|
|
|
| SLAC Home | Computing Home | Computing Outages | Help | |
What is Email IP Blocking?
When a computer gets infected by a virus or worm, one of the likely results is that it becomes a spam bot. A spam bot is a computer under the control of cyber criminals which is continually sending out spam emails. In fact, an infected computer can send out hundreds or thousands of messages per hour as part of the spammer's campaign.
Over the past few years the quantity and overall percentage of spam has increased worldwide due to the proliferation of spam bots. No one at SLAC is immune to receiving these spam bot emails. At SLAC, we've implemented various methods to try to keep the spams from getting into your Inbox. On a typical day, 86% of the email received at SLAC are spam, or similarly invalid emails.
Our email gateway software vendor, SophosLabs, strongly recommended we try their IP blocking service as a further step towards combating spam. This is a tool now widely used by many organizations. What they do is take various "DNS real time block lists" (DNSBLs) which are maintained globally by anti-spam organizations and merge them into a list which they maintain in-house. This DNSBL contains thousands of computer IP addresses. These computers are most likely either spam bots, or misconfigured computers which have allowed spammers to abuse them (e.g. open relays). Sophos assures us they have very high confidence in the quality and accuracy of their DNSBL service. The block lists are updated several times a day and systems are automatically removed from it after a period of time. Systems are also removed from their block list once the computer has been reported to them as no longer sending spam. In the rare circumstance in which a non-spamming host is placed on the Sophos block list by mistake, the SLAC Email Administrators have the ability to put that computer on a local Whitelist. This would allow emails to be sent to SLAC from the computer while the issue is worked through with Sophos.
Let's walk through the process of an email arriving at SLAC:
Connection is made from offsite computer to SLAC's incoming mail server
SLAC's mail server determines the offsite computer's IP address
- SLAC's mail server then searches for the computer's IP address in the local copy of the block list
- If it finds it on the list it puts out a message which says something similar to "Your message was rejected due to spam filtering based on the IP address from which it was sent". This message will be sent back to the sender of the email.
- If the IP address is not found on the block list then the message is processed normally. It may still be found to be spam and thrown away if 99% or 100%, or quarantined if 50% to 98%.
Last Updated: 07/22/2010