Spambot Detection

Spambot Detection tracks the IP addresses that every SMTP MAIL (return-path) value uses over a given period of time. If the same return-path is used by an inordinate number of different IP addresses in a short time, this could indicate a spambot network. When a spambot is detected, the current connection is immediately dropped and the return-path value is optionally blacklisted for a length of time you specify  You can also optionally blacklist all the known spambot IP addresses for a designated period.

Enable Spambot Detection

Click this box to enabled Spambot detection. It is disabled by default.

Max different IPs allowed during time interval

This is the number of different IP addresses from which a given return-path can connect during the specified time interval.

Time interval (in minutes)

Specify the time interval (in minutes) to use when attempting to detect spambot networks.

White List

Click this button to open the Spambot Detection white list. There you can specify IP addresses, senders, and recipients that are exempt from spambot detection.

 

Blacklist offending return-paths for this many minutes

Use this option if you wish to blacklist detected spambot return-paths. MDaemon will not accept messages with a blacklisted return-path for the designated number of minutes. This option is enabled by default.

Advanced

Click this button to open the Spambot Senders File. It displays the return-paths currently blacklisted and the number of minutes remaining before they will be removed from the blacklist.

Blacklist offending IPs for this many minutes

Use this option if you wish to blacklist detected spambot IP addresses. MDaemon will not accept messages from a blacklisted IP address for the designated number of minutes. This option is disabled by default.

Advanced

Click this button to open the Spambot IP File. It displays the IP addresses currently blacklisted and the number of minutes remaining before they will be removed from the blacklist.

SMTP response (leave blank for default)

Use this option if you wish to customize the SMTP response to spambots attempting to send messages from a blacklisted return-path or IP address. MDaemon will return the SMTP response, "551 5.5.1 <your custom text>", rather than the default response. Leave it blank to use MDaemon's default response.

Do not track connections if they are authenticated

By default MDaemon will not track authenticated sessions for Spambot Detection. Clear this checkbox if you do not wish to exempt authenticated connections.

Do not track connections from trusted IPs

By default Spambot Detection will not tack connections from Trusted IP addresses. Clear this checkbox if you do not wish to exempt Trusted IPs.