SMTP Blocks

SMTP Blocks are an effective method for temporarily preventing a domain or individual user from sending email from the server. For example, if a particular user is sending an abnormal amount of email, you can add their address to the SMTP Blocks list and they will be unable to send email until you remove them. Users and/or domains can be left on the list for whatever time you deem appropriate. This action can be an effective stop-gap versus actually deleting the user and/or domain from the server, giving users or domain administrators the ability to clean up their act before having their mail server privileges revoked.

Note: Email Address / Domain blocks are enforced against a message's Return Path (the address given with the SMTP MAIL FROM command) rather than the From: header, because the Return Path is generally more difficult to spoof than the From: address alone. If SmarterMail is authenticating the sender, the authenticated username is also checked, so a blocked user can't get around the rule simply by sending with a different From: header while still logging in with the blocked account.

Note: A whitelisted IP address is exempt from every SMTP Block rule, regardless of block type. If a sending server's IP has been added to the Whitelist, its messages will go through even if the address, domain, or EHLO value it uses would otherwise match an entry on this list. Keep this in mind if a block doesn't seem to be taking effect – check the Whitelist for a matching IP before assuming the block rule itself is wrong.

By default, this tab will be empty. However, once entries are added, the following details can be seen for each:

Address - The email address, domain, or EHLO value being blocked.
Type - The type of block: Email Address / Domain or EHLO Domain.
Direction - Whether the block is for inbound, outbound, or all messages. (This only applies to Email Address / Domain blocks; see below.)
Description - The description given to the block. Entries created automatically by SmarterMail – rather than typed in by an administrator – are also identified through this field (see Blocking a Sender from the Spool below).

EHLO Domain vs Email Address / Domain Block Types

Both block types are entered into the same Blocked Address field, but they are checked against completely different parts of an SMTP session, and they behave differently once a match occurs:

Email Address / Domain – This is a flat block on the Return Path address supplied in the MAIL FROM command (and, if relevant, the authenticated username). Enter a complete address (e.g., "spammer@example.com") to block only that mailbox, or enter just the domain (e.g., "example.com") to block every address at that domain. Either value can also include the wildcard characters * and ? for partial matches (e.g., "*example.com" behaves the same as entering the bare domain "example.com"). This block type is enforced immediately: as soon as a matching MAIL FROM is received, the session is rejected outright with a 550 Sender is not allowed response – there is no delay or "soft" handling for this block type.
Note: When a bare domain is entered for this block type, SmarterMail matches it against the domain portion of the Return Path – not the EHLO/HELO domain the connecting server announced. This is an important distinction if you're used to thinking of "the domain" as whatever a mail server identifies itself as when it connects; for this block type, it always means the domain half of the sender's address, e.g., the "example.com" in "user@example.com".
EHLO Domain – An "EHLO domain" is the value a connecting mail server supplies with the EHLO/HELO command when it opens an SMTP session. (SmarterMail treats EHLO and HELO identically.) A well-behaved server will supply its own fully qualified domain name here (e.g., "mail.your_domain.com"), but this isn't guaranteed – some clients or misconfigured servers may supply something else entirely, such as a bare local IP address. Because there's no universal rule for what a given sender will supply, expect to do some testing (reviewing SMTP logs for the actual EHLO values being sent) before relying on this block type. There is no Direction option for EHLO Domain blocks – they only ever apply to inbound sessions, since the EHLO value only matters for servers connecting in to SmarterMail.

Note: Unlike an Email Address / Domain block, an EHLO Domain block does NOT reject the connection right when the EHLO command is given. Instead, SmarterMail applies a "soft" block: the EHLO command still gets its normal 250 OK response, but the session is flagged internally, and any subsequent authentication attempt will fail with 535 Authentication failed while any RCPT TO command will fail with a 550/551 <address> No such user here response. This delay is intentional: if the rejection happened immediately after EHLO, a spammer probing which domain names are blocked could quickly figure out exactly what tripped the rule and adjust the EHLO value on each connection attempt. By waiting until authentication or RCPT TO, the failure looks like an ordinary bad password or invalid mailbox instead of a deliberate block.

Adding a New Block

To create a new block, click on New. When adding or editing an entry, the following configuration settings will be available, based on the Block Type chosen:

Block Type - Whether the block affects an email address or an entire domain, or an EHLO domain.
Blocked Address - The complete email address of the user, the domain name (or wildcard pattern), or the value used for the EHLO domain, depending on the Block Type chosen above.
Direction - For Email Address / Domain blocks only, this refers to the types of messages that should be blocked: Inbound, Outbound or All Messages. For example, a block set to Outbound would stop a compromised local mailbox from sending mail out through your server while still letting other people send mail to that same address.
Description - A friendly name or brief description of the block.

Blocking a Sender from the Spool

SMTP Blocks entries don't only come from this Security page. From the Spool Overview dashboard, a system administrator reviewing live SMTP sessions can block an offending sender address or domain directly from one of the activity tables, without navigating away from the dashboard. Doing so creates a new entry here of type Email Address / Domain, defaulting to the Inbound direction, with its Description set to "Blocked from Spool Overview" – a useful marker when reviewing this list later to distinguish blocks that were added reactively, in response to observed abuse, from ones an administrator configured ahead of time. Removing the block from the Spool Overview dashboard deletes the corresponding entry here, and deleting the entry from this page removes the block as seen from the spool.

Importing/Exporting Settings

One of the primary reasons SmarterMail is so popular is that it's very easy for a system administrator to manage. Not only is SmarterMail's administration all web-based, many of the functions available for administrators can be exported from one machine and imported into another SmarterMail installation. This makes it easy for administrators to have a consistent set of security settings, antispam settings and more across all of the SmarterMail servers in use.

To import or export settings, simply click the Actions (⋮) button and select either option. When exporting, the settings are saved as a JSON file to the location specified in File Explorer. When importing files, a modal window opens and the corresponding JSON file can be dragged-and-dropped right in the modal or the file can be selected using File Explorer.