Sophos Email Appliance: Blocking Backscatter / NDR (Non-Delivery Report/Receipt) Messages

The following article discusses a method of using an Email Appliance policy to quarantine ALL Backscatter/NDR spam messages. When prompted for the reason for quarantining them, choose 'Spam' from the dropdown menu.

What to do

1. Log into the Administrator Interface
2. Go to Configuration | Policy | Anti-Spam | Inbound
3. Click the 'Add...' button
4. Under 'Rule type' set it to 'Bounce messages' and click next
5. Select  one or both options "Enable Bounce Address Tag Verification (BATV)" or "Treat all auto-responders identified by SophosLabs as bounces", and click next
6. Under 'Users & Groups', include users who are impacted, and click next
7. Under 'Main Action' select 'quarantine' (or any other action)
8. Choose the reason for quarantine (optional if quarantining) as Spam and click next
9. Under 'Rule Description' give the policy a name, for example - NDR Blocking
10. Select the checkbox option to 'Activate this rule'
11. Click 'Save'

Ensure that the newly-created policy is running, i.e. the active light is green.

The BATV option requires that outbound mail be passed through the appliance.  Bounce messages originating from within the organization through the appliance will be accepted if the BATV option is selected. Please be aware that the rule "Treat all auto-responders identified by SopohsLabs as bounces" may capture all NDRs from valid mail servers. Please be sure to review those messages if you are going to be quaranting NDR messages.