Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Use the 

archive()

 line for verification of proper action, with drop() enabled or disabled for extra safety:

Identify blank “From” headers, 

This filter can alleviate various forms of blank “from” addresses:

If you also want to drop messages with a blank envelope from, use this filter:

SenderBase Reputation filter:

toTooBig: 

if(header('To') == "^.{500,}") { 

   archive('tooTooBigdropped'); 

   drop(); 

} 

blank_mail_from_stop: 

if (recv-listener == "InboundMail" AND header("From") == "^$|<\\s*>") { 

  drop (); 

} 

blank_mail_from_stop: 

if (recv-listener == "InboundMail" AND (mail-from == "^$|<\\s*>" OR header ("From") == 

"^$|<\\s*>")) 

{ 

  drop (); 

} 

note_bad_reps: 

if (reputation < -2)  { 

  strip-header ('Subject'); 

  insert-header ('Subject', '***BadRep $Reputation *** $Subject');

}