Email Reputation Services Standard

1. Under SMTP Server/DNS Blacklists, You'll need to have 15 entries for all 15 Response codes ranging from 127.1.0.1 through 127.1.0.15
   • Name Hostname
   • Response MAPS activationcode.r.mail-abuse.com 127.1.0.1
   • Denial Message. Please see http://www.mail-abuse.com/cgi-bin/lookup

1. On DNS Black Lists (DNS-BL) screen, select 'DNS-BL options' tab
2. Check 'Enable DNS-BL engine"
3. Check 'Block email from servers which have been blacklisted'
4. Click 'Apply' Select 'DNS-BL Hosts' tab

5. Click 'Add'
6. Check 'Stop host lookups on the first host match'
7. Check 'Send Message" on match rather than "User unknown"' and click 'Apply'

1. In Policies Properties, Under the Security Tab, Check the box "Look up SMTP hosts in unsolicited mail database"
2. For "Web site:" enter activationcode.r.mail-abuse.com
3. Check the box "Record rejected host in Event Log" if you want it to log the rejections. This is the MailSweeper Event Log, not the Windows Event Log
   

1. Edit your /usr/exim/configure file. (Yours may be in a different location) Look to see if you have a dnslists section already. You'll need to enter the following information:

2. Make sure the deny line is one really long line. Then stop and restart exim.

1. Under the Spam Filter>DNBSBL & ORDBL section,
   Click Create New.
2. For 'RBL Server'name enter: activationcode.r.mail-abuse.com
3. Select the 'Action' you want to use and select 'Enable' and then click 'OK'

1. You will need to setup 15 response codes for our RBL+ service:
   • 127.1.0.1 through 127.1.0.15
   • For 'RBL Server' enter activationcode.r.mail-abuse.com
   • Set 'Action' to 'Fail'
   • For 'IP Response' enter 127.1.0.1 Be sure to setup all 15 entries.

1. Under Configuration>GWAVA Manager>RBL lists please do the following
   • Check the box for 'Enable RBL lookup'
   • Click 'Add' and enter activationcode.r.mail-abuse.com

1. You need to configure the RBL checking in 2 places, under the main server configuration and the host connection filtering. For more information click here.
2. Main Server Configuration: Configure DNS Black Lists by following the steps given below. (For more information click here )
   • Getting to the DNS Black Lists tab

• Click Add to open the Add DNS BlackList dialog box.
• Enter the requested information in the Add DNS BlackList dialog box

• Click 'Apply' to save the Server black list information.
• Select the Trend Micro RBL+ name and click Enabled
• If you would like to log the rejections, click the Logging tab.

3. Now, you must enable Trend Micro RBL+ in the Connection Filtering tab. Follow the steps below to get to the Connection Filtering tab. (For more information click here )

1. Under Spam Filtering, you'll need to Add a new Interet blacklist. Enter the following:
   • 'DNS Suffix' activationcode.r.mail-abuse.com
   • 'Description' Trend Micro RBL+
   • Select 'Block the message'
   • Do not check the box that says "Ask the blacklist DNS servers directly"
   • Click OK

1. Make sure you already have a Configuration Settings document for the server(s) to be configured.
2. From the Domino Administrator, click the Configuration tab and expand the Messaging section.
3. Click Configurations.
4. Select the Configuration Settings document for the mail server or servers where you want to enable DNS blacklist filters, and click Edit Configuration.
5. Click the Router/SMTP>Restrictions and Controls
   >SMTP Inbound Controls tab.
6. Complete the following fields in the DNS Blacklist Filters section, and then click Save & Close
   • DNS Blacklist filters: Enabled
   • DNS Blacklist sites: activationcode.r.mail-abuse.com
   • Desired action: Log and reject message
   • Custom SMTP error response: Blocked by Trend Micro RBL+. Please see http://www.mail-abuse.com/cgi-bin/lookup?ip_address=%s
   • Reload the SMTP task, or update the SMTP configuration to put changes into effect.

1. In Server Admin, select Mail in the Computers & Services pane.
2. Click Settings.
3. Select the Filters tab.
4. Check "Use these junk mail rejection servers."
5. Edit the list of servers by adding the DNS name of an RBL server.
   • Click the Add button to add a server to the list.
   • Click the Remove button to delete the currently selected server from the list.
   • Click the Edit button to change the currently selected server from the list.
   • Enter the domain name of the desired RBL server, such as rbl.example.com

We currently do not have exact instructions on how to configuration this product to utilize Trend Micro Reputation Services. Please refer to your product manual for information on the proper method to configure your MTA to utilize DNSBLs or block lists. Your vendor’s Technical Support organization should also be able to assist you with detailed configuration and set-up options.

We believe you a looking for the Anti-Spam Techniques tab. Under there it looks like Blocked List Services might be what you are looking for. Please insert this string where indicated:
activationcode.r.mail-abuse.com If you have questions regarding setting up the appropriate DNSBL zone, the proper error message to utilize, testing that your configuration is set-up correctly, or need general assistance in accessing the service, please contact the Trend Micro Support Team, by sending an email to nrs_clientsupport@trendmicro.com.

1. Under E-mail (SMTP)>Anti-Spam>Real-time Spam, check there will be a Blackhole Server box.
2. Click Add, then enter activationcode.r.mail-abuse.com

1. Under Global Settings, right click on Message Delivery and Select Properties. Click the Connection Filter tab.
2. Click New to add a new filter Enter the following:

3. Host %0 was blocked using Trend Micro RBL+. Please see http://www.mail-abuse.com/cgi-bin/lookup . Click Return Status Code button
4. Select the top option 'Match Filter Rule to Any Return Code'
5. Click Ok, a warning message will pop up indicating that Connection, Recipient and Sender Filter must manually be enabled on specific SMTP virtual servers as they are not enabled by default.
6. Under Protocols/SMTP/Default SMTP Virtual Server right click and Select Properties. Click on the General tab then Advanced>Edit and check the box to 'Apply Connection Filter' and click 'ok'

1. Under Server Properties, select the Host Validation tab. You'll need to create DNS Blacklist entries:
   • Name: Trend Micro RBL+
   • Domain: activationcode.r.mail-abuse.com
   • Reply message. Some versions have separate boxes for Message Number and Description.

• If yours does not, then enter both in the box.

Module generic/spf_macros spf_macros { }

Validate validate/sieve sieve { connect_phase1 = /opt/ecelerity/etc/rbl.siv }

Place the following in /opt/ecelerity/etc/rbl.siv:

$a = ec_dns_lookup "%{spfv1:ir}.activationcode.r.mail-abuse.com" "a"; if ec_test :matches "${a}" "127.1.0.*" { ec_disconnect 550 "Your host is in the TrendMicro RBL+, please see http://www.mail-abuse.com/cgi-bin/lookup?%{spfv1:i}";
}"; }

This will disconnect the connection right after it is created, in lieu of the SMTP banner. This is ideal for most situations, except for when XCLIENT is used. In those cases, connect_phase1 should be changed to mailfrom_phase1, which will process the script with the XCLIENT address.

Open the GUI and click 'System' and then 'Settings' on the left menus.
Click 'DNS Block List' on the top right menu.
Click 'Add'

For 'ID' enter TrendMicroRBL+
For 'Domain' enter activationcode.r.mail-abuse.com
For 'Has TXT Records' click No. Our DNSBL zones do not have TXT records.
Click 'Save Changes'

Check the box next to 'Enabled'
Check the box next to 'TrendMicroRBL+'
Click 'Save Changes'

Your setup may use different options, but that is a working rblsmtpd -b -r "...." entry. qmail will log rblsmtpd rejections in /var/log/qmail/smtpd/current @400000003fd843f92af91f1c rblsmtpd: xx.xx.xx.xx pid 19122: 553 Please see http://www.mail-abuse.com/cgi-bin/lookup?ip_address=xx.xx.xx.xx

1. On the Sidewinder, go to Service Configuration Tab
2. Click Servers
3. Click Sendmail
4. Click m4 config on external burb (This will bring up a text editor)
5. Locate the following line: FEATURE(`blacklist_recipients')dnl

6. Save and Exit the file
7. Apply the change (that will rebuild the Sendmail config and restart Sendmail)

1. Locate the following line: FEATURE(`blacklist_recipients')dnl
2. Below that, add:
   FEATURE(`dnsbl',`activationcode.r.mail-abuse.com', ` "550 Mail from " $&{client_addr} " blocked using Trend Micro RBL+. Please see http://www.mail-abuse.com/cgi-bin/lookup?ip_address =" $&{client_addr} ')dnl
   Note :Make sure the FEATURE line you enter is one long line when you add it.
3. Rebuild your sendmail.cf and restart sendmail.
4. Save the file.
5. Rebuild the sendmail server with the following command: reconfigure_mail rebuild

1. Here is a working sendmail.mc entry for Trend Micro RBL+ service.

2. Rebuild your sendmail.cf and restart sendmail.

You are looking for the RBL Domain Settings screen.
Click the box to the left of "Enable RBL Domain" to Enable RBL checking.
For "RBL Domain:" enter activationcode.r.mail-abuse.com
Under "RBL Blocked Responses" click "Block ALL Responses"
Click "OK"

NOTE: Some customers have told us that their version of SonicWALL has a 39 character limit and our RBL Domain entry is 48 characters. If your version has this limitation, please contact SonicWALL support to see if they have an update.

SpamAssassin 3.00
http://www.spamassassin.org/

1. Edit /etc/mail/spamassassin/local.cf and add the following:

rewrite_header Subject *SPAM*
skip_rbl_checks 0
required_score 5
header RCVD_IN_TM_RBL_PLUS eval:check_rbl('tmrblplus','activationcode.r.mail-abuse.com.')
describe RCVD_IN_TM_RBL_PLUS Received via Trend Micro RBL+, see http://www.mail-abuse.com/cgi-bin/lookup
score RCVD_IN_TM_RBL_PLUS 5.0

NOTE: Make sure the header, describe and score lines do not have any line breaks.

That will add *SPAM* to the beginning of the subject line when a detection is made.
skip_rbl_checks 0 should be default, but just make sure.
The required_score needs to match the score you set for RCVD_IN_TM_RBL_PLUS

NOTE: Trend Micro RBL+ service does not have TXT records for the error message. Please see the Sun ONE Messaging Server 6.0 Administrator's Guide, December 2003 http://docs-pdf.sun.com/816-6738-10/816-6738-10.pdf There is an example at the bottom of page 420 to specify the error message.Example: Edit your MAPPINGS file and look for the FROM_ACCESS section.NOTE: Make sure there are two spaces at the start of the TCP line.NOTE: Make sure each line is less than 252 characters.FROM_ACCESSTCP|*|25|*.*.*.*|*|SMTP*|*|tcp_local|* $[IMTA_LIB:dns_verify.so,dns_verify,+$4.$3.$2.$1.activationcode.r.mail-abuse.com.+$$N$$X5.5.0|IP$ $$1.$$2.$$3.$$4$ found$ on$ MAPS-RBL$ list+$$CTCP|$$0|25|$$1.$$2.$$3.$$4|$$5|SMTP$$6|$$7|tcp_local|$$8]

Now rebuild and restart the mail service. imsimta cnbuild imsimta restart dispatcher For more information on configuring Sun ONE Messaging Server, see http://docs-pdf.sun.com/816-6738-10/816-6738-10.pdf

1. Open the E-Mail Filter Monitor.
2. Click the Server Configuration icon on the toolbar.
3. Click the SMTP tab.
4. Click the Enable RBL DNS Lookup check box.
5. Highlight Anti Spam Servers (RBL) and enter the domain name of an RBL. Enter: activationcode.r.mail-abuse.com

1. Under Filtering/Mailhost Filtering there is a Mailhosts List box. Click 'RBL Servers' to see the current Filter Lists.
2. Below that, click 'Add'.
3. Enter activationcode.r.mail-abuse.com for the domain name of the RBL server and 'Save' it. Make sure the Filter is set to 'Enabled' Action: can be Skip/Purge/Identify (tag subject line)
4. Select 'Purge' to have it delete all email detected in Trend Micro service.

1. Under Blocking Policy/Anti-Spam click the small box on the left of DNSBL domain name and enter: activationcode.r.mail-abuse.com
2. Do not check the box "Identify spam by return codes", which appears under the domain name. That will block everything detected in Trend Micro service. Below that, select Drop message

Symantec Mail Security 4.5 for Microsoft Exchange

To block by real-time blacklists

1. Do one of the following:
. Open Symantec Mail Security for the single server.
. In the Symantec Mail Security for Microsoft Exchange console, in the left pane, select a server group.

2. In the left pane, expand Configuration.
3. Click Spam Prevention Settings.
4. In the right pane, under Real-time Blacklist Blocking, in the Domains of providers supporting IP-based lookup box, type the domains of the RBL providers. Separate domains with commas with no spaces between entries. RBL providers are queried in the order in which you list them. The first RBL provider to return a match during an SMTP connection results in the message being rejected, and no other RBL providers are queried.

Enter: activationcode.r.mail-abuse.com

5. Click Save.

Symantec Mail Security 5.0.3.360 for Microsoft Exchange did not work at this writing. You will need to download a patch from Symantec, but it is not available yet, 7/26/2006.

Follow the steps below to configure your Tumbleweed Enterprise Mail Firewall to use Trend Micro Network Reputation Services.

Login to the web manager Click "Setup" in the lower portion of the left pane Click "Relays" Scroll to DNSBL settings and enter the RBL name and select the action you wish to take if the sender is found on the RBL.

DNSBL Source Domain: activationcode.r.mail-abuse.com Response to Client: Refuse connection with a permanent error response.

Click "Setup" Click "Network Connections" Look for a "DNSBL" entry and check the box to enable it.

1. In the Services Arena, double-click the SMTP Proxy icon. The service Properties dialog box opens.
2. Click the Properties tab.
3. Click Incoming. The Incoming SMTP Proxy dialog box appears displaying the General tab.
4. To check email against RBL servers, select "Use RBLs to determine the email's spam classification." You can now configure the RBL/DNS servers.
5. From the SpamScreen dialog box, click the RBL Lists tab.
6. Click Add and enter: activationcode.r.mail-abuse.com
7. Check the box next to: activationcode.r.mail-abuse.com
8. Click OK

1. Under Options/Spam Tab, check the box to "Enable lookup of the IP address of the connecting host in the Spam Lookup Service database".
2. Below that is the list of Services.
3. Click 'New' and enter: activationcode.r.mail-abuse.com
4. For 'Action', select 'Block message transfer at the SMTP level'
5. Then, click 'Apply'

1. Launch the Administration Client, login and go to Manage | MTA Configuration.
2. Scroll downwards to the Custom configuration field.
3. Enter the Realtime Blackhole List of your choosing. For Trend Micro RBL+, you should use the following: