hmLoadTopic({
hmKeywords:"Backscatter Protection,BATV,Domain Gateways,Gateway,Protection,Protection Against backscatter,Security,Security Backscatter Protection,Security BATV",
hmTitle:"Backscatter Protection",
hmDescription:"Backscatter Protection Enable Backscatter Protection Click this checkbox if you wish to insert a special Backscatter Protection code into each outgoing message\'s \"Return-Path\"",
hmPrevLink:"security--backscatter_protection.html",
hmNextLink:"bandwidth_throttling_overview.html",
hmParentLink:"security--backscatter_protection.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Other &gt; <a href=\"security--backscatter_protection.html\">Backscatter Protection - Overview<\/a>",
hmTitlePath:"Security Menu > Security Manager > Other > Backscatter Protection - Overview > Backscatter Protection",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Backscatter Protection<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/backscatter-protection.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Backscatter Protection<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable Backscatter Protection<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this checkbox if you wish to insert a special Backscatter Protection code into each outgoing message\'s &quot;Return-Path&quot; address. MDaemon will generate this special code by using the private key found in the <\/span><span class=\"f_T_Code\">rsa.private<\/span><span class=\"f_ControlIndent\"> file located in MDaemon\'s <\/span><span class=\"f_T_Code\">PEM\\_batv\\<\/span><span class=\"f_ControlIndent\"> folder, and the code will be valid for seven days. Any incoming DSNs or other auto-response messages (with a &quot;<\/span><span class=\"f_T_Code\">mailer-daemon@...<\/span><span class=\"f_ControlIndent\">&quot; or <\/span><span class=\"f_T_Code\">NULL<\/span><span class=\"f_ControlIndent\"> reverse path) must have a valid, non-expired BP code or they will fail BP verification.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">If you disable this option, MDaemon will not insert the special Backscatter Protection code into outgoing messages. It will, however, continue to check incoming DSNs and auto-response messages to ensure that any incoming message with a valid code is not rejected by mistake.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Apply Backscatter Protection to gateway domains<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When Backscatter Protection is enabled, click this option if you also wish to apply it to domains for which MDaemon is acting as a gateway or backup server (see <a href=\"gateway_domain_gateways.html\" class=\"topiclink\">Gateway Manager<\/a>).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Reject messages that fail Backscatter Protection verification<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this checkbox if you wish to reject DSNs or other auto-response messages that fail BP verification. Messages with a &quot;<\/span><span class=\"f_T_Code\">mailer-daemon@...<\/span><span class=\"f_ControlIndent\">&quot; or <\/span><span class=\"f_T_Code\">NULL<\/span><span class=\"f_ControlIndent\"> reverse path will fail if they do not contain the special code or if the code\'s seven day life-cycle has expired. Because of Backscatter Protection\'s solid reliability, there are no false positives or &quot;gray areas&quot; — a message is valid or it isn\'t. For this reason it is safe to configure MDaemon to reject invalid messages, as long as you ensure that all of your accounts\' outgoing messages contain the special BP code. In all cases, however, the result of BP verification will be logged into the SMTP-in log file, even when you choose not to reject messages that fail verification. Incoming messages for gateways will not be rejected unless you have checked the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">...apply Backscatter Protection to gateway domains<\/span><span class=\"f_ControlIndent\"> option above.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When you enable Backscatter Protection, you should wait about a week before setting it to reject invalid auto-response messages. This is because during that time you might still receive DSNs or auto-responses to messages that were sent out before BP was activated. If BP were configured to reject invalid message during that time then those legitimate response messages would be rejected by mistake. After a week it should be safe to start rejecting invalid messages. This same warning applies when you create a new BP key and choose to delete the old key immediately instead of allowing it to continue working for another seven days. (see the<\/span><span class=\"f_Notes\" style=\"font-style: italic;\"> Create new Backscatter Protection key <\/span><span class=\"f_Notes\">option below).<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this button to open the Backscatter Protection<\/span><span class=\"f_ControlIndent2\"> exempt list. Use this list to designate any IP addresses or domains that you wish to exempt from Backscatter Protection.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Create new Backscatter Protection key<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to generate a new Backscatter Protection key. This key is used by MDaemon to create and then verify the special BP codes that are inserted into messages. The key is located in a file called <\/span><span class=\"f_T_Code\">rsa.private<\/span><span class=\"f_ControlIndent\"> in MDaemon\'s <\/span><span class=\"f_T_Code\">PEM\\_batv\\<\/span><span class=\"f_ControlIndent\"> folder. When the new key is generated, a box will open to inform you that the old key will continue to work for seven more days unless you wish to delete it immediately. In most cases you should click &quot;<\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">No<\/span><span class=\"f_ControlIndent\">&quot;, electing to allow the key to work for seven more days. If you choose to delete the key immediately then that could cause some incoming messages to fail BP verification, since they would be responses to messages containing the special code generated by the old key.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">If you have your email traffic split across multiple servers, you may need to share the key file with all of your other servers or Mail Transfer Agents (MTAs).<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--backscatter_protection.html\" class=\"topiclink\">Backscatter Protection - Overview<\/a><\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
