Barracuda Spam Firewall firmware 3.5 and later.
Depending on which name servers are listed as suspect and how the authority server issues the Name Server requests, you may see all the incoming mail from a certain domain blocked, or only every other email blocked. When you see all mail coming from a certain domain is blocked for Real-time Intent that means the authority server for that domain is issuing a list of the name servers with all the name servers for that domain included, therefore blocking all the emails. When you see every other email is blocked for Real-time intent it is more likely the authority server is using a round robin technique to answer queries. As the authority server cycles through the list of name servers, the name servers that are on the reputation list will be blocked, and the ones that are not found on the list will be allowed.
For more information on Real-time Intent see http://www.barracudacentral.org.
Link to This Page: