Local Bad Senders IP List in Messaging Gateway is too large to manage

Products

• Messaging Gateway

Issue/Introduction

• A large amount of entries exist in the Local Bad Senders IP List in Symantec Messaging Gateway (SMG).
• The size of the list has become unmanageable.
• The validity of the IPs has not be verified against Symantec's bad IP list since entry to the list.

Environment

Messaging Gateway

Cause

Over time, the Bad Senders IP List can get filled with entries that have not been verified in months or years. Symantec constantly updates IP addresses in the Global Bad Sender List. When an IP is added to global lists, it is no longer needed in local lists.

Resolution

Verify the IP address against Symantec global reputation:

1. Check the IP address against Symantec's Global Bad Senders.
   • Article ID 177268 - Instructions on how to check reputation from within the Control Center.
2. If the reputation of the IP address is negative, that IP is in the Global Bad Sender List. It does not need to be in local lists. Check the box in front of that IP entry, then click the Delete button to remove from local list.
3. If the reputation is positive or neutral and you are receiving spam messages, then submission of spam samples to Symantec will be needed to create custom local spam rules. Custom spam rules replace the placement of the IP in the Local Bad Senders IP List.

Recommended actions:

• You should use spam submission instructions from SMG Administration Guide or Symantec email submission client to report new spam.
• Use local lists sparingly. Try to create content rules or spam rules to act as workarounds until Symantec verifies reputation.