Cisco Cisco Email Security Appliance X1070 Guía Para Resolver Problemas
Note that the volume of spam that your organization receives will change over time. It is possible that more
spam is getting through the ESAs simply due to the fact that you are receiving more spam than in the past.
You can track this behavior over time by looking at the Incoming Mail Overview page and adding the
"stopped by reputation filtering" and "spam messages detected" line items.
spam is getting through the ESAs simply due to the fact that you are receiving more spam than in the past.
You can track this behavior over time by looking at the Incoming Mail Overview page and adding the
"stopped by reputation filtering" and "spam messages detected" line items.
SBRS Rationale
The big concern with False Positives is that important email could get lost. In this context, the practice of
Quarantining or Dropping SPAM Positive email is problematic. If a legitimate email is sent to a Quarantine or
a spam folder, it requires a proactive search to go in and "notice" that ham was misclassified as spam.
Quarantining or Dropping SPAM Positive email is problematic. If a legitimate email is sent to a Quarantine or
a spam folder, it requires a proactive search to go in and "notice" that ham was misclassified as spam.
In contrast, blacklist and rate−limited emails are blocked in such a way that the sender is notified
immediately. If this sender is NOT a spammer, they will likely find another way to make contact with you. In
fact, as an overall policy, blocking by default and then accepting trusted partners on request, is a
better position for some businesses.
immediately. If this sender is NOT a spammer, they will likely find another way to make contact with you. In
fact, as an overall policy, blocking by default and then accepting trusted partners on request, is a
better position for some businesses.
Throttling, if set properly, should rarely if ever affect partners, but will provide protection from domains that
get infected with viruses. Throttling will also be off−putting to spammers. We are aware of a spammer
technique to purchase large numbers of IP's, generate enough "good" email to get a decent SBRS score and
then start spamming. A larger suspect list range should catch these, limit the damage they do and it may
eventually cause them to stop sending spam to your domain.
get infected with viruses. Throttling will also be off−putting to spammers. We are aware of a spammer
technique to purchase large numbers of IP's, generate enough "good" email to get a decent SBRS score and
then start spamming. A larger suspect list range should catch these, limit the damage they do and it may
eventually cause them to stop sending spam to your domain.
Updated: Aug 06, 2014
Document ID: 118220