ZyXEL Communications ZyWall USG 2000 User Manual page 672

Chapter 38 Anti-Spam
Here is an example of an e-mail classified as legitimate based on DNSBL replies.
Figure 449 DNSBL Legitimate E-mail Detection Example
The ZyWALL receives an e-mail that was sent from IP address c.c.c.c and relayed
1
by an e-mail server at IP address d.d.d.d. The ZyWALL sends a separate query to
each of its DNSBL domains for IP address c.c.c.c. The ZyWALL sends another
separate query to each of its DNSBL domains for IP address d.d.d.d.
DNSBL B replies that IP address d.d.d.d does not match any entries in its list (not
2
spam).
DNSBL C replies that IP address c.c.c.c does not match any entries in its list (not
3
spam).
Now that the ZyWALL has received at least one non-spam reply for each of the e-
4
mail's routing IP addresses, the ZyWALL immediately classifies the e-mail as
legitimate and forwards it. The ZyWALL does not wait for any more DNSBL replies.
672
IPs: c.c.c.c
d.d.d.d
1
4
c.c.c.c?
d.d.d.d?
d.d.d.d Not spam
2
3
ZyWALL USG 2000 User's Guide
DNSBL A
DNSBL B
DNSBL C