• Outbound sender controls - These controls specify which users in your organization are allowed to send mail to the Internet.
• Outbound recipient controls - These controls specify the Internet destinations to which users can send mail.

The outbound sender controls let you specify who can and cannot send mail to the Internet. The controls are implemented in two sets of Allow and Deny lists:

• Internet addresses of users who can/cannot send mail to the Internet
• IBM® Lotus® Notes® addresses of users who can/cannot send mail to the Internet

The Outbound sender controls are not intended to restrict SMTP relay access. To configure relay restrictions, use the Inbound Relay Controls on the Router/SMTP - Restrictions and Controls - SMTP Inbound Controls tab of the Configuration Settings document.

Note SMTP can resolve names for group types of Mail-only or Multi-purpose. When you create or modify the SMTP and Router settings in the Configuration Settings document, be sure to enter group names that have a group type of Mail-only or Multi-purpose. These groups must be in the primary directory. This applies to settings on the Restrictions tab, the SMTP Inbound Controls tab, and the SMTP Outbound Controls tab.

Note Because you might unintentionally block desired mail, be careful when you use these fields.

1. Make sure you already have a Configuration Settings document for the server(s) to be configured.

2. From the Domino Administrator, click the Configuration tab and expand the Messaging section.

3. Click Configurations.

4. Select the Configuration Settings document for the mail server or servers you want to administer, and click Edit Configuration.

5. Click the Router/SMTP - Restrictions and Controls - SMTP Outbound Controls tab.

6. Complete these fields in the Outbound Sender Controls section, and then click Save & Close:

Outbound Sender Controls
Field	Description
Allow messages only from the following Internet addresses to be sent to the Internet	Specifies the RFC 821 Internet addresses of users in the local Internet domain from whom Domino accepts mail destined for Internet addresses outside the local Internet domain. If this field contains entries, Domino accepts outbound Internet mail from the specified Internet addresses only and rejects outbound Internet mail sent from other addresses. Rejected mail is returned to the sender. Enter Internet addresses in the form user@domain.com, or enter the name of a Notes group containing a list of Internet addresses allowed to send mail to the Internet. Domino expands entries for groups only if the group name can be found in the primary Domino Directory. Wildcards (for example, *acme.com) and isolated Internet domain suffixes (for example, acme.com) are not acceptable values in this field. Group entries cannot contain a domain part or dot ('.'). For example, the group with the name DenyMail is valid, but the groups named Deny.iris.com or Denymail@iris are not.
Deny messages from the following Internet addresses to be sent to the Internet	Specifies the RFC 821 Internet addresses of users in the local Internet domain from which Domino does not accept mail destined for external Internet addresses. If this field contains entries, Domino rejects outbound Internet mail sent from the specified Internet addresses and returns it to the sender. All other users can send Internet mail. Enter Internet addresses in the form user@domain.com, or enter the name of a Notes group listing the Internet addresses from which to deny outbound Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory. Wildcards (for example, *acme.com) and isolated Internet domain suffixes (for example, acme.com) are not acceptable values in this field. Group entries cannot contain a domain part or dot ('.'). For example, the group with the name DenyMail is valid, but the groups named Deny.iris.com or Denymail@iris are not.
Allow messages only from the following Notes addresses to be sent to the Internet	Specifies the Notes user names from which Domino accepts mail destined for external Internet addresses. If this field contains entries, Domino accepts outbound Internet mail from the specified entries only and rejects outbound Internet mail sent from all other Notes addresses. Rejected mail is returned to the sender. Enter fully qualified Notes addresses in the form User/Organizational_unit/Organization, or enter the name of a Notes group whose members you want to prevent from sending Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory.
Deny messages from the following Notes addresses to be sent to the Internet	Specifies the Notes user names from which Domino does not accept mail destined for external Internet addresses. If this field contains entries, Domino rejects outbound Internet mail sent from the specified entries and returns it to the sender. Domino accepts outbound Internet mail from all other Notes addresses. Enter fully qualified Notes addresses in the form User/Organizational_unit/Organization or the name of a Notes group whose members you want to prevent from sending Internet mail. Domino expands entries for groups only if the group name can be found in the primary Domino Directory.

Note Group entries cannot contain a domain qualifier ('@' sign). For example, an entry for a group with the name DenyMail is valid, but if you add the domain name to the entry, as in Denymail@acme, IBM® Lotus® Domino® does not expand the entry to determine its members. This restriction applies to nested groups also. That is, if the group DenyMail includes Sales@AcmeWest as a member, Domino does not expand Sales@AcmeWest to determine its members.

This outbound sender controls are not intended to control relaying. For information on using Domino's inbound relay controls, see the topic Setting inbound relay controls.

Setting outbound recipient controls

The Outbound recipient controls let you specify the Internet domains, and host names users are allowed to and denied from sending mail to. The controls consist of a set of pair of lists, one specifying the Internet domains or host names to which users can send mail and another listing the domains and host names to which users cannot send mail.

1. Make sure you already have a Configuration Settings document for the server(s) to be configured.

2. From the Domino Administrator, click the Configuration tab and expand the Messaging section.

3. Click Configurations.

4. Select the Configuration Settings document for the mail server or servers you want to administer, and click Edit Configuration.

5. Click the Router/SMTP - Restrictions and Controls - SMTP Outbound Controls tab.

6. Complete these fields in the Outbound Recipient Controls section, and then click Save & Close:

Outbound recipient controls
Field	Description
Allow messages only to recipients in the following Internet domains or host names	Specifies the Internet domains, such as acme.com, and Internet host names, such as mailhost.acme.com, to which Domino can send mail. If there are entries in this field, users can send Internet mail to the specified entries only. Domino denies mail to all other domains or host names. If you specify an Internet domain, users can send mail to any host or sub-domain in that domain. Domino matches entries against the last part of domain names or host names, so entering host.acme.com allows mail to mail.host.acme.com as well inbound.host.acme.com. Note If you list a host name that matches an MX record for a domain, Domino allows mail to all recipients in that domain. For example, if mailhost.acme.com exactly matches the name of an MX host in the DNS for the domain acme.com, entering it in this field allows all mail to that domain.
Deny messages to recipients in the following Internet domains or host names	Specifies the Internet domains, such as acme.com, and Internet host names, such as mailhost.acme.com, to which Domino cannot send mail. Domino allows mail to all other domains or host names. Domino matches entries against the last part of domain names or host names, so entering host.acme.com denies mail to smtp.host.acme.com as well as inbound.host.acme.com. Note If you enter a host name that matches an MX record for a domain, mail to all host names / MX records for that domain is denied. Thus, specifying a host name that matches an MX record for a domain denies all mail to that domain.

7. The change takes effect after the next Router configuration update. To put the new setting into effect immediately, reload the routing configuration.

Note For security reasons, if there is a conflict between the two fields for a given setting, entries in the Deny field take precedence. For example, if acme.com appears in both the "Allow messages only to recipients in the following Internet domains or host names" field and the corresponding "Deny messages" field, Domino denies messages sent to acme.com. Be careful not to have the same entry in an Allow field and a Deny field for the same setting.

Note Domino checks each address to see if it is an Internet address or an IBM® Lotus® Notes® address. The Router then applies the restrictions specified for that type of address.

Note If you are entering multiple names in a field, consider creating a group and entering the group name in the field. Domino expands the group into a list of members. If you update the group list in this document or edit the group members in the Domino Directory, changes do not take effect immediately.

Related topics

Customizing the text of mail failure messages
Preventing unauthorized SMTP hosts from using Domino as a relay
Creating a Configuration Settings document
Recalculating the server's routing table
Restricting outbound mail routing
Supporting outbound SMTP extensions

Glossary