GFI – How to stop backscatter spam using GFI Mail Essentials

If you have GFI Mail Essentials 20 there are 2 steps to make your server secure against backscattering. You have to enable Directory Harvesting anti-spam filter, and you have to change SMTP Transmission Filtering.

Enabling Directory Harvesting is as simple as going into Anti-spam, Anti-spam Filter and Directory Harvesting option. Since our GFI Mail Essentials is installed on Exchange server directly we can use the option Use native Active Directory lookups. We also recommend setting Block if non-existent recipients equal or exceed to 2 addresses.

On second tab, if it's not greyed out you should choose Delete email option. There's no real reason to quarantine the email or keep them in different form anyways. In our case as you can see it's greyed out which basically means we already have next step configured which is making sure the verification of e-mails is done on SMTP Transmission level rather then during Full Email Transmission.

Now go to Anti-spam, Filter Priority and switch tab to SMTP Transmission Filtering. On this tab make sure under Directory Harvesting option it says Filtering during SMTP transmission. If it says something different make sure to press Switch and then Apply. This step is very important. Otherwise even thou Directory Harvesting will work just fine but it will still send emails back to fake senders and cause backscatter.

After this change Directory Harvesting on Filter priority should be on top of the list, and the Filter Level should be SMTP Data.

This way Microsoft Exchange server sends only NDR (Non Delivery Reports) to real senders making sure your server doesn't spam other servers by accident.

Microsoft Exchange allows disabling Delivery Reports which is often used by people to track of their email has been read. While this option doesn't cause backscatter many companies don't wish to send our Delivery Reports so that their users can notify senders if email has arrived on their own agenda. We can do that per domain basis (banning sending Delivery Reports to just one or few customers) or by using global option.

To do that you can simply use below powershell commands to

# Disable delivery reports to yourcompetitor.com domain 
Set-RemoteDomain yourcompetitor.com -DeliveryReportEnabled $false
# Enable delivery reports to yourcompetitor.com domain 
Set-RemoteDomain yourcompetitor.com -DeliveryReportEnabled $false

# Disable delivery reports to all domains
Set-RemoteDomain Default -DeliveryReportEnabled $false
# Enable delivery reports to all domains
Set-RemoteDomain Default -DeliveryReportEnabled $true

Keep in mind it's entirely possible to block NDR or Delivery Reports to all senders and just allow those for few important customers. The proper way to do this would be:

Set-RemoteDomain Default -DeliveryReportEnabled $false -NDREnabled $false
Set-RemoteDomain yourbestcustomer.com -DeliveryReportEnabled $true -NDREnabled $true
Set-RemoteDomain yourothercustomer.com -DeliveryReportEnabled $true -NDREnabled $true
Set-RemoteDomain mycustomer.com -DeliveryReportEnabled $true -NDREnabled $true

If you wish to verify your NDR, DeliveryReports settings you can check them globally by using following PowerShell query

Get-RemoteDomain | ft -AutoSize Name, DomainName, AllowedOOFType, NDREnabled, DeliveryReportEnabled, MeetingForwardNotificationEnabled,AutoReplyEnabled, AutoForwardEnabled, NDRDiagnosticInfoEnabled

Please be aware that NDR's are essential debugging tools. Using NDR's can often give you clues about problems in your system. Below you can find some useful NDR codes.