Cisco Cisco Email Security Appliance C680 User Guide

The SenderBase Reputation Service provides an accurate, flexible way for users 
to reject or throttle suspected spam based on the connecting IP address of the 
remote host. The SenderBase Reputation Service returns a score based on the 
probability that a message from a given source is spam and exposes objective data 
in the Mail Flow Monitor feature to allow mail administrators to get a more 
complete picture of who is sending them email (see “Using Email Security 
Monitor” in the Cisco IronPort AsyncOS for Email Daily Management Guide). 
The SenderBase Reputation Service can be used as a stand-alone anti-spam 
solution. It is primarily designed to improve the effectiveness of a content-based 
anti-spam system such as IronPort Anti-Spam.

Using the SenderBase Reputation Service, you can:

Reduce spam

The SenderBase Reputation Service allows enterprises to identify known spam 
based on the connecting IP address, allowing organizations to block spam as soon 
as it reaches the gateway. This increases the effectiveness of the anti-spam 
scanning engine being used or any content-based filter. 

Protect against spam floods

Viruses such as SoBig and “hit and run” spam attacks can create sudden and 
unexpected spikes in message volume. If a particular sender starts sending at high 
volumes, the SenderBase Reputation Service can detect this through its global 
affiliate network and assign a more negative score, which the Cisco IronPort 
appliance can use to immediately begin limiting the number of recipients per hour 
allowed from the sender. (See also 

Improve throughput

The Cisco IronPort appliance can reduce system load and increase message 
throughput by immediately rejecting known spam and routing known good 
messages past content filters.