You can control the transfer of outbound mail from your organization to the Internet.

About this task

Domino® provides two methods for restricting outbound Internet mail:

• Outbound sender controls - These controls specify which users in your organization are allowed to send mail to the Internet.
• Outbound recipient controls - These controls specify the Internet destinations to which users can send mail.

About this task

The outbound sender controls let you specify who can and cannot send mail to the Internet. The controls are implemented in two sets of Allow and Deny lists:

• Internet addresses of users who can or cannot send mail to the Internet
• Notes® addresses of users who can or cannot send mail to the Internet

The Outbound sender controls are not intended to restrict SMTP relay access. To configure relay restrictions, use the Inbound Relay Controls on the Router/SMTP - Restrictions and Controls -> SMTP Inbound Controls tab of the Configuration Settings document.

Note: SMTP can resolve names for group types of Mail-only or Multi-purpose. When you create or modify the SMTP and Router settings in the Configuration Settings document, be sure to enter group names that have a group type of Mail-only or Multi-purpose. These groups must be in the primary directory. This applies to settings on the Restrictions tab, the SMTP Inbound Controls tab, and the SMTP Outbound Controls tab.

Procedure

1. Make sure you already have a Configuration Settings document for the server(s) to be configured.

2. From the Domino Administrator, click the Configuration tab and expand the Messaging section.

3. Click Configurations.

4. Select the Configuration Settings document for the mail server or servers you want to administer, and click Edit Configuration.

5. Click the Router/SMTP -> Restrictions and Controls -> SMTP Outbound Controls tab.

6. Complete these fields and then click Save & Close:

Table 1. Outbound Sender Controls fields

Field	Description
Allow messages only from the following Internet addresses to be sent to the Internet	Specifies the RFC 821 Internet addresses of users in the local Internet domain from whom Domino accepts mail destined for Internet addresses outside the local Internet domain. If this field contains entries, Domino accepts outbound Internet mail from the specified Internet addresses only and rejects outbound Internet mail sent from other addresses. Rejected mail is returned to the sender. Enter Internet addresses in the form user@domain.com, or enter the name of a Notes group containing a list of Internet addresses allowed to send mail to the Internet. Domino expands entries for groups only if the group name can be found in the primary Domino Directory. Wildcards (for example, *renovations.com) and isolated Internet domain suffixes (for example, renovations.com) are not acceptable values in this field. Group entries cannot contain a domain part or dot (.).
Deny messages from the following Internet addresses to be sent to the Internet	Specifies the RFC 821 Internet addresses of users in the local Internet domain from which Domino does not accept mail destined for external Internet addresses. If this field contains entries, Domino rejects outbound Internet mail sent from the specified Internet addresses and returns it to the sender. All other users can send Internet mail. Enter Internet addresses in the form user@domain.com, or enter the name of a Notes group listing the Internet addresses from which to deny outbound Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory. Wildcards (for example, *renovations.com) and isolated Internet domain suffixes (for example, renovations.com) are not acceptable values in this field. Group entries cannot contain a domain part or dot (.).
Allow messages only from the following Notes addresses to be sent to the Internet	Specifies the Notes user names from which Domino accepts mail destined for external Internet addresses. If this field contains entries, Domino accepts outbound Internet mail from the specified entries only and rejects outbound Internet mail sent from all other Notes addresses. Rejected mail is returned to the sender. Enter fully qualified Notes addresses in the form User/Organizational_unit/Organization, or enter the name of a Notes group whose members you want to prevent from sending Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory.
Deny messages from the following Notes addresses to be sent to the Internet	Specifies the Notes user names from which Domino does not accept mail destined for external Internet addresses. If this field contains entries, Domino rejects outbound Internet mail sent from the specified entries and returns it to the sender. Domino accepts outbound Internet mail from all other Notes addresses. Enter fully qualified Notes addresses in the form User/Organizational_unit/Organization or the name of a Notes group whose members you want to prevent from sending Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory.




Note: Group entries cannot contain a domain qualifier ('@' sign).

What to do next

This outbound sender controls are not intended to control relaying. For information on using Domino's inbound relay controls, see the related topics.

Setting outbound recipient controls

About this task

The Outbound recipient controls let you specify the Internet domains, and host names users are allowed to and denied from sending mail to. The controls consist of a set of pair of lists, one specifying the Internet domains or host names to which users can send mail and another listing the domains and host names to which users cannot send mail.

Procedure

1. Make sure you already have a Configuration Settings document for the server(s) to be configured.

2. From the Domino Administrator, click the Configuration tab and expand the Messaging section.

3. Click Configurations.

4. Select the Configuration Settings document for the mail server or servers you want to administer, and click Edit Configuration.

5. Click the Router/SMTP -> Restrictions and Controls -> SMTP Outbound Controls tab.

6. Complete these fields and then click Save & Close:

Table 2. Outbound Recipient Controls

Field	Description
Allow messages only to recipients in the following Internet domains or hostnames	Specifies the Internet domains, such as renovations.com, and Internet host names, such as mailhost.renovations.com, to which Domino can send mail. If there are entries in this field, users can send Internet mail to the specified entries only. Domino denies mail to all other domains or host names. If you specify an Internet domain, users can send mail to any host or sub-domain in that domain. Domino matches entries against the last part of domain names or host names, so entering host.renovations.com allows mail to mail.host.renovations.com as well inbound.host.renovations.com. Note: If you list a host name that matches an MX record for a domain, Domino allows mail to all recipients in that domain.
Deny messages to recipients in the following Internet domains or hostnames	Specifies the Internet domains, such as renovations.com, and Internet host names, such as mailhost.renovations.com, to which Domino cannot send mail. Domino allows mail to all other domains or host names. Note: If you enter a host name that matches an MX record for a domain, mail to all host names / MX records for that domain is denied.

Results

For security reasons, if there is a conflict between the two fields for a given setting, entries in the Deny field take precedence. For example, if renovations.com appears in both the Allow messages only to recipients in the following Internet domains or host names field and the corresponding Deny messages field, Domino denies messages sent to renovations.com. Be careful not to have the same entry in an Allow field and a Deny field for the same setting.

Domino checks each address to see if it is an Internet address or a Notes address. The Router then applies the restrictions specified for that type of address.

If you are entering multiple names in a field, consider creating a group and entering the group name in the field. Domino expands the group into a list of members. If you update the group list in this document or edit the group members in the Domino Directory, changes do not take effect immediately.

Related concepts
Restricting outbound mail routing

Related tasks
Customizing the text of mail failure messages
Preventing unauthorized SMTP hosts from using Domino as a relay
Creating a Configuration Settings document
Recalculating the server's routing table
Supporting outbound SMTP extensions