Configuring DoS and DHA blocking period method

This article applies to:

• Trustwave MailMarshal (SEG) 
• DoS and DHA functionality

Question:

• What are the configuration options for DoS and DHA blocking periods?
• Are DoS and DHA blocking periods extended?
• DoS and DHA calculation 

Background:

In MailMarshal SMTP versions before 6.4.5, the Denial of Service (DoS) and Directory Harvest Attack (DHA) blocking periods are reset on a sliding basis. If a blocked server attempts to connect, the blocking period can be extended.

• This behavior can cause email from a legitimate external server to be delayed or permanently refused.
• For instance, if an external server creates a large number of legitimate connections, or attempts delivery to obsolete addresses, it might be blocked. If the server retries delivery within the blocking period, blocking might never end.   

In current versions of MailMarshal/SEG, the end times of DoS and DHA blocking periods are not reset. Any connections from a blocked server will not extend the period. When the blocking period ends, MailMarshal starts a new evaluation period.

• This behavior helps to ensure that legitimate servers will eventually be able to deliver messages.

If you prefer the "sliding"  behavior, you can configure MailMarshal  to use this behavior, by setting Registry entries.

Procedure:

• The below information is correct for version 8.2 and current 10.X versions. For full details of the registry locations to edit for each version, see article Q10832. 

For DoS:

1. Navigate to the Registry key: HKEY_LOCAL_MACHINE\Software\Trustwave\Secure Email Gateway\Default\Receiver\DOS
2. Create a DWORD value SlidingDOSWindow
3. Set the value to 1

For DHA:

1. Navigate to the Registry key: HKEY_LOCAL_MACHINE\Software\Trustwave\Secure Email Gateway\Default\Receiver\DHA
2. Create a DWORD value SlidingDHAWindow
3. Set the value to 1

After editing the Registry or Advanced Settings, to apply changes:

1. From the MailMarshal Configurator or 10.X Management Console, commit configuration.
2. Confirm that all servers are up to date.
3. Restart the Receiver service on each server.

As always, take due care when editing the Registry.

Notes:

To configure DoS and DHA prevention settings, see the MailMarshal Configurator or 10.X Management Console (Attack Prevention tab of Array Properties).

The Advanced Settings described may not be available in MailMarshal 10.0.0 and 10.0.1.

If you are experiencing problems with DoS or DHA blocking, you can also configure other settings:

• Exclude specific hosts from blocking.
• Set the blocking period to a shorter time than typical server retry times (generally, less than 15 minutes).