Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Identify blank “From” headers, 

This filter can alleviate various forms of blank “from” addresses:

blank_mail_from_stop: 

if (recv-listener == "InboundMail" AND header("From") == "^$|<\\s*>") { 

  drop (); 

} 

If you also want to drop messages with a blank envelope from, use this filter:

blank_mail_from_stop: 

if (recv-listener == "InboundMail" AND (mail-from == "^$|<\\s*>" OR 

header ("From") == "^$|<\\s*>")) 

{ 

  drop (); 

} 

SenderBase Reputation filter:

note_bad_reps: 

if (reputation < -2)  { 

  strip-header ('Subject'); 

  insert-header ('Subject', '***BadRep $Reputation *** $Subject');

}