Using Server-Based Spam Filtering

Note: Server-based spam filtering supports only IP-based spam block list black list lookup. Symantec updates and maintains the IP-based spam block list. Server-based antispam filtering is a separately licensed subscription service. When your antispam license key expires, you can continue to use locally defined black and white lists.

The server-based antispam feature requires Internet connectivity with the spam block list (SBL) server. Domain Name Service (DNS) is required to access the SBL server. The firewall performs SBL lookups through the DNS protocol. The lookups are against the IP address of the sender (or relaying agent) of the e-mail, adding the name of the SBL server as the authoritative domain. The DNS server then forwards each request to the SBL server, which returns a DNS response to the device. The device then interprets the DNS response to determine if the e-mail sender is a spammer.

IP addresses that are included in the block lists are generally considered to be invalid addresses for mail servers or easily compromised addresses. Criteria for listing an IP address as a spammer on the SBL can include:

• Running an SMTP open relay service
• Running open proxy servers (of various kinds)
• Being a zombie host possibly compromised by a virus, worm, Trojan, or spyware
• Using a dynamic IP range
• Being a confirmed spam source with a known IP address

By default, the device first checks incoming e-mail against local white and black lists. If there are no local lists, or if the sender is not found on local lists, the device proceeds to query the SBL server over the Internet. When both server-based spam filtering and local list spam filtering are enabled, checks are done in the following order:

1. The local white list is checked. If there is a match, no further checking is done. If there is no match...
2. The local black list is checked. If there is a match, no further checking is done. If there is no match...
3. The SBL server list is checked.

Note: SBL server matching stops when the antispam license key is expired.