Reverse DNS, a tough call
Enabling the option Verify connecting hostnames in DNS in the Inbound Connections Controls section found just below the DNS Blacklist Filters settings can itself reduce the amount of spam entering your organization by half. This option causes your Domino server to do a reverse DNS lookup on SMTP hosts that try to connect. Most spammers don't have these DNS records. Unfortunately, many legitimate companies have poorly configured DNS records and would fail this test as well. However, more and more system administrators and ISPs are using reverse DNS as an anti-spam tool, so even if you don't enable it, you should use DNS Report (see: http://www.dnsreport.com) to ensure the DNS records for your own SMTP servers are correct.

Further down in the configuration document, you will find the Inbound Sender Controls section. Here you can enable Domino to "Verify the sender's domain in DNS" before accepting a mail message. This causes Domino to do a DNS lookup of the domain in the "from" field of the email (technically it's really the MAILFROM SMTP command that is checked). This will block spam that appears to originate from bogus domains.

If you are encountering dead mail in your MAIL.BOX file addressed to former employees or nonexistent addresses, enable the "Verify that local domain recipients exist in the Domino Directory" option in the Inbound Intended Recipients Controls section.

Each of the options described in this article may introduce latency to inbound message delivery, but it is often times well worth it. Enable each feature one by one and track both its success at stopping spam and its effect on performance.

Done carefully and maybe you can win back some of that $874!

Daniel Koffler works as a Domino consultant for major organizations in North America and Europe, specializing in network design, security analysis and knowledge management, he is also the author of several OpenSource projects. Daniel can be reached at dkoffler@users.sourceforge.net