Cisco Cisco Email Security Appliance C690 User Guide
4-59
Cisco IronPort AsyncOS 7.5 for Email Daily Management Guide
OL-25138-01
Chapter 4 Quarantines
Working with Safelists and Blocklists
When you use a group of C-Series appliances without an M-Series appliance, you
may need to synchronize the safelist/blocklist settings and database across
machines.
may need to synchronize the safelist/blocklist settings and database across
machines.
If you use the centralized management feature to configure multiple Cisco
IronPort appliances, you can configure administrator settings using centralized
management. If you do not use centralized management, you can manually verify
that settings are consistent across machines.
IronPort appliances, you can configure administrator settings using centralized
management. If you do not use centralized management, you can manually verify
that settings are consistent across machines.
For more information about accessing the appliance using FTP see “Accessing the
Appliance” in either the Cisco IronPort AsyncOS for Email Configuration Guide
or the Cisco IronPort AsyncOS for Email Advanced Configuration Guide.
Appliance” in either the Cisco IronPort AsyncOS for Email Configuration Guide
or the Cisco IronPort AsyncOS for Email Advanced Configuration Guide.
Troubleshooting Safelists and Blocklists
An end user maintains his or her own safelists and blocklists. Administrators can
access an end user’s safelist or blocklist only by logging into the end user account
with the user’s login and password. To troubleshoot issues with safelists and
blocklists, you can view the log files or system alerts.
access an end user’s safelist or blocklist only by logging into the end user account
with the user’s login and password. To troubleshoot issues with safelists and
blocklists, you can view the log files or system alerts.
When an email is blocked due to safelist/blocklist settings, the action is logged in
the ISQ_logs or the antispam log files. Emails that are safelisted are marked as
safelisted with an X-SLBL-Result-Safelist header. Emails that are blocklisted are
marked as blocklisted with an X-SLBL-Result-Blocklist header.
the ISQ_logs or the antispam log files. Emails that are safelisted are marked as
safelisted with an X-SLBL-Result-Safelist header. Emails that are blocklisted are
marked as blocklisted with an X-SLBL-Result-Blocklist header.
Alerts are sent out when the database is created, updated, or if there are errors in
modifying the database or running the safelist/blocklist processes.
modifying the database or running the safelist/blocklist processes.
For more information about alerts, see “System Administration” in the Cisco
IronPort AsyncOS for Email Configuration Guide.
IronPort AsyncOS for Email Configuration Guide.
For more information about log files, see
End User Tasks for Configuring Safelists and Blocklists
End users can create safelists to ensure that messages from certain senders are
never treated as spam, and they can use blocklists to ensure that messages from
certain senders are always treated as spam. For example, an end user may receive
email from a mailing list that no longer interests him. He may decide to add this
sender to his blocklist to prevent emails from the mailing list from getting sent to
his inbox. On the other hand, end users may find that emails from specific senders
never treated as spam, and they can use blocklists to ensure that messages from
certain senders are always treated as spam. For example, an end user may receive
email from a mailing list that no longer interests him. He may decide to add this
sender to his blocklist to prevent emails from the mailing list from getting sent to
his inbox. On the other hand, end users may find that emails from specific senders