It’s a widely suggested best practice to reject mail addressed to nonexistent recipients at the gateway level. This will aid the spam block rate and keep your license usage count accurate.
LibraCyber ESG supports two different types of recipient verification:
- Dynamic Verification
- Valid Recipient List
Dynamic Verification
The Dynamic Verification is the easiest form of recipient verification to use and manage.
How it works
To use the Dynamic Verification method your mail server must reject email addressed to invalid addresses through the SMTP RCPT TO command. If the server accepts the request (required code 250, 251, or 252), it may provide information about the address in a server-defined format and then LibraCyber ESG can use your mailserver to verify if a recipient specified on an incoming email is valid or not.
Email server side setup
Each email server has its own documentation about how to enable this feature. See the links below for guides of commonly used mail server software:
- Microsoft Exchange 2007: http://technet.microsoft.com/en-us/library/aa998898%28EXCHG.80%29.aspx
- Microsoft Exchange 2010: http://technet.microsoft.com/en-us/library/bb125187.aspx If you are using a default standalone (no Edge Transport Server) installation of 2010 the Anti-Spam functionality is not installed. Therefore you need to follow this article: http://technet.microsoft.com/en-us/library/bb201691.aspx
- Microsoft Exchange 2013/2016: Dynamic Verification with Exchange 2013 and 2016
- Microsoft Office 365: Directory Based Edge Blocking (DBEB) feature from Office 365
- IBM Lotus Domino: https://www.ibm.com/support/knowledgecenter/SSKTMJ_8.5.3/com.ibm.help.domino.admin85.doc/H_RESTRICTING_WHO_CAN_RECEIVE_MAIL_FROM_THE_INTERNET_STEPS.html
- Postfix MTA: http://www.postfix.org/ADDRESS_VERIFICATION_README.html
Email Security side setup
Log in to LibraCyber ESG as admin and reach the Relay Configuration page.
Edit a relay domain and select Dynamic Verification as Recipient Verification method.
Note: you can configure different policies for different domains, even if they belong to the same tenant.
Configure the Dynamic Verification Server address and the Dynamic Verification Port.
Valid Recipient List
The Valid Recipient List is the most efficient and reliable recipient verification method.
How it works
The valid address check is completely done versus a locally cached list without an online connection to any other server. It requires a more complex configuration, but this method is more efficient and reliable than the above Dynamic Verification.
Setup
Addresses import method
This list of valid email addresses can be populated in different ways:
- Manually (by adding each accepted address one by one)
- Text Import (from a CSV text file import)
- LDAP import (via a LDAP server)
- Microsoft 365 import (via Microsoft 365 connector)
- Google Workspace import (via Google Workspace connector)
Note: if you want to use one of the last 3 methods, please setup the connector.
Populate the list
Reach the Recipient Verification page and populate the Valid Recipient List using the import method you chose.
Apply to the domain
Once you have populated your list you have to apply it to your domain in the Relay Configuration page.
Warning: remember to populate your Valid Recipient List before setting it as Recipient Verification method, or all received emails will be rejected.
Edit a relay domain and select Valid Recipient List as Recipient Verification method.
Note: you can configure different policies for different domains, even if they belong to the same tenant.