Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 152 / 861

152 Establishing your network
About the security gateway’s implementation of DNS
Related information
For further information related to this topic, see the following:
■
“DNS Subnet Record Properties—General tab” on page 682
Help to block spam or email forgery by configuring a DNS TXT record
DNS TXT resource records prevent spam or email forgery by informing an email server of verifiable
sender IP addresses. A domain publishes the criteria for legitimate mail sent by it in sender policy
framework (SPF) records served by DNS. SPF records hold information about the servers that are
allowed to send mail from that domain. SMTP receivers can query the sender domain to find out the
list of allowed servers. If the mail is received from a server that is not listed, it is regarded as spam. Use
only one SPF record for each domain.
You can use http://spf.pobox.com/ to help you with the correct syntax for your TXT record.
When specifying the legitimate mail senders for the domain, you should consider what a receiver sees
as the sender for the domain protected by security gateway, such as in the following instances:
■
If you have only a rule allowing traffic from a mail server in an inside network to outside, the traffic
will have security gateway's outside interface address as the source address. In this case, the SPF
record should point to the security gateway’s outside IP address.
This may be not the case if there is an:
■
Address transform, allowing client to see the server’s actual IP address. (Use original source
address, if selected). The SPF record should resolve to the actual mail server address.
■
Address transform with a NAT pool. In this case, the SPF record should resolve to the address
from the NAT pool that is assigned.
■
If you have a cluster, to get failover, use the VIP address for sending and receiving SMTP server
addresses, and have service redirects point to the actual servers.
Note: The security gateway does not use SPF in its antispam protection methods.
Prerequisites
None.
To help block spam or email forgery by configuring a DNS TXT record
1 In the SGMI, in the left pane, under Assets, click Network .
2 In the right pane, on the DNS tab, click New > DNS TXT Record
3 In the DNS TXT Records Properties dialog, on the General tab, do the following:
4 Click OK.
5 On the Text tab, type the text value of your SPF parameters.
6
Optionally, on the Description tab, type a more detailed description than what you typed in the
Caption text box.
Enable To enable the DNS TXT record, click Enable .
Domain name Type the fully qualified domain name for which you provide mail service.
Accessibility Select Private or Public.
IP Address Optionally, you can type a corresponding IP address for the domain address you typed in the
Domain name field.
Caption Type a brief description of the DNS TXT record here.