Cisco Cisco Email Security Appliance C650 Guía Del Usuario
6-439
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
Chapter 6 Using Message Filters to Enforce Email Policies
Blank “From:” Filter
Identify blank “From” headers,
This filter can alleviate various forms of blank “from” addresses:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND header("From") == "^$|<\\s*>") {
drop ();
}
If you also want to drop messages with a blank envelope from, use this filter:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND (mail-from == "^$|<\\s*>" OR
header ("From") == "^$|<\\s*>"))
{
drop ();
}
SRBS Filter
SenderBase Reputation filter:
note_bad_reps:
if (reputation < -2) {
strip-header ('Subject');
insert-header ('Subject', '***BadRep $Reputation *** $Subject');
}