Outbound mailfilter

From CT Wiki
Jump to navigation Jump to search

Outbound (sender) filtering.

The outbound (sender) mailfilter provides rate limiting and filtering on outbound email sent through the Nikhef mail servers to the outside world. This should prevent the very unfortunate situation where the Nikhef mail servers are 'blacklisted' by major email providers because of sending massive spam by (hacked) Nikhef accounts. Outbound mail filtering is done by the (external) SURFmailfilter.

The filtering involves several measures:

  • The maximum number of messages per sender is limited to 500 recipients per hour, regardless of where you send them from.
  • All mail destined outside of Nikhef is scanned for viruses and spam.
  • When you use the Nikhef mail servers outside Nikhef (i.e. on the road or from home) be sure your sender (from) address is one of your valid Nikhef email addresses (see below).
    • Note: no sender validation is performed in case you send the mail from insde the Nikhef network.

Mail send through Nikhef mail servers to internal addresses is not filtered and always remains inside Nikhef.

Blocked mails.

In case of the mail servers refuse to deliver your message, you will be

notified by email with the reason.

If you think the block is in error, or if you have specific email needs, please contact the helpdesk to arrange for a time-limited exception.

Nikhef email address

Valid Nikhef email addresses are:

  • the sender@address is a name of your personal mailbox at nikhef, e.g. a42@nikhef.nl, j.doe@nikhef.nl, john.doe@nikhef.nl
  • the sender@address is your registered preferred email contact address (the one where you receive account notices, which may be at CERN or at your home university, or even at home)
  • the sender@address is the email address of a group list that you are a member of, of of which you are the owner (e.g. the user "davidg" can send mail pretending to be <group-pdp@nikhef.nl>)
  • the sender@address has been added as a mailacceptinguser exceptional permission to your computer account entry


The SURFmailfilter checks all incoming mail for the nikhef.nl domain. The filter settings for incoming mail can be modified per user.

May 2014: the SURFmailfilter checks all outgoing mail as well. This is to prevent abuse of Nikhef accounts for sending massive spam mail to the internet (more info).

Modify filter settings for incoming mail

The filter configuration can be modified per user via a web interface. The filter itself is maintained by SURFnet and is used by other SURFnet members as well. The filter is complex and very effective.

The end-user can select one out of three predefined filters: default, mild and aggressive.

The recommended filter is the default one. The spam score of this filter is 5, the autoreject score is 10:

  • mails are marked as spam between 5 and 10 are sent to your inbox
  • mails marked more than 10 will be rejected by the filter.

You might want to add or delete addresses, domains or IP ranges to the black- and whitelist of this filter. Warning: do not use the filter in the webmail for this purpose.

Perform the following steps to login to the filter:

  • Go to the login page.
  • Do NOT use the Please Login box (for domain adminstrators only), INSTEAD go to Log in using SURFfederatie.
  • Select 'Nikhef' and login with your standard Nikhef user name and password.

Useful links: