Preventing your servers becoming a source.
WHY IT MATTERS MOST TO A HOSTING PROVIDER
One compromised account can destroy the sending reputation of every customer on a server.
WHAT CAUSES IT
Compromised credentials Vulnerable web applications sending mail Deliberate abuse by a customer
WHAT TO IMPLEMENT
Per-account sending limits, hourly and daily Rate limiting on submission Alerting on unusual volume Automatic suspension above a threshold
WHY AUTOMATIC SUSPENSION
The damage occurs within minutes, and manual response is too slow.
WHAT ELSE TO CONTROL
Mail sent by web applications, which frequently bypasses authentication The ability to set arbitrary sender addresses
WHAT TO REQUIRE
That the authenticated user owns the sender address.
WHAT TO MONITOR
Queue growth, which indicates a flood Recipients per message Distinct recipients per account
WHAT TO SEPARATE
Outbound mail onto dedicated addresses, so a problem is contained.
WHAT TO PREPARE
A procedure for responding to a compromise: suspend, purge the queue, reset credentials, investigate.
WHAT TO DO ABOUT BLOCKLISTING
Fix the cause first, then request delisting.
WHY
Requesting removal without fixing it results in relisting and reduced credibility.
