RollerNet Help | Valid User Table

The valid user table is a system to configure a list of valid users for a mail domain. This feature is required to configure the Roller Network mail servers with a list of valid email addresses for a given domain. It will also prevent dictionary attacks and eliminate backscatter. By default, the recipient map table for a domain is empty.

The default action determines how the Roller Network will validate email addresses:

Default: Allow - The default action for this domain is to allow any email address. This mode should only be used for "catch-all" or "dropbox" style delivery. Entries may be added to the table to explicitly reject an address.
Default: Deny - The default action for this domain is to reject any email addresses not listed in the valid user table. This is the recommended mode for mail servers that reject unknown recipients.
Use Global Table - This mode follows the same conventions as above, but a single recipient map table may be used across multiple domains. Any domain in this mode will use the common global table.
Defer All - Disable the domain; no messages will be accepted by the system. If a domain generates too many "unknown user" errors for messages the Roller Network servers have accepted as valid addresses, the domain may be changed to "Defer All" mode.
Auto-learn - The list of valid and invalid users will be learned and cached by the system. (See the "Automatic Learning Mode" section below before using this mode.)

A recipient map entry may have an "Allow" or "Deny" action associated with it:

Allow - Any recipient address matching this rule is allowed.
Deny - Any recipient matching this rule is rejected immediately.

For the "Allow" action, any configured filtering options (DNSBL, SPF, blacklist, etc.) still apply to the final decision; a message may still be rejected by another filter after an "Allow" action is matched. The most common configuration is to list valid addresses as "Allow" entries in "Default Deny" mode. A "Deny" entry is only effective in "Default Allow" mode. Likewise, an "Allow" entry is only effective in "Default Deny" mode.

Single entry or bulk entry (one address per line) is available. Changes take effect immediately. Address extensions, as defined by the "Recipient Delimiter" setting, are ignored when checking the recipient map table. After an entry is added, it may be enabled, disabled, or removed from the valid user table. If an entry in the valid user table is rejected by the destination mail server, it will be automatically deleted by the system. Existing rules can not be changed. When a domain's valid user table is enabled, the following lookup process is applied:

Skip any domain marked as "disabled".
Skip any entry marked as "disabled".
If a matching "deny" entry is found, reject immediately.
If a matching "allow" entry is found, permit the recipient (pending other filter results).
If no matching entry is found, apply the default action.

Mail forwarding maps are automatically included in the valid user table as an "allow" entry.

All mail domains must configure a valid user table. Addresses "postmaster" and "abuse" are automatically included, as they are required by RFC2821 and RFC2142.

The valid user table is available on all account levels. Free accounts are allowed 20 entries (excluding required actions) while paid accounts are allowed unlimited entries. Free accounts that need more entries should use "Default Allow" mode. Paid accounts may also elect to use the Account Control Center API to integrate valid user functions into a management system or other procedure when adding and removing email accounts from the primary server.

Automatic learning is only effective in RCPT or VRFY mode when all messages pass through our servers. If you are using a domain in "Secondary MX" we recommend using "Default Deny" mode and the API (or manual entry as part of standard procedure when adding and removing email addresses) to maintain the list of valid users, or use the "HTTP/HTTPS Request" query method calls to validate addresses external outside of the SMTP path.

In addition to managing an explicit table of addresses to allow or deny, an automatic learning mode is also available. When a domain is in auto-learn mode, an address probe is made to determine if the address should be accepted or rejected. This response is then cached by the system, after which the cached entry will be used to determine the response for future responses on the same address. The primary server is only probed if a cached entry was not found.

How does the system know what server to probe? The primary server is determined in one of two ways depending on the domain mode. For domains in "SMTP Redirection" mode, our system will probe the server and port as configured in the account manager. In "Secondary MX" mode, a list of MX records will be assembled and any server at or below the MX priority of the Roller Network mail servers will be probed.

Automatic learning mode (show in the account manager as "Auto-learn") can use three different methods to check an address: SMTP "RCPT TO" commands, SMTP "VRFY" commands, and a URL query method. Once the probe is made and the response cached, the same address will not be probed again until it expires (or is removed from) the cache. All address queries are made using the "stripped" address, i.e. without address extensions.

The default method, and the most compatible, is to probe using a "RCPT TO" command and cache the response given. An "unknown user" response will result in a cached "reject", while an "ok" response will result in a cached "accept". SMTP "VRFY" is similar, except the response to a VRFY command is used instead of RCPT TO. A third advanced method is available to validate email addresses: HTTP/HTTPS Request. This method allows a URL to be queried and an "ACCEPT" or "REJECT" response returned. The URL has three substitution tokens which are replaced with the appropriate information when the URL query is actually made. These are:

%d - the domain name, or "right hand side" of the email address
%u - the user name, or "left hand side" of the email address
%a - the full email address

For example, the URL "http://www.mydomain.com/validate.cgi?domain=%d&user=%u" would be queried as "http://www.mydomain.com/validate.cgi?domain=domain.com&user=myuser". The URL must return only the words "ACCEPT" or "REJECT" in response in plain text.

There are several options for configuring automatic learning mode.

Query Method - The method used to populate the cache; these are described above.
Verification URL - A URL to query. This option is only shown for the "HTTP/HTTPS Request" method.
Response Cache Time - The amount of time before an entry is removed from the cache. Valid entries are 1 to 12 months.
Cache Negative Responses - Whether or not negative responses should be cached. The recommended setting is "No" since a dictionary attack can make the cache table excessively large.
Verification Timeout - The number of seconds allowed before a query request times out. Valid entries are 1 to 60 seconds.
Verification Retry - After a query times out, the system will not attempt another query for this many minutes. Valid entries are 10 to 60 minutes.
Action on Failure - If a query times out, this response will be given for any non-cached entry for the duration of the verification retry period. Options are to return a "Defer" or "Reject".
Notify On Failure - If a query times out or otherwise fails, an optional alert may be sent to the account alert email address to notify an administrator of a possible problem.
Cache Auto-Prune - This option will automatically remove cache entries that were previously added to the cached data table as "accept" if a 5xx error is detected while attempting delivery to the address.
Notify On Prune - If the Cache Auto-Prune option is enabled and an entry was removed from the cached data table, a notice of the action will be sent to the account alert email address.

The cached data table is also shown. Entries may be removed from this table, as desired. When the "Cache Expiration" time is exceeded, the entry will be removed automatically.