Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Configuring the IP Reputation in InterScan Messaging Security products

    • Updated:
    • 21 Oct 2015
    • Product/Version:
    • InterScan Messaging Security Suite 7.1 Linux
    • InterScan Messaging Security Suite 7.1 Windows
    • InterScan Messaging Security Suite 7.5 Windows
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • Platform:
    • Linux - Red Hat RHEL 4 32-bit
    • Linux - Red Hat RHEL 4 64-bit
    • Linux - Red Hat RHEL 5 32-bit
    • Linux - Red Hat RHEL 5 64-bit
    • Linux - Red Hat RHEL 5.1 32-bit
    • Linux - Red Hat RHEL 5.1 64-bit
    • Linux - Red Hat RHEL 5.2 32-bit
    • Linux - Red Hat RHEL 5.2 64-bit
    • Linux - Red Hat RHEL 5.6 32-bit
    • Linux - Red Hat RHEL 5.6 64-bit
    • Linux - Red Hat RHEL 5.7 32-bit
    • Linux - Red Hat RHEL 5.7 64-bit
    • Linux - Red Hat RHEL 5.8 32-bit
    • Linux - Red Hat RHEL 5.8 64-bit
    • Linux - Red Hat RHEL 6 32-bit
    • Linux - Red Hat RHEL 6 64-bit
    • Linux - Red Hat RHEL 6.1 32-bit
    • Linux - Red Hat RHEL 6.1 64-bit
    • Linux - Red Hat RHEL 6.2 32-bit
    • Linux - Red Hat RHEL 6.2 64-bit
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Server R2
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server R2
    • Windows 2008 Server R2 Enterprise
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
    • Windows 2012 Enterprise
Summary

Modify the IP Reputation settings in InterScan Messaging Security products, such as InterScan Messaging Security Suite (IMSS) and InterScan Messaging Security Virtual Appliance (IMSVA).

Details
Public

To configure IP Reputation:

 
Make sure that you have a valid license or activation code (AC) for IP Filtering Service before doing the procedure.
  1. Log on to InterScan Messaging Security console.
  2. Go to System Status and ensure that the Email reputation check box is ticked.

    System Status

    Click image to enlarge.

  3. Navigate to IP Filtering > Email Reputation and make sure that the Enable Email Reputation check box is marked.

    Email Reputation Settings

    Click image to enlarge.

  4. Select the appropriate Service Level from the following Email Reputation Services (ERS) settings:
    • Standard or Real-Time Blackhole List (RBL+) Service - This setting uses the Standard Reputation database to block the messages from known spam sources.
      This service sends a single DNS query to the RBL+ database, which contains known and documented sources of spam, as well as an extensive list of dynamic IP addresses. If the sender is included in this database, your mail server will return a '550' error or it will reject the connection.

      The Standard IP Reputation database includes the following:

      ListDescription
      Real-time Blackhole List (RBL)A list of IP addresses of mail servers that are known sources of spam.
      Dynamic User List (DUL)A list of dynamically assigned IP addresses, or those with a policy that prohibits public mail servers. Most entries are maintained in cooperation with the ISP owners of the network space. IP addresses in this list do not directly send email but use the mail servers of ISP.
      Relay Spam Stopper (RSS)A list of IP addresses of mail servers that are open mail relays and are known to have sent spam. An open mail relay is a server that accepts a mail which came from any user addressed to any other user on the Internet, thus, making it difficult or impossible to track the spammers.
      Open Proxy Stopper (OPS)A list of IP addresses of open proxy servers that are known to have sent spam. An open proxy server is a server that accepts connections from any user and relays the messages to any server on the Internet.
    • Advanced or Network Anti-Spam Service (NAS) - This setting uses both the Standard and Dynamic Reputation databases to block the messages from known and suspected spam sources.
      It features the Dynamic Real-Time Spam Blocking. If the first query to the RBL+ database does not return a positive response, a second query is sent to the QIL database. A positive response returns a '450' error, or temporary failure of the requested connection.
      This database may occasionally list legitimate mail servers with compromised hosts behind that are temporarily sending spam. If this happens, it will re-queue and try again later, causing a delay in mail delivery until the listing expires.
  5. Click Save.

To view the Global Spam reports, do some administrative tasks, and configure the service, log on to the ERS portal.

The ERS portal also includes the IP Reputation Lookup Tool. If you suspect that your IP address is being blocked by ERS, you may use this tool to view the full IP address and determine which database it is listed in.

 
This lookup tool is based on IP addresses and does not use host or domain names.

For more information abour ERS, refer to the ERS Administration Guide.

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1101697
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.