Cisco Cisco Email Security Appliance C160 Mode D'Emploi
6-3
Cisco AsyncOS 8.5.6 for Email User Guide
Chapter 6 Sender Reputation Filtering
SenderBase Reputation Service
Figure 6-1
The SenderBase Reputation Service
1.
SenderBase affiliates send real-time, global data
2.
Sending MTA opens connection with the appliance
3.
Appliance checks global data for the connecting IP address
4.
SenderBase Reputation Service calculates the probability this message is spam and assigns a
SenderBase Reputations Score
SenderBase Reputations Score
5.
Cisco returns the response based on the SenderBase Reputation Score
How SenderBase Reputation Filters Work
Sender reputation filter technology aims to shunt as much mail as possible from the remaining security
services processing that is available on the appliance. (See
services processing that is available on the appliance. (See
.)
When sender reputation filtering is enabled, mail from known bad senders is simply refused. Known
good mail from global 2000 companies is automatically routed around the spam filters, reducing the
chance of false positives. Unknown, or “grey” email is routed to the anti-spam scanning engine. Using
this approach, sender reputation filters can reduce the load on the content filters by as much as 50%.
good mail from global 2000 companies is automatically routed around the spam filters, reducing the
chance of false positives. Unknown, or “grey” email is routed to the anti-spam scanning engine. Using
this approach, sender reputation filters can reduce the load on the content filters by as much as 50%.
Sending MTA
SBRS Scoring Engine
•Global complaint data
•Global volume data
SenderBase Affiliate Network
1
5
3
4
2
1.2.3.4
HELO
1.2.3.4
Rule hits
SBRS =
x.x
250-Recipient Accepted
or
452-Too many recipients this hour
or
554-Access Denied
for
1.2.3.4
Email Security Appliance