To configure IP Reputation:

1. Log on to InterScan Messaging Security console.
2. Go to System Status and ensure that the Email reputation check box is ticked.

   

   Click image to enlarge.

3. Navigate to IP Filtering > Email Reputation and make sure that the Enable Email Reputation check box is marked.

   

   Click image to enlarge.

4. Select the appropriate Service Level from the following Email Reputation Services (ERS) settings:
   • Standard or Real-Time Blackhole List (RBL+) Service - This setting uses the Standard Reputation database to block the messages from known spam sources.
     This service sends a single DNS query to the RBL+ database, which contains known and documented sources of spam, as well as an extensive list of dynamic IP addresses. If the sender is included in this database, your mail server will return a '550' error or it will reject the connection.

     The Standard IP Reputation database includes the following:

     List	Description
     Real-time Blackhole List (RBL)	A list of IP addresses of mail servers that are known sources of spam.
     Dynamic User List (DUL)	A list of dynamically assigned IP addresses, or those with a policy that prohibits public mail servers. Most entries are maintained in cooperation with the ISP owners of the network space. IP addresses in this list do not directly send email but use the mail servers of ISP.
     Relay Spam Stopper (RSS)	A list of IP addresses of mail servers that are open mail relays and are known to have sent spam. An open mail relay is a server that accepts a mail which came from any user addressed to any other user on the Internet, thus, making it difficult or impossible to track the spammers.
     Open Proxy Stopper (OPS)	A list of IP addresses of open proxy servers that are known to have sent spam. An open proxy server is a server that accepts connections from any user and relays the messages to any server on the Internet.

   • Advanced or Network Anti-Spam Service (NAS) - This setting uses both the Standard and Dynamic Reputation databases to block the messages from known and suspected spam sources.
     It features the Dynamic Real-Time Spam Blocking. If the first query to the RBL+ database does not return a positive response, a second query is sent to the QIL database. A positive response returns a '450' error, or temporary failure of the requested connection.
     This database may occasionally list legitimate mail servers with compromised hosts behind that are temporarily sending spam. If this happens, it will re-queue and try again later, causing a delay in mail delivery until the listing expires.
5. Click Save.

To view the Global Spam reports, do some administrative tasks, and configure the service, log on to the ERS portal.

The ERS portal also includes the IP Reputation Lookup Tool. If you suspect that your IP address is being blocked by ERS, you may use this tool to view the full IP address and determine which database it is listed in.

For more information abour ERS, refer to the ERS Administration Guide.