Home > Microsoft Exchange Tips > Exchange Security Tips > Fighting spam with geographic blacklists
Exchange Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

EXCHANGE SECURITY TIPS

Fighting spam with geographic blacklists


Serdar Yegulalp
04.20.2005
Rating: -2.50- (out of 5)


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


Please let others know how useful this tip is via the rating scale at the end of it. Do you have a useful Exchange or Outlook tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize.


VIEW MEMBER FEEDACK TO THIS TIP

Exchange 2003 natively supports third-party DNS blacklists. However, not all blacklists are created equal. Some of them are constructed for very specific purposes, and if used incorrectly, they can create more problems than they solve.

One potentially interesting new variety of blacklist is a geographic blacklist. (Blackholes.us is one common provider of geographic blacklists.) Geographic blacklists are designed to block everything from a specific country, Internet provider, or top-level domain.

In this case, "geography" doesn't just mean physical geography, but also the geography (maybe "topology" would be a better word) of the Internet itself.

Such blacklists are powerful tools against sudden spam floods. For instance, if a cadre of zombie PCs suddenly begins blasting your organization from Malaysia, you can temporarily blacklist all of Malaysia to free up the bandwidth needed to fight the problem a little more elegantly.

Geographic blacklists have one major drawback: they are indiscriminate. Everything that comes from a particular ISP, country or domain will be blocked, including any potentially legitimate mail.

This hasn't stopped some administrators from using them to create all-encompassing blacklists, though. One common rationale for blacklisting an entire geographic region -- China, for instance -- is that a large percentage of zombie spam is sent from there, and some administrators see little reason why a legitimate e-mail would come from there at all.

This is not a terribly sound policy, since permanently disabling an entire populace from reaching you by e-mail defeats the purpose of e-mail in the first place. As an emergency measure, that may be sound, but as an ongoing policy for how to handle e-mail, it doesn't make a lot of sense.

About the author: Serdar Yegulalp is editor of the Windows 2000 Power Users Newsletter and a regular contributor to SearchExchange.com.


MEMBER FEEDBACK TO THIS TIP

Unlike the author, I think that this approach makes total sense. My company only does business with companies in the U.S. -- ANY e-mail from China, Russia, etc., will certainly not have any business purpose.
—Kevin F.


Do you have comments on this tip? Let us know.
More information from SearchExchange.com:

  • Quiz: In the spammer's lair
  • Chapter Download: Blocking spammers with DNS blacklists
  • Learning Guide: Spam, spyware and viruses
  • Topics Library: Spam prevention and management



    Rate this Tip
    To rate tips, you must be a member of SearchExchange.com.
    Register now to start rating these tips. Log in if you are already a member.




    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Spam and virus protection
    Controlling spam in Exchange 2007 at the edge transport server level
    How file-level antivirus software can harm your Exchange Server
    Problems with email spoofing on SBS 2003
    Exchange Insider e-zine
    Securing your Exchange Server 2007 journaling archives
    Troubleshooting Outlook Web Access issues on a 64-bit system
    Microsoft Exchange Server security dos and don'ts
    Troubleshooting Microsoft Exchange Server Event ID error 6009
    How effective is tracking the IP address of an email hacker?
    How can I configure Exchange IMF to allow an IP address or DNS?
    Spam and virus protection Research

    Exchange Security Tips
    Is full email encryption the solution to Exchange security?
    Lock down direct file access and protect OWA users
    Controlling spam in Exchange 2007 at the edge transport server level
    When to use a self-signed certificate with Exchange Server 2007
    Obtaining and verifying SSL certificates in Exchange Server
    How file-level antivirus software can harm your Exchange Server
    Understanding Exchange Server 2007 SP1 mobile security settings
    Which ActiveSync authentication method is best for your mobile device?
    Why you should secure Exchange 2007 using administrative policies
    Microsoft Exchange Server security dos and don'ts

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    greylist  (SearchExchange.com)
    hash buster  (SearchExchange.com)
    image spam  (SearchExchange.com)
    KnujOn  (SearchExchange.com)
    Sender ID  (SearchExchange.com)
    spam confidence level  (SearchExchange.com)
    spamblock  (SearchExchange.com)
    spim  (SearchExchange.com)
    tarpitting  (SearchExchange.com)
    teergrube  (SearchExchange.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary

    DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.



  • Email Server Solutions: Exchange 2007, Exchange 2003, Exchange 2000, SharePoint
    HomeNewsTopicsITKnowledge ExchangeTipsAsk the ExpertsMultimediaWhite PapersIT Downloads
    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    SEARCH 
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2004 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts