WARNING: None of what follows is supported by anyone. Modifying the design of the Domino Directory is something that you should only do with your eyes wide open to the consequences, so let me spell them out right here and now: creating rules using the hack that I am about to tell you about runs the risk that those rules will be invalid on Domino 7 or greater. It runs some risk of crashing the admin client or the server in Domino 7. If you do this, be absolutely sure to remove all rules that you have created before doing a server upgrade. Back them up, look for an updated version of the hacked code or re-do the hack yourself, and then restore or re-create the rules. Whether you can restore or you will need to re-create the rules will depend on what, if any, changes IBM has made in the rules functionality that might conflict with the way the hack was programmed.

Now that we've got that all out of the way, here's what you need to know:

The hack to the server rules is based on work done by Daniel Koffler to integrate Spam Assassin with Domino. You don't have to use Spam Assassin to take advantage of the technique, however, because Chris Linfoot took Daniel's technique and extended it in some very interesting ways. Please start by reading Daniel's article, however, because Chris doesn't explain the code, and you need to understand how it works in order to be fully aware of what you are doing to your server.

Now, read this article that Chris published in his blog, in which he explains how Daniel's article inspired him to develop his own hacked rule to detect bogus HELO messages in the SMTP conversation. The result of that post was that rules hacks for checking the HELO message, for checking the $DNSBLSite tag, and for checking some of the other headers for indicators that are often found in spam messages. Next, go here to download a template and read the instructions for modifying the design of your Domino Direcftory. Follow the instructions to take the design elements from the downloaded template and use them to replace the versions that are in your server's names.nsf design.

Now, what you need to do is change your Domino server's configuration to use the log and tag option for DNS Blacklists (as shown above), and then create a rule that looks like this:

(You can skip the bit about exempting yahoo.com or yahoogroups.com. That's in my current configuration to exempt a specific set of messages from a mailing list -- but it will only be there until I find a better way for those particular messages.)

What you are doing is checking the $DNSBLSite field to see if it is not blank. Just select DNS Blacklist in the first control, "Is Not" in the second, leave the third one blank, and click "Add". It looks funny, but it works. Then click on the "Exception" radio button, select "SourceIP" in the first control, "Is" in the second control, enter "206.67.5.170" in the third field, and click "Add" again. Down in the Actions portion of the rule dialog, I specify "Move to database" and I have the rule put all the blacklisted messages into a database that is based on a slightly modified version of the MAIL.BOX template, where I have modified the view to allow me to easily inspect many of the header suspect fields. You can specify "Don't accept message" if you want. I'm collecting the messages not so much out of a fear of false positives as out of an interest in easily measuring the results of blacklist checking -- but obviously this morning's discovery of LNOTES-L messages in the quarantine database makes me glad that I'm not rejecting the messages, as it probably would have taken a day or two for me to notice what I was missing.

After you've implemeted the hacked (or "enhanced" as Chris likes to say) rules, you will need to issue a "set rules" command on the server console to put them into effect.

Finally, you may want to consider checking out the article where Chris lists the rules that he uses himself in his highly successful anti-spam campaign. As long as you're hacking rules, you might as well learn from his experience and implement some very effecfive anti-spam controls. I've been using all of Chris' techiques for a while now. I'll be writing a report in my own blog in a few weeks, after I've had them running long enough to have some meaningful statistics to analyze.

As of this morning, sbl.spamhaus.org is listing the IP address of the server that hosts LNOTES-L. Apparently, the server sits on the same /24 subnet as a known spammer, and Spamhaus has blocked the entire subnet. If you have sbl.spamhaus.org listed in the blacklist configuration for your mail client or server, you will not be receiving messages from the list.

The owner of the IP address has been notified.

If you are using Domino 6, there is a way to exempt a specific server's IP address from blacklisting. It's a hack though, requiring a modification to the design of the Domino Directory. I'll post the details shortly for anyone who is interested. If you aren't willing to try the hack, or if you're not running Domino 6 of if the mail server and/or client you are using don't provide a way to exempt specific IPs from blacklisting, you may have to stop using sbl.spamhaus.org until the problem is resolved. The IP, by the way, is 206.67.5.170.