Administrator's Guide - Kerio Software Archive

Chapter 16 Antispam control of the SMTP serverKerio MailServer uses two SMTP connection errors to recognize spam servers. These errors occurwhile establishing SMTP connection. The server that initializes the SMTP communicationshould according to the corresponding RFC wait for the reply for at least 5 minutes. Applicationsthat send spam automatically do not wait for that long since they need to send emailmessages as fast as possible to send as many spam messages as they can. It would hold theseapplications too much to keep waiting the whole period. Therefore, spammer servers behavein one of the following two predictable ways if Kerio MailServer does not answer to the SMTPgreeting for a certain period (i.e. delay is set for answers). In one case, the spammer servergives up the connection to Kerio MailServer and tries elsewhere. In the other case, it startsto send email to Kerio MailServer immediately, without receiving the SMTP greeting (in sucha case, Kerio MailServer interrupts the connection immediately).Benefits of the SMTP delay are as follows:1. Reception of spam by Kerio MailServer is eliminated by 60 — 70 per cent. This alsodecreases the load on the server since spam testing is very demanding.2. The method has no so called false positives as there is no influence to the email which isdelivered legitimately. SettingsSMTP delay settingsYou can set either the SMTP greeting delay in the Spam repellent tab of Kerio MailServer (Configuration→ Content filtering → Spam filter):Figure 16.10Spam repellentDelay SMTP greeting byUse this option to set the SMTP delay. The optimal delay value is between 25 and 30seconds. Shorter delay might not be enough (the spam sending applications use 10-20sec), longer time would impede the communication.188