Spammers routinely try to send emails with the recipient field filled with a list of all possible combinations of letters and numbers. These…

The scenario describes a Directory Harvest Attack (DHA), where an attacker attempts to discover valid email addresses by sending messages to a large number of potential addresses. The most effective countermeasure on a Cisco Secure Email Gateway is to validate recipient addresses against a corporate directory during the SMTP conversation. Configuring the gateway to perform LDAP acceptance validation allows it to query an LDAP server (such as Microsoft Active Directory) to verify if the recipient in the RCPT TO command is a valid user. If the user does not exist, the gateway rejects the message at the protocol level, preventing the attacker from learning which addresses are valid.

A. Select the SMTP Authentication Query checkbox: SMTP Authentication is used to verify the identity of the sender for relaying outbound mail, not to validate the existence of an inbound recipient.

C. Quarantine external authentication queries: This is not a standard feature or terminology. The goal is to reject invalid recipients at the SMTP level, not to quarantine a query.

D. Enable end user safelist features: Safelists are user-managed lists of approved senders to prevent their emails from being marked as spam; they do not validate the recipient's own address.

1. Cisco Secure Email Gateway Best Practices

Tips

and Tricks

Document ID: 118900.

In the "Preventing Directory Harvest Attacks" section

it states: "The primary method for preventing DHAs is to configure your gateway to reject mail for non-existent users. You can do this by creating an LDAP query to validate the recipient address on the gateway... When recipient validation is enabled

the gateway queries the LDAP server during the SMTP conversation to determine if the recipient address in the 'RCPT TO' command is valid." This directly supports using an LDAP query for validation.

2. Cisco Content Security Management Appliance Configuration Guides (relevant to Secure Email Gateway management).

In sections covering Mail Policies and Hat/Rat (Host Access Table/Recipient Access Table)

the configuration of LDAP Accept queries is detailed as the mechanism for recipient validation. The "LDAP Accept" feature explicitly performs this function. For example

the AsyncOS for Email Security User Guide describes configuring an LDAP profile and then using it in a recipient access table (RAT) to accept or reject mail.

3. Cisco Live Presentation

BRKSEC-3171 - Advanced Email Security with Cisco Email Security Appliance (ESA).

These presentations frequently cover best practices for securing email infrastructure. The topic of Directory Harvest Attack Prevention (DHAP) is a standard component

where the recommended solution is enabling Recipient Validation via an LDAP query against a directory server. This is presented as a fundamental security control.