How to stop NDR Spam?

Overview

Your users are receiving a large number of NDR spam messages. These appear as email bounce backs for messages they never sent.

Solution

To fix the issue, please follow the steps mentioned below:

1. Open the GFI MailEssentials Configuration UI
2. Navigate to Content Filtering > Advanced Content Filtering
3. Create a new rule:
   1. Give it a descriptive name (such as NDR Spam)
   2. Choose Header and Contains as the condition
   3. Enter Return-Path: <> as the value for the rule
   4. Apply the rule for Inbound, Outbound, and Internal
   5. Configure the spam action in the Actions tab as desired
   6. Apply the changes
   7. Ensure that the rule is enabled, by checking the box next to the rule you created and click Enabled selected.
   Note

   Since most legitimate emails have a valid return path, this should prevent the recurrence of such directory harvesting attacks.

4. Repeat the above steps and create another rule by using "R e t u r n - P a t h : < >" as the value
   (Note that this rule has spaces between the characters)
   Note

   It has been observed that sometimes spammers use this technique to circumvent filters. It is recommended to implement this content filtering rule as well, to ensure optimal protection

You can enable Directory Harvesting for additional protection:

1. Navigate to Anti-Spam > Anti-Spam Filters > Directory Harvesting.
2. Select the Enable directory harvesting protection checkbox.
3. Change the configured value for Block if non-existent recipients equal or exceed from 2 to 1.
4. (Optional) Configure Directory Harvesting to operate at the SMTP level:
   1. Navigate to Anti-Spam > Filter Priority.
   2. Open the SMTP Transmission Filtering tab.
   3. Locate Directory Harvesting.
   4. Click on the Switch button so that it reads "Filtering during SMTP transmission".
   5. Click Apply to save settings.
   Note

   If the Directory Harvesting filter is operating in Full Email mode, please check the spam actions under the Actions tab in the Directory Harvesting filter, since the default spam action for the filter is to deliver the email to users' inbox.

5. Make sure that the Microsoft Exchange Recipient Filtering is disabled.

Testing

After applying the steps above, your users should not receive any more NDR spam.

Related Articles

• How to prevent a Reverse NDR Attack
• A user is compromised and receiving a lot of NDR messages
• Example rules for the Advanced Content filtering system