Configuring DHA Protection Settings

Configure DHA protection settings to prevent senders from using a directory harvest attack (DHA) to obtain user email addresses for spam message transmission.

Note:

Before you enable this feature, configure Microsoft Active Directory settings.

For more information, see Configuring Microsoft Active Directory Settings.
When SMTP traffic volume is extremely high, Deep Discovery Email Inspector might not precisely block email messages based on the configuration due to the time delay between rule trigger and activation.

Go to Administration > Sender Filtering/Authentication > DHA Protection.
Select Enable directory harvest attack protection.

Configure the following settings.

Table 1.
Field	Description
Monitoring duration	Select the number of hours that Deep Discovery Email Inspector monitors email traffic to see if the percentage of messages signaling a DHA threat exceeds the specified threshold.
Rate	Type the maximum percentage of messages with detected threats (the numerator).
Total messages	Type the total number of messages (received from the same sender) that Deep Discovery Email Inspector uses to calculate the threshold percentage (the denominator).
Recipient threshold	Type the maximum number of recipients allowed.
Non-existing recipients	Type the he maximum number of non-existent recipients allowed for the threshold value. DHA often include randomly generated email addresses in the receiver list.
Action	Select one of the following block actions: Block temporarily: Blocks messages from the IP address temporarily and allow the upstream MTA to try again after the block duration ends Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again
Blocking duration	If you select the Block temporarily action, select the number of hours to block. Note: After blocking a sender for the specified time, Deep Discovery Email Inspector removes the sender from the Blocked Senders list.

For example, if you configure the following settings:

Monitoring duration: 1 hour
Rate: 20
Total messages: 100
Recipient threshold: 10
Non-existing recipients: 5

During each one-hour period that DHA protection is active, Deep Discovery Email Inspector starts blocking senders when it receives more than 20% of the messages that were sent to more than 10 recipients (with more than five of the recipients not in your organization) and the total number of messages exceeds 100.

Click Save.
To use the default settings, click Restore Default to discard your configuration.