Using the Dynamic Screening feature, SecurityGateway monitors the behavior of sending servers to identify suspicious activity and automatically blocks IP addresses that exhibit it, such as: an IP that causes too many failed RCPT attempts during a session, connects too many times in a short period, or fails authentication too often. A Dynamic Screening block is not permanent. The IP is blocked for a length of time that you configure, and can increase automatically the more times the same IP commits another offense. Every currently blocked IP address, and the amount of time remaining on its block, is listed in the Blocked IP List at the bottom of the page.
SMTP Screening
Enable dynamic screening
Click this option to activate the Dynamic Screening feature. This is enabled by default.
Block IPs who cause this many failed RCPT attempts per connection
When enabled, an IP address is blocked when a designated number of RCPT attempts from it fail during a single SMTP session. It is a common tactic of spammers to send many RCPT commands, most of which target invalid addresses. This option is enabled by default, with a default threshold of 10.
Block IPs that connect more than [xx] times in [xx] minutes
This option designates how many times a sender is allowed to connect to SecurityGateway within a given number of minutes. If a sender exceeds that number of connections in the specified time, its IP address is blocked. This option is disabled by default.
Block IPs that fail this many authentication attempts
This is the number of times a sender may fail to authenticate before its IP address is blocked. Someone using an incorrect password is an example of something that would cause a failed authentication attempt. This option is enabled by default, with a default threshold of 10.
...within [xx] Minute(s)/Hour(s)/Day(s)
This sets the time window over which failed authentication attempts are counted toward the threshold above. Choose the number and the unit — minutes, hours, or days. Only failures that occur within this window count toward a block; older failures age out. The default window is 1 day.
Ignore authentication attempts using identical passwords
When enabled, Dynamic Screening does not count a failed authentication attempt toward the threshold above if it used the same password as a previous failed attempt from the same IP address and username. Only attempts using a different, unique password count. This prevents an email client that has cached an old, wrong password from repeatedly triggering a block on its own. This option is disabled by default.
Only for valid accounts
This sub-option of "Ignore authentication attempts using identical passwords" restricts the ignore behavior to usernames that correspond to real, existing accounts. Failed attempts against usernames that don't exist still count every time, even with a repeated password, since repeated attempts against invalid accounts are more likely to be a brute-force attack rather than a cached bad password.
Block IPs that send this many RSETs per connection
When enabled, an IP address is blocked if it sends more than the designated number of SMTP RSET commands during a single session. Repeated RSET commands are a technique sometimes used to probe or abuse a mail server without completing a full message transaction. This option is disabled by default, with a default threshold of 20.
IP Address Blocking Options
The options in this section control how long an IP address stays blocked, however it came to be blocked — whether by one of the SMTP Screening triggers above or by a direct call to the REST API (see below).
Default Expiration timeout
This is the length of time an IP address is blocked for a first offense. Specify a number and a unit — minutes, hours, or days. The default is 1 day.
Second offense penalty / Third offense penalty / Fourth+ offense penalty
These optional settings let a repeat offender be blocked for longer than a first-time offender. Check the box for an offense level you want to escalate, and specify a duration and unit for it. All three are disabled by default. The "Fourth+ offense" penalty applies to the fourth offense and every offense after it — there is no separate fifth-level penalty.
Note: These three penalty levels only take effect if you enable them. If, for example, you enable only the Fourth+ offense penalty, a second or third offense still uses the Default Expiration timeout; only the fourth and later offenses use the longer duration you've configured. Enabling a higher level without also enabling the levels below it is a valid way to escalate only the most persistent offenders.
Reset offense count after [xx] Minute(s)/Hour(s)/Day(s)
If an IP address that has offended before goes this long without offending again, its offense count resets, and its next block is treated as a first offense at the Default Expiration timeout rather than an escalated penalty. The default is 30 days.
Close SMTP session after banning IP
When an IP address is blocked, by default the SMTP session is closed immediately rather than being allowed to continue through the rest of the SMTP protocol. Clear this checkbox if you do not want the connection ended immediately when an IP is blocked.
Enable IPv4 aggregation as low as x.x.x.x [xx] identical bits (CIDR)
When enabled, a blocked IPv4 address is treated as blocking every address in the surrounding subnet, down to the number of identical bits (CIDR) you specify. This is useful for blocking an entire range of addresses being used by the same spam source, rather than blocking them one at a time as each new address appears. This option is disabled by default; the default aggregation size, once enabled, is /24.
Enable IPv6 aggregation as low as x::::x [xx] identical bits (CIDR)
This is the IPv6 equivalent of the option above. A blocked IPv6 address is treated as blocking the surrounding subnet, down to the number of identical bits (CIDR) you specify. This option is disabled by default; the default aggregation size, once enabled, is /56.
Exclusions
Exclude messages from allowlisted IP addresses and hosts
By default, all allowlisted IP addresses and hosts are exempt from the Dynamic Screening restrictions. Clear this checkbox if you wish to require even allowlisted IPs and hosts to adhere to these restrictions.
Exclude messages from authenticated sessions
When an incoming message is being sent over an authenticated session, it will be exempt from the Dynamic Screening restrictions by default. Uncheck this box if you wish to apply the restrictions to authenticated sessions as well.
Exclude messages from domain mail servers
Messages coming from one of your domain mail servers are exempt from Dynamic Screening by default. Clear this checkbox if you do not wish to exclude domain mail servers from Dynamic Screening restrictions.
Blocked IP List
This area lists every currently blocked IP address and the amount of time that has passed since it was blocked. Click Refresh to update the list, Delete to remove the selected entry or entries (unblocking those addresses immediately), or Delete All to clear the entire list at once.
Dynamic Screening and the REST API
Dynamic Screening's blocked-IP list can also be managed through SecurityGateway's REST API, in addition to this page. It uses the same settings described above, and a global administrator can retrieve the current list of blocked IPs, manually block a new IP address, or remove (unblock) an entry, all via the API. When an IP is blocked through the API without an explicit expiration being specified in the request, the block duration is calculated exactly the same way as an automatic block from this page, using the Default Expiration timeout and any enabled penalty escalation levels above. See the API documentation for the exact endpoints and request formats.
