Cisco Cisco Email Security Appliance X1050 Troubleshooting Guide
When an email message is sent though an incoming relay, the "original" sending host (the sending MTA
before the incoming relay) is not known at the time the incoming relay connects to the ESA.
before the incoming relay) is not known at the time the incoming relay connects to the ESA.
It is therefore not possible for the ESA to match the "original" sending host to a given sender group (either by
IP address, SBRS score, etc) at connection time. However, with the incoming relays feature, the ESA can
deduce the "original" sending host from the headers of the message that is being relayed through the incoming
relay to the ESA.
IP address, SBRS score, etc) at connection time. However, with the incoming relays feature, the ESA can
deduce the "original" sending host from the headers of the message that is being relayed through the incoming
relay to the ESA.
After deducing the "original" sending host, the ESA makes this information available in the form of message
filter variables, e.g. reputation, sendergroup, remote−ip, etc.
filter variables, e.g. reputation, sendergroup, remote−ip, etc.
You can use either of these message filters to handle messages from mail hosts with poor SBRS scores.
This filter matches the receiving listener, "Example−Listener":
Handle_low_SBRS: if ((recv−listener == "Example−Listener") AND
(reputation <= −3.0)){
# insert action here
}
This filter matches the SenderGroup, "bad−SBRS−sg":
Handle_low_SBRS: if (sendergroup == "bad−SBRS−sg") {
# insert action here
}
What kind of actions can I apply to an email message using message filters?
Updated: Dec 05, 2014
Document ID: 118686