Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Senders in the Blacklist sender group are rejected (by the parameters set in the 
$BLOCKED mail flow policy). Adding senders to this group rejects connections 
from those hosts by returning a 5XX SMTP response in the SMTP HELO 
command. 

The Suspectlist sender group contains a mail flow policy that throttles, or slows, 
the rate of incoming mail. If senders are suspicious, you can add them to the 
Suspectlist sender group, where the mail flow policy dictates that:

Rate limiting limits the maximum number of messages per session, the 
maximum number of recipients per message, the maximum message size, and 
the maximum number of concurrent connections you are willing to accept 
from a remote host. 

The maximum recipients per hour from the remote host is set to 20 recipients 
per hour. Note that this setting is the maximum throttling available. You can 
increase the number of recipients to receive per hour if this parameter is too 
aggressive.

The content of messages will be scanned by the anti-spam scanning engine 
and the anti-virus scanning engine (if you have these feature enabled for the 
system). 

The IronPort SenderBase Reputation Service will be queried for more 
information about the sender. 

The Unknownlist sender group may be useful if you are undecided about the mail 
flow policy you should use for a given sender. The mail flow policy for this group 
dictates that mail is accepted for senders in this group, but the IronPort Anti-Spam 
software (if enabled for the system), the anti-virus scanning engine, and the 
IronPort SenderBase Reputation Service should all be used to gain more 
information about the sender and the message content. Rate limits for senders in 
this group are also enabled with default values. For more information on virus 
scanning engines, see 

. For more information on 

the SenderBase Reputation Service, see