Category: News

First of all, what is NDR?

NDR stands for Non-delivery Report. These are emails. Basically, you receive this type of NDR emails because an email you sent to someone did not reach the intended recipient.

But why are you getting NDRs from mail servers for mail you NEVER sent? The answer: Spammers are spoofing your email address. They are claiming to be YOU when they send out emails (oh yes it can be done easily).

So let us say that your email address is user@domain.com. A spammer got hold of your email and then ’spoofs’ it. This means that the spammer is now sending out spam using YOUR email address. Because spammers send out thousands of emails – (some to wrong address), the mail servers of the domain will naturally send out a notice that the email could not be sent (either the reciepient is non-existent, or the mailbox is full).

These Non delivery notices via email are then sent to the sender’s email address. In the above scenario, they will be sent back to you. Even if you did not really send the email in the first place! And that explains why you are getting tons of NDR emails even if you did not send any emails out!

The internet community has come up with a way to combat or reduce these types of NDRs and spams. It is called the SPF (Sender provider framework). In simple terms, we put up a record on your domain that says email from your domain can only be sent out from a list of accredited email servers. This makes it hard for spammers that use their own mail servers to ’spoof’ your identity anymore. This will reduce the spam they send out, and also reduce the NDR spams you get!!

Interesting now isnt it? So how do you enable SPF on your domain? The solution is fairly simply as well!

Use Microsoft’s senderID tool and follow the prompts. For our hosted clients that need us to enable their SPF on their domains, kindly contact your account executive to start the process! Do let us know if this has helped you and your experience with NDR once the SPF has been implemented.

The Payment Card Industry (PCI)’s Data Security Standard is increasingly being demanded by tech savvy clients, so it is important that your hosting provider is able to offer PCI Compliant Hosting.

PCI Compliant Hosting providers have grown in importance as the scale of financial transactions are more and more being done online. At BNS we implement the major aspects of PCI standards to make these PCI standard hosting services. Both physical and logical barriers are in place to restrict access and secure data to only those individuals that are properly authenticated and authorized to access the servers.

We employ things like certificate based security, encrypted communications,  IP access control list, full audit entry logs and physical access control measures that employ biometrics.

How to make your website PCI Compliant?

Step 1: Find out the level of PCI Compliance needed:

• Level 1: Merchants which process over 6 million annual transactions or have already suffered an attack resulting in compromised data·  
• Level 2: Merchants which process between 150,000 to 6 million annual transactions
• Level 3: Merchants which process between 20,000 and 150,000 annual transactions
• Level 4: Merchants which process less than 20,000 annual transactions

The requirements for each level are:

• Level 1: Annual on-site security audit and quarterly network security scan.
• Level 2 and 3: Annual self assessment questionnaire and quarterly scan by an approved PCI scanning vendor
• Level 4: No need to report compliance but must maintain compliance

Step 2: Engage a PCI approved scanning vender to have your Web site scanned for vulnerabilities.  Be sure to continue the scanning on a quarterly basis.

Step 3: Report your compliance by sending the PCI scan and self-assessment to your merchant bank.

If you want to know more about PCI standards:

PCI Security Standards

PCI Self Assessment

PCI FAQs

Feel free to contact us about your PCI compliant hosting requirements