Cisco Cisco Email Security Appliance C160 Guía Del Usuario
11-8
Cisco AsyncOS 8.0.1 for Email User Guide
Chapter 11 Content Filters
How Content Filters Work
Envelope Recipient
Envelope Recipient. Does the Envelope Recipient, (i.e. the Envelope To,
<RCPT TO>) match a given pattern?
<RCPT TO>) match a given pattern?
Matches LDAP group. Is the Envelope Recipient, (i.e. the Envelope To,
<RCPT TO>) in a given LDAP group?
<RCPT TO>) in a given LDAP group?
Contains term in content dictionary. Does the envelope recipient contain
any of the regular expressions or terms in the content dictionary named
<dictionary name>?
any of the regular expressions or terms in the content dictionary named
<dictionary name>?
To search for dictionary terms, the dictionary must already have been
created. See
created. See
.
Note
The dictionary-related conditions are only available if you have
one or more dictionaries enabled. For information about creating
content dictionaries, see
one or more dictionaries enabled. For information about creating
content dictionaries, see
Note: The Envelope Recipient rule is message-based. If a message has
multiple recipients, only one recipient has to be found in a group for the
specified action to affect the message to all recipients.
multiple recipients, only one recipient has to be found in a group for the
specified action to affect the message to all recipients.
Is the Envelope Sender (i.e., the Envelope From, <MAIL FROM>) in a
given LDAP group?
given LDAP group?
Receiving Listener
Did the message arrive via the named listener? The listener name must be
the name of a listener currently configured on the system.
the name of a listener currently configured on the system.
Remote IP
Was the message sent from a remote host that matches a given IP address
or IP block? The Remote IP rule tests to see if the IP address of the host
that sent that message matches a certain pattern. This can be an Internet
Protocol version 4 (IPv4) or version 6 (IPv6) address. The IP address
pattern is specified using the allowed hosts notation described in
or IP block? The Remote IP rule tests to see if the IP address of the host
that sent that message matches a certain pattern. This can be an Internet
Protocol version 4 (IPv4) or version 6 (IPv6) address. The IP address
pattern is specified using the allowed hosts notation described in
, except for the SBO, SBRS, dnslist notations and
the special keyword ALL.
Reputation Score
What is the sender’s SenderBase Reputation Score? The Reputation Score
rule checks the SenderBase Reputation Score against another value.
rule checks the SenderBase Reputation Score against another value.
DKIM Authentication
Did DKIM authentication pass, partially verify, return temporarily
unverifiable, permanently fail, or were no DKIM results returned?
unverifiable, permanently fail, or were no DKIM results returned?
SPF Verification
What was the SPF verification status? This filter rule allows you to query
for different SPF verification results. For more information about SPF
verification, see “Email Authentication” in Cisco IronPort AsyncOS for
Email Advanced Configuration Guide.
for different SPF verification results. For more information about SPF
verification, see “Email Authentication” in Cisco IronPort AsyncOS for
Email Advanced Configuration Guide.
Table 11-2
Content Filter Conditions (continued)
Condition
Description