Cisco Cisco Email Security Appliance C160 Mode D'Emploi

End user safelists and blocklists are created by end users and stored in a database 
that is checked prior to anti-spam scanning. Each end user can identify domains, 
sub domains or email addresses that they wish to always treat as spam or never 
treat as spam. If a sender address is part of an end users safelist, anti-spam 
scanning is skipped, and if the sender address is listed in the blocklist, the 
message may be quarantined or dropped depending on administrator settings. For 
more information about configuring safelists and blocklists, see the 
“Quarantines” chapter in the Cisco IronPort AsyncOS for Email Daily 
Management Guide.

The Anti-Spam feature involves IronPort Anti-Spam scanning. Anti-spam 
scanning offers complete, Internet-wide, server-side anti-spam protection. It 
actively identifies and defuses spam attacks before they inconvenience your users 
and overwhelm or damage your network, allowing you to remove unwanted mail 
before it reaches your users’ inboxes, without violating their privacy.

Anti-spam scanning can be configured to deliver mail to the IronPort Spam 
Quarantine (either on- or off-box). Messages released from the IronPort Spam 
Quarantine proceed directly to the destination queue, skipping any further work 
queue processing in the email pipeline.

See 

 for more information.

Your IronPort appliance includes integrated virus scanning engines. You can 
configure the appliance to scan messages and attachments for viruses on a 
per-“mail policy” basis. You can configure the appliance to do the following when 
a virus is found:

attempt to repair the attachment

drop the attachment

modify the subject header