Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 353 / 861

352 Preventing attacks
Increasing productivity by identifying spam email
■
“Identifying spam using subject pattern matching” on page 355
■
“Identifying spam using subject pattern matching” on page 355
Blocking spam using real-time blacklists
The most common way to prevent spam is to reject email that comes from mail servers known or
believed to send spam. To limit potential spam, the security gateway can support up to three real-time
antispam blacklists. Real-time blacklists are DNS-based blocking lists that are generated to limit spam.
You can use these lists to identify spam email from certain sources, based on criteria that are
determined by the list operators. Real-time blacklisting depends on an actively maintained DNS server
with a database of IP addresses that are associated with Internet mail servers that are deemed to be
abusive on one or more spam-related criteria.
The security gateway queries the real-time blacklist for the IP address of a sending mail host. If the
query response indicates that the address is listed in the real-time blacklist database, then the security
gateway refuses the connection attempt.
The security gateway lets administrators specify up to three domains to query against. The real-time
blacklist servers are processed in the order listed in the SGMI. The security gateway stops processing
the email message when the first real-time blacklist rejects the sender address. Messages from the
rejected sender address are always blocked.
If the proxy does not get a suitable response from any of the real-time blacklist servers, a log entry is
created that contains the sender, recipient, and the real-time blacklisted servers that were contacted.
Ensure that you enable the real-time blacklist servers setting in the appropriate security gateway rule.
You must also have a valid Firewall Base license. If you do not, the security gateway does not attempt to
use this antispam scanning process.
Note: Real-time black-list checking only applies to SMTP rules that have traffic arriving on an outside
interface.
Prerequisites
None.
To block spam using real-time blacklists
1
In the SGMI, in the left pane, under Policy, click Antispam .
2 In the right pane, on the Configuration tab, in the Real-time blacklist servers text boxes, type the
fully qualified domain names of the blacklist services that you will use.
3
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
4
To apply these settings, create a rule and, on the Antispam tab, check Real-time blacklist servers .
Related information
For further information related to this topic, see the following:
■
“Monitoring log files” on page 470
■
“Adding antispam protection to a rule” on page 358
■
“Understanding and using licenses” on page 86
■
“Reducing false positives by bypassing the real-time blacklists” on page 356