Difference between "Check for RBL" and "Verify Sender’s IP Reputation"?

Daniel,

When real-time blackhole lists are enabled, external IP reputation databases are used to determine if the sending server is a known spammer. I believe the default RBLs used are at least these were used in Sophos SG UTM 9:
• CYREN IP Reputation
• cbl.abuseat.org
Yes, you can also configure additional RBLs to use.

Note that the difference between the premium and standard RBL services you see are that with premium no false positives are expected, and with standard some false positives may be possible.

With IP reputation enabled you can choose to reject, accept or drop emails that are being sent from known spam senders. By doing this during the message transmission, you can reduce the processing that Sophos XG Firewall is required to do.

The XG Firewall can also verify if the recipient email address is valid by using an SMTP query to the recipients mail server. If the email address is incorrect, the email will be rejected causing a bounce message to the sender. This reduces the load on XG Firewall as it does not have to process the email, and it provides senders, including customers and valued partners, with an instant response if they mistype your email address. If the email address is valid, the message is processed for spam and viruses as normal.

Hope this steers you in the right direction!

Regards,

Firewalls.com Inc.

Get Secure. Stay Secure.

www.firewalls.com

Daniel,

When real-time blackhole lists are enabled, external IP reputation databases are used to determine if the sending server is a known spammer. I believe the default RBLs used are at least these were used in Sophos SG UTM 9:
• CYREN IP Reputation
• cbl.abuseat.org
Yes, you can also configure additional RBLs to use.

Note that the difference between the premium and standard RBL services you see are that with premium no false positives are expected, and with standard some false positives may be possible.

With IP reputation enabled you can choose to reject, accept or drop emails that are being sent from known spam senders. By doing this during the message transmission, you can reduce the processing that Sophos XG Firewall is required to do.

The XG Firewall can also verify if the recipient email address is valid by using an SMTP query to the recipients mail server. If the email address is incorrect, the email will be rejected causing a bounce message to the sender. This reduces the load on XG Firewall as it does not have to process the email, and it provides senders, including customers and valued partners, with an instant response if they mistype your email address. If the email address is valid, the message is processed for spam and viruses as normal.

Hope this steers you in the right direction!

Regards,

Firewalls.com Inc.

Get Secure. Stay Secure.

www.firewalls.com

Firewalls.com Inc said:

Note that the difference between the premium and standard RBL services you see are that with premium no false positives are expected, and with standard some false positives may be possible.

I wonder who decides which are premium and which are standard? Or does the appliance behave different regarding the list you put the RBL service in?

Jelle,

These RBL Services can be modified. By default the Premium RBL Services uses bl.spamcop.net and the Standard RBL Services uses dnsbl-1.uceprotect.net. We can only choose a single Sender Remote Blacklist Group per SMTP Scanning Policy. Our SMTP Scanning policy defines the criteria which must be met such as email address/domain group sender/receiver, filter criteria such as source/destination IP's/networks in order for the action to take place.

Regards,

Firewalls.com Inc.

Get Secure. Stay Secure.

www.firewalls.com

Well, I can choose more on our XG...?!? Or did I misunderstand you?

They've moved some things around in the SFOS 17.0.5 MR-5. My apologies, in the previous version you could add and edit Sender Remote Blacklist directly from within the SMTP Scanning Policy. Looks like we now have to create the objects then we can add them to the SMTP Policy when Spam Protection is enabled.

Screen shot demonstrates where to add the RBL Group where we can create new groups or edit the pre-built service groups in the new SFOS 17.0.5 MR-5

Premium RBL Services
RBL (IPv4)
Premium RBLs. No false alarms expected.

Standard RBL Services
RBL (IPv4)
More RBLs. False alarms are possible.

Regards,

Firewalls.com Inc.

Get Secure. Stay Secure.

www.firewalls.com

Yes, and still I wonder who decides which are premium and which are standard? We ourselves... OK. But how do we know? From testing and playing around?

Maybe it's only the names and descriptions given by Sophos which are confusing me and I should forget about premium and standard.

By the way. If senders IP reputation is also based on this as described above, where is this reputation taken from as I can't select one ore more blacklists for this feature?

Firewalls.com Inc said:

With IP reputation enabled you can choose to reject, accept or drop emails that are being sent from known spam senders. By doing this during the message transmission, you can reduce the processing that Sophos XG Firewall is required to do. 

Ahhh, then the difference between them is, that "RBL check" only drops spam mails, while "verify IP reputation" rejects them immediately. Thanks for making that clear.

Jelle said:

If senders IP reputation is also based on this as described above, where is this reputation taken from as I can't select one ore more blacklists for this feature?

I asked myself the same thing. Where comes the "IP reputation" from?

dja said:

I asked myself the same thing. Where comes the "IP reputation" from?

From Sophos Support I've now gotten the answer:

The appliance checks all IP addresses for reputation based on our data collected by Sophos Labs.