Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
5-419
Cisco IronPort AsyncOS 7.1 for Email Advanced Configuration Guide
OL-22164-02
Chapter 5 Using Message Filters to Enforce Email Policies
Blank “From:” Filter
Identify blank “From” headers,
This filter can alleviate various forms of blank “from” addresses:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND header("From") == "^$|<\\s*>") {
drop ();
}
If you also want to drop messages with a blank envelope from, use this filter:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND (mail-from == "^$|<\\s*>" OR
header ("From") == "^$|<\\s*>"))
{
drop ();
}
SRBS Filter
SenderBase Reputation filter:
note_bad_reps:
if (reputation < -2) {
strip-header ('Subject');
insert-header ('Subject', '***BadRep $Reputation *** $Subject');
}