domain.
-  Reject if From is currently Flooding.
-  Reject if no Reverse SMTP Connect.

-  If IP is Back-End server, abort checks.
-  _To checks: _
-  Reject if domain not listed in RelayDomains.
-  Reject if To listed in SpamDests.
-  Reject if To is currently Flooding.

-  If IP is Back-End server, abort checks, log outgoing message.
-  _From (real displayed From) checks:_
-  Reject if From listed in Spammers.
-  Reject if no MX configured for From domain.
-  Reject if From is currently Flooding.
-  Add X-External header if IP not listed in Inside CERN IP.
-  _Send mail to SpamKiller servers:_
-  Write score in Keywords header.
-  If Spam rewrite subject if recipient match configuration.
-  If Spam change recipient if match configuration.

## Benefits

- SMTP Gateways have a 100% uptime, due to load balancing.
- Floods (everyday!) are automatically detected and blocked.
- Automatic generated graphics and mail queues monitoring show quickly any problem.
- Configuration and log files can easily be checked by Helpdesk, if any problem is raised.

## Gateways statistics

- 1 day statistics on SMTP gateways:**CERN receives 84% of Spam (92% on Week Ends)  !****But 81% is rejected.**

- Huge increase of mails rejected due to forbidden attachments, from 15pm to 3am.
**This is a virus attack !**

- Classic day, ‘No Reverse DNS’ reject reason is number one, except when a flood is detected.

## Agenda

- Exchange 2003 upgrade
- Mail Gateways upgrade
- Spam Fighting Evolution

## Current Status

- Content based detection is not worth improving
- Increasing 1% requires lot of work, and may produce false positives.
- Focus on low level Spam Rejection
- Reverse DNS activated on 15th June: increase of Spam rejection from 55% to 85%.
- Reverse SMTP connect rule activated on 6th October.
- Next steps:
- Try and identify new techniques: SPF, SenderID, DomainKeys.
- Try to reject evident Spams, detected by SpamKiller, CERN Content based Spam detection engine.

## Reverse SMTP Connect

- Reverse SMTP Connect process:
- CERN mail gateway receives a mail from _[bob@domain.com](mailto:bob@domain.com)_
- CERN mail gateway will simulate a reply to the _[bob@domain.com](mailto:bob@domain.com)_, by trying to connect to the SMTP server responsible for domain.com (MX):
- If connection succeeds, the mail is accepted.
- If connection fails, mail is rejected with a temporary error, if the remote server has temporary problems, the mail will be resent.
- 25% of mails that we currently accept could be rejected with this rule.
- No false positives detected.

## Future “Standards”

- Solutions being investigated
- SPF (Sender Policy Framework), Unified SPF evolution (main problem of SPF is that it does not support forwarding).
- SenderID: merge of SPF and MS Caller-ID.
- DomainKeys proposed by Yahoo
- Google put this idea into production **TODAY**!
- All these new standards allow to detect mail sender forgery
- They will not block Spam
- A validated check DOES NOT mean it is not a Spam.