Procedure

1. Go to Sender Filtering → Rules.
   The Rules screen appears with five tabs, one for each type of threat.
2. Click the Bounced Mail tab.
   The Bounced Mail screen appears.
3. Select the Enable check box to enable blocking of bounced mail.
4. Configure the following:
   • Duration to monitor: The number of hours that IMSVA monitors email traffic to see if the percentage of messages signaling bounced mail exceeds the threshold you set.
   • Rate (%): The maximum number of allowable messages signaling bounced mail (the numerator).
   • Total messages: The total number of bounced messages out of which the threshold percentage is calculated (the denominator).
   Consider the following example:

   Duration to monitor: 1 hour at a rate of 20 out of 100

   During each one-hour period that blocking for bounced mail is active, IMSVA starts blocking IP addresses when more than 20% of the messages it receives are bounced messages and the total number of messages exceeds 100.

   Note The LDAP service must be running to check bounced mail.

5. Next to Triggering action, select one of the following:
   • Block temporarily: Block messages from the IP address temporarily and allow the upstream MTA to try again after the block duration ends.
   • Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again.
6. Optional: If you select Block temporarily, specify the block duration.
7. Click Save.