ZyXEL Communications 91-009-073003B manual 579

Chapter 34 Anti-Spam

Here is an example of an e-mail classified as spam based on DNSBL replies.

Figure 331 DNSBL Spam Detection Example

IPs: a.a.a.a b.b.b.b

1

4

?

a

.

a

.

a

?

.

m

a

b

.

a

b

.

p

b

s

.

t

b

o

N

a

.

a

.

a

.

a

a.a.a.a?

b.b.b.b?

a

.

a

.

a

b

.

a

.

?

b

.

b

.

b

?

b

.

b

.

b

.

bS

p

a

m

DNSBL A

2

DNSBL B

DNSBL C

3

1The ZyWALL receives an e-mail that was sent from IP address a.a.a.a and relayed by an e-mail server at IP address b.b.b.b. The ZyWALL sends a separate query to each of its DNSBL domains for IP address a.a.a.a. The ZyWALL sends another separate query to each of its DNSBL domains for IP address b.b.b.b.

2DNSBL A replies that IP address a.a.a.a does not match any entries in its list (not spam).

3DNSBL C replies that IP address b.b.b.b matches an entry in its list.

4The ZyWALL immediately classifies the e-mail as spam and takes the action for spam that you defined in the anti-spam policy. In this example it was an SMTP mail and the defined action was to drop the mail. The ZyWALL does not wait for any more DNSBL replies.

	579
ZyWALL USG 50 User’s Guide