I’m trying to get Mimesweeper to generate a PCS LDAP Address list from Domino but we have 1/4 million ppl in the address book and it’s timing out when initially trying to Authenticate with Mimesweeper. This is before we get a chance to refine the query. It seems (to my very amateur LDAP understanding) that domino is sending the results of a wildcard query back to Mimesweeper and it is taking longer than the 300 seconds configured in the domain wide configuration document’s LDAP settings.
Since this is a global address book and I’m not going to be able to change the LDAP setting, is there a way to override the timeout option using a .ini variable on the server?
It seems (to my very amateur LDAP understanding) that domino is sending the results of a wildcard query back to Mimesweeper and it is taking longer than the 300 seconds configured in the domain wide configuration document’s LDAP settings.You can see what the longest search is via SHOW STAT LDAP - check the values of “LDAP.Longest LDAP Search” stats. Sounds like it would be the wildcard query you suspect that is being requested from Mimesweeper.
Since this is a global address book and I’m not going to be able to change the LDAP setting, is there a way to override the timeout option using a .ini variable on the server?
Sorry, there are no INI variables that support the LDAP server timeout.
BTW, if you are not familiar with the Domino anti-spam features mentioned here , they may be worthwhile investigating.
We actually want to reject attempts to send to invalid addresses before we accept the message for processing and content scanning, and before we hand it to Domino - so we need Mimesweeper to have an LDAP list to do the lookup.
Accepting the message, then sending a failure message back is considered bad practice these days. Its’ best to reject as part of the initial SMTP conversation.
This search does not retrieve your entire directory! That search would be encoded as Scope=2 (subtree search) rather than Scope=0 (base/object search).
This search is known as a “root DSE search”. The root object (base=empty, scope=base) in the LDAP directory reveals information about the LDAP server itself including RFC 3045 (vendor information). Many LDAP apps will perform such a search in their prolog to tailor subsequent searches for each vendor.
To determine what search Mimesweeper is timing out on, you can:Temporariliy set LDAPDEBUG=1 in your Notes.ini and restart your Domino LDAP server. This will trace to the server console, all the search arguments that the Domino LDAP server receives.
We actually want to reject attempts to send to invalid addresses before we accept the message for processing and content scanning, and before we hand it to Domino - so we need Mimesweeper to have an LDAP list to do the lookup.
I’ve confirmed that the Domino feature I previously pointed to earlier “Verify local domain recipients…” does just what you are asking for - it verifies the recipient addresses prior to accepting the message, and any invalid recipients are rejected as part of the SMTP transaction in progress.
Subject: RE: Try “Verify local domain recipients…”
Ken, I hear what you’re saying, and if Domino was the first host to accept a SMTP Message for our domain that would be useful but this is not the case.
The config is:
Internet → (DMZ) Mimesweeper content srvs → (Internal) Domino
Is the path it uses and so we’d prefer that when a session is opened with mimesweeper from a host on the internet, the Receiver service is immediately able to tell if the user exists or not and can decide whether to accept the message or reject it. Accepted messages are then put through the normal content scanning process and only after they have passed, then they are sent to Domino. The important distinction here is that the NDR is generated by the connecting host if mimesweeper rejects it, and not by mimesweeper. If Domino was to reject it, the NDR would be generated by mimesweeper which would potentially put us on SPAM blacklists if the sender address is spoofed.