Cisco Cisco Email Security Appliance C160 Mode D'Emploi

If the bounce verification tag is not present, or if the key used to generate the tag 
has changed, or if the message is more than seven days old, the message is treated 
as per the settings defined for IronPort Bounce Verification. 

For example, the following mail log shows a bounced message rejected by the 
IronPort appliance:

Fri Jul 21 16:02:19 2006 Info: Start MID 26603 ICID 125192

Fri Jul 21 16:02:19 2006 Info: MID 26603 ICID 125192 From: <>

Fri Jul 21 16:02:40 2006 Info: MID 26603 ICID 125192 invalid bounce, 

rcpt address <bob@example.com> rejected by bounce verification.

Fri Jul 21 16:03:51 2006 Info: Message aborted MID 26603 Receiving 

aborted by sender

Fri Jul 21 16:03:51 2006 Info: Message finished MID 26603 aborted

When delivering non-bounce mail to your own internal mail server (Exchange, 
etc.), you should disable IronPort Bounce Verification tagging for that internal 
domain. 

AsyncOS considers bounces as mail with a null Mail From address (<>). For 
non-bounce messages that might contain a tagged Envelope Recipient, AsyncOS 
applies a more lenient policy. In such cases, AsyncOS ignores the seven-day key 
expiration and tries to find a match with older keys as well.

The tagging key is a text string your IronPort appliance uses when generating the 
bounce verification tag. Ideally, you would use the same key across all of your 
IronPort appliances so that all mail leaving your domain is tagged consistently. 
That way, if one IronPort appliance tags the Envelope Sender on an outgoing 
message an incoming bounce will be verified and delivered even if the bounce is 
received by a different IronPort appliance.