Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The following filter drops a message that results in a “

127.0.0.2

” response from 

the server. If the response is anything else, the rule returns “false” and the filter is 
ignored.

blacklist:

   if (dnslist('dnsbl.example.domain') == '127.0.0.2') {

        drop();

   }

The 

reputation

 rule checks the SenderBase Reputation Score against another 

value. All the comparison operators are allowed, such as 

>

, 

==

, 

<=,

 and so forth. 

If the message does not have a SenderBase Reputation Score at all (because one 
was never checked for it, or because the system failed to get a response from the 
SenderBase Reputation Service query server), any comparison against a 
reputation fails (the number will not be greater than, less than, equal to, or not 
equal to any value). You can check for a SBRS score of “none” using the 

no-reputation

 rule described below. The following example adjusts the 

“Subject:” line of a message to be prefixed by “

*** BadRep ***

” if the reputation 

score returned from the SenderBase Reputation Service is below a threshold of 
-7.5..

note_bad_reps:

   if (reputation < -7.5) {

        strip-header ('Subject');

        insert-header ('Subject', '*** BadRep $Reputation *** 

$Subject');

   }

 For more information, see “Reputation Filtering” and “SenderBase Reputation 
Score (SBRS)” in the Cisco IronPort AsyncOS for Email Configuration Guide. 
See also