ZyXEL Communications ZyWALL 310 - Page 766

Chapter 40 Anti-Spam
ZyWALL USG Series User’s Guide
766
Figure 526 DNSBL Spam Detection Example
1 The Zyxel Device receives an e-mail that was sent from IP address a.a.a.a and relayed by an e-mail
server at IP address b.b.b.b. The Zyxel Device sends a separate query to each of its DNSBL domains for IP
address a.a.a.a. The Zyxel Device sends another separate query to each of its DNSBL domains for IP
address b.b.b.b.
2 DNSBL A replies that IP address a.a.a.a does not match any entries in its list (not spam).
3 DNSBL C replies that IP address b.b.b.b matches an entry in its list.
4 The Zyxel Device immediately classifies the e-mail as spam and takes the action for spam that you
defined in the anti-spam policy. In this example it was an SMTP mail and the defined action was to drop
the mail. The Zyxel Device does not wait for any more DNSBL replies.
Here is an example of an e-mail classified as legitimate based on DNSBL replies.
DNSBL A
DNSBL B
DNSBL C
IPs: a.a.a.a
b.b.b.b
1
2
a
.
a
.
a
.
a
N
o
t
s
p
a
m
3
4
a
.
a
.
a
.
a
?
b
.
b
.
b
.
b
?
a
.
a
.
a
.
a
?
b
.
b
.
b
.
b
?
a.a.a.a?
b.b.b.b?
b
.
b
.
b
.
b
S
p
a
m