Message Filtering at UM

1. Message Filtering at UM The good, the bad & the ugly

2. Overview • History • Message flows & filtering points • Common mail flow errors & diagnostics • Efficient Troubleshooting • Tips & Gotchas • Future

3. History • Antigen for anti-virus since 1999 • “ORF” for blocking & stats since 2003 • “IMFTune” for Outlook Junk-mail foldering since 2004 • Custom MS Windows IIS rules since 2003 • “Ironport” appliance supercedes ORF as primary blocking tool – Summer, 2008

4. Inbound Mail Filtering Points

5. Ironport Inbound Filtering

6. Sample Ironport ReportInbound Mail Summary

7. Incoming Mail DetailSorted by Reputation Filtering Blocks

8. Ironport Message Tracking Tools

9. Ironport treatment of “Absolute” & “Suspected” Spam

10. Ironport Internet Header additions“Suspected” Spam

11. Ironport Internet Header additions“Absolutely-positive” Spam

12. Internet header ‘triggers’ to use when writing custom rules • X-IRONPORT-SCORE: YES • X-IRONPORT-SCORE: SUSPECT • X-SBRS: #Value#

13. Exchange Inbound Filtering

14. Antigen for Exchange – ‘Quarantine’ of Viri, Executables & Chain mail

15. IMFTune for Exchange – Junk Mail ‘auto-foldering’

16. ORF for Exchange – Former primary tool, replaced by the Ironports, still used for some functions.

17. Outbound Mail Filtering Points

18. Outbound Traffic – Authentication & anti-virus

19. Outbound Traffic – Authentication

20. Outbound Traffic – Segregated Data Streams

21. Ironport – Outbound traffic assignments

22. Yahoo msg header showing source IP as 209.106.229.47 for mst.edu senders

23. Yahoo msg header showing source IP as 209.106.229.53 for missouri.edu senders

24. *Why* we use multiple outbound streams via different IP addresses & host names

25. Mail flow errors & diagnostics • Mis-foldered mail • Mail not received • Delivery errors

26. Mail flow errors & diagnostics Mis-foldered msgs: Spam in the inbox and/or ‘good mail’ in the Junk Mail Folder Check for the Ironport stamp within the headers X-IRONPORT-SCORE: Check for custom user-created rules. Report if appropriate, be aware of the 0.1 % failure rate of the IMFTune ‘foldering’ engine.

27. Mail delivery failure – Missing Mail This email message is to notify you that your membership to 52-discusswas previously "held" and has now been restored to "normal".This means that you were not receiving mail from '52-discuss'.Your subscription was held because your email address was bouncing alarge amount of mail which was sent to it.Your membership has now been restored to "normal", and the listserver program running '52-discuss' will attempt to send you mail.  Ifyour email address continues to bounce mail, your subscription willonce again be "held".You may want to contact the people responsible for your electronicmail to determine why your email address has been refusing mail.

28. Mail delivery failure – Missing Mail • I’m sorry to have to inform you that your message could not be delivered to one or more recipients.  It’s attached below. • For further assistance, please send mail to postmaster. • If you do so, please include this problem report.  You can delete your own text from the attached return message. •                         The mail system • <RECIPIENT@mst.edu>: host mxnip01.um.umsystem.edu[209.106.229.21] refused to talk to me: 421 #4.4.5 Too many connections from your host.

29. Mail delivery failure – Missing mail Dramatically fewer ‘false-positive’ blocks with the new Ironports But more difficult to resolve. May not be able to track lost mail via sender’s email address alone. ‘Source IP’ of the sending mail system is the key to resolving issues. Check the internet header info of any previously successfully received messages. Have sender forward any error messages to postmaster@SM.missouri.edu , or to recipient via alternative mail system. Be patient, if the sending system is normally ‘clean’, the Ironports will eventually allow the traffic to flow in.

30. Mail delivery failure – RBL blocks • The following recipient(s) cannot be reached: • crcurry@webtv.net on 9/30/2008 1:26 PM • There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. • <um-nsmtpout1.um.umsystem.edu #5.5.0 smtp;556 <um-nsmtpout1.um.umsystem.edu[209.106.228.53]>: Client host rejected: Resource unavailable - listed by external RBL http://info.webtv.net/spam/index.html#209.106.228.53>

31. Mail delivery failure – Connection Dropped – NO *500 series permanent failure errors* • Subject: Delivery Status Notification (Delay) • This is an automatically generated Delivery Status Notification. • THIS IS A WARNING MESSAGE ONLY. • YOU DO NOT NEED TO RESEND YOUR MESSAGE. • Delivery to the following recipients has been delayed. • tdubose84@tampabay.rr.com

32. Mail delivery failure – no such user • Your message did not reach some or all of the intended recipients. • Subject: test • Sent: 9/26/2008 9:05 AM • The following recipient(s) cannot be reached: • usedu@canachieve.com.cn on 9/26/2008 9:05 AM • There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. • <um-tsmtpout1.um.umsystem.edu #5.5.0 smtp;550 user(usedu@canachieve.com.cn) no exist>

33. Mail delivery failure – no such user • did not reach the following recipient(s): • bill.schulze@business.utah.edu on Tue, 7 Oct 2008 21:15:37 -0500 • The e-mail system was unable to deliver the message, but did not • report a specific reason. Check the address and try again. If it still • fails, contact your system administrator. • < mxtip01-mizzou-out.um.umsystem.edu #5.0.0 smtp; 5.1.0 - Unknown • address error 550-'#5.1.0 Address rejected • bill.schulze@business.utah.edu' (delivery attempts: 0)>

34. Mail delivery failure – no such user Troubleshooting: Google the recipient’s last name <space> & domain and/or “specialty” to find new email addresses… @harvard.edu smith smith@ swine genetics DNA mailto:

35. Mail delivery failure – recipient content filter blocks • The following recipient(s) could not be reached: • jonesdb@drexel.edu on 10/14/2008 8:11 AM • The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator. • < smtp.mail.drexel.edu #5.0.0 X-Postfix; host 127.0.0.1[127.0.0.1] said: 550 during .: Error: Message content rejected (in reply to end of DATA command)>

36. Mail delivery failure – recipient content filter blocks • One sentence test msg – to prove mail *can be* delivered • “Divide & Conquer” technique to slip past foreign filters • Cut msg in half – send both halves • If one half fails – divide *it* in half & send again • Repeat as necessary until either the full message is delivered or you can determine the phrase or phrases which has offended the recipient system’s mail filters.

37. Mail delivery failure – recipient content filter blocks *suspected* Hello, I’ve been experiencing problems with my e-mails not going through to people.  I get e-mails from them, but they do not receive mine.  I talked to some other people in my department who say that their e-mail works fine.  Have any ideas of what might be going on? --------- Advise sender to 'enable delivery & read receipts' with their outbound messages. This will tell them whether the messages are being accepted by the remote mail server. If problems continue, have them try very short, one line, test msgs - to see if they get thru. If short test msgs get thru, but not other messages, then odds are strong that her messages are being filtered by the remote system. Last resort = send a note to the postmaster & abuse accounts at the failing domains and ask that they check to see what happened to her messages...

38. Internal Mail Delivery Failure – Deleted Exchange Mailbox This is an automatically generated Delivery Status Notification. THIS IS A WARNING MESSAGE ONLY. YOU DO NOT NEED TO RESEND YOUR MESSAGE. Delivery to the following recipients has been delayed.   IMCEAex-_O=UNIVERSITY+20OF+20MISSOURI_OU=HEALTH+20SCIENCES_CN=RECIPIENTS_CN=5845@missouri.edu

39. Efficient Troubleshooting • Do short, simple test msgs work ? • Have the sender use delivery & read receipts. • Full info, sender, recipient, subject, date & headers, headers, headers… (if available). • Full copy of any error messages. • Abuse & postmaster accounts. • Manual Telnet session test to foreign hosts.

40. Tips & Gotchas • Rename executable attachments. • Don’t encrypt (password protect) .zips. • Don’t let the ‘thread’ run forever… The longer a message the greater chance it will trip a content filter, start new ‘threads’ when appropriate. • Watch your language… ;) • Don’t auto-forward mail ! <grrr> • Compare with OWA. • Compare with other mail clients, other machines, other Exchange profiles.

41. Tips & Gotchas • Phishing & Nigerian Scams Don’t assume your folks couldn’t fall for these…

42. Future Messaging ‘explosion’ as handhelds take off, etc… Content size increases as attachments get even larger. Encryption & authentication becoming ever more important. More security threats, & “better’ scams…