Cisco Cisco Email Security Appliance C160 Mode D'Emploi
8-25
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Chapter 8 Anti-Spam
Positively Identified versus Suspected Spam
Because IronPort Anti-Spam and IronPort Intelligent Multi-Scan make the
distinction between positively identified and suspected spam (
distinction between positively identified and suspected spam (
), many users configure their systems in one
of the following ways:
The first configuration method tags only suspected spam messages, while
dropping those messages that are positively identified. Administrators and
end-users can check the subject line of incoming message for false positives, and
an administrator can adjust, if necessary, the suspected spam threshold.
dropping those messages that are positively identified. Administrators and
end-users can check the subject line of incoming message for false positives, and
an administrator can adjust, if necessary, the suspected spam threshold.
In the second configuration method, positively identified and suspected spam is
delivered with an altered subject. Users can delete suspected and positively
identified spam. This method is more conservative than the first.
delivered with an altered subject. Users can delete suspected and positively
identified spam. This method is more conservative than the first.
See
for a further discussion of mixing aggressive and
conservative policies on a per-recipient basis using the Email Security Manager
feature.
feature.
Unwanted Marketing Message Detection
IronPort Anti-Spam and IronPort Intelligent Multi-Scan can distinguish between
spam and unwanted marketing messages from a legitimate source. Even though
marketing messages are not considered spam, your organization or end-users may
not want to receive them. Like spam, you have the option to deliver, drop,
spam and unwanted marketing messages from a legitimate source. Even though
marketing messages are not considered spam, your organization or end-users may
not want to receive them. Like spam, you have the option to deliver, drop,
Table 8-1
Common Example Configurations of Positively Identified and
Suspected Spam
Suspected Spam
Spam
Method 1 Actions
(Aggressive)
(Aggressive)
Method 2 Actions
(Conservative)
(Conservative)
Positively
Identified
Identified
Drop
Deliver with “
[Positive Spam]
”
added to the subject of messages
Suspected
Deliver with “
[Suspected
Spam]
” added to the subject of
messages
Deliver with “
[Suspected
Spam]
” added to the subject of
messages