IBM AH0QXML - Lotus Domino Messaging, User Manual

Page: 43 / 120

Chapter 4. Domino 6 Server anti-spam features
31
2. Select the document, right-click, and choose Document Properties. The
individual fields are on the left and the value held in each field is on the right.
If you find that Dead mail or Held mail is accumulating in mail.box, determine
whether the messages are for valid users by checking the IntendedRecipient field
for each message.
You can use the value of the Received fields to determine the sending server’s IP
address or hostname. This is normally the last received field in the document.
Received fields are read from bottom up, with the top received field being the one
added by your Domino Server. The received fields also contain the time/date for
each server processing the message. If you are being spammed by a particular
IP address or hostname, you can use this information to place this host in the
Deny connections from this host category.
If you have a large quantity of dead or held messages that appear to be invalid
addresses in your domain, sent from the same domain, you may have been
under a harvesting attack. Check the SMTPOriginator and From: fields to
determine the sender of these messages. Keep in mind, most spam messages
do not contain valid e-mail addresses and it’s likely these headers will be
different.
4.1.2 Separating legitimate e-mail from spam based on content
Often server mail rules are focused on the sources, the addresses and domains
of incoming e-mail. There are some characteristics of spam mail that allow you to
scan or search for items that can help you classify useful e-mail and eliminate
spam e-mail. Some characteristics are easily discernible by simply viewing the
message subject or content. Other characteristics can be identified by viewing
the source information of incoming messages.
To learn more about how to separate e-mail from spam based on the content of
the messages, see 5.1, “Distinguishing between spam and legitimate e-mail” on
page 66.