ZyXEL Communications ZyWALL USG 50 User Manual page 587

Here is an example of an e-mail classified as spam based on DNSBL replies.
Figure 334 DNSBL Spam Detection Example
4
The ZyWALL receives an e-mail that was sent from IP address a.a.a.a and relayed
1
by an e-mail server at IP address b.b.b.b. The ZyWALL sends a separate query to
each of its DNSBL domains for IP address a.a.a.a. The ZyWALL sends another
separate query to each of its DNSBL domains for IP address b.b.b.b.
DNSBL A replies that IP address a.a.a.a does not match any entries in its list (not
2
spam).
DNSBL C replies that IP address b.b.b.b matches an entry in its list.
3
The ZyWALL immediately classifies the e-mail as spam and takes the action for
4
spam that you defined in the anti-spam policy. In this example it was an SMTP
mail and the defined action was to drop the mail. The ZyWALL does not wait for
any more DNSBL replies.
ZyWALL USG 50 User's Guide
IPs: a.a.a.a
b.b.b.b
1
2
a.a.a.a?
b.b.b.b?
3
Chapter 34 Anti-Spam
DNSBL A
DNSBL B
DNSBL C
587