ZyXEL Communications USG40 User Manual page 492

Figure 325 DNSBL Legitimate E-mail Detection Example
IPs: c.c.c.c
d.d.d.d
4
The ZyWALL/USG receives an e-mail that was sent from IP address c.c.c.c and relayed by an e-mail
1
server at IP address d.d.d.d. The ZyWALL/USG sends a separate query to each of its DNSBL
domains for IP address c.c.c.c. The ZyWALL/USG sends another separate query to each of its
DNSBL domains for IP address d.d.d.d.
DNSBL B replies that IP address d.d.d.d does not match any entries in its list (not spam).
2
DNSBL C replies that IP address c.c.c.c does not match any entries in its list (not spam).
3
Now that the ZyWALL/USG has received at least one non-spam reply for each of the e-mail's
4
routing IP addresses, the ZyWALL/USG immediately classifies the e-mail as legitimate and forwards
it. The ZyWALL/USG does not wait for any more DNSBL replies.
If the ZyWALL/USG receives conflicting DNSBL replies for an e-mail routing IP address, the
ZyWALL/USG classifies the e-mail as spam. Here is an example.
Chapter 29 Anti-Spam
1
c.c.c.c?
d.d.d.d?
d.d.d.d Not spam
ZyWALL/USG Series User's Guide
492
DNSBL A
DNSBL B
2
DNSBL C
3