Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
13-14
Cisco AsyncOS 8.5 for Email User Guide
Chapter 13 Anti-Spam
Headers Added During Anti-Spam Scanning
Headers Added During Anti-Spam Scanning
•
If either anti-spam scanning engine is enabled for a mail policy, each message that passes through
that policy will have the following headers added to the message:
that policy will have the following headers added to the message:
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam: result
The second header contains information that allows Cisco Support to identify the rules and engine
version used to scan the message. Result information is encoded proprietary information and is not
customer-decodable.
version used to scan the message. Result information is encoded proprietary information and is not
customer-decodable.
•
Cisco Intelligent Multi-Scan also adds headers from the third-party anti-spam scanning engines.
•
You can define additional custom headers to be added to all messages for a given mail policy that
are positively identified as spam, suspected to be spam, or identified as unwanted marketing mail.
See
are positively identified as spam, suspected to be spam, or identified as unwanted marketing mail.
See
Related Topics
•
Reporting Incorrectly Classified Messages to Cisco Systems
Messages that appear to be incorrectly classified may be reported to Cisco for analysis. Each message is
reviewed by a team of human analysts and used to enhance the accuracy and effectiveness of the product.
Each message should be forwarded as an RFC 822 attachment to the following addresses:
reviewed by a team of human analysts and used to enhance the accuracy and effectiveness of the product.
Each message should be forwarded as an RFC 822 attachment to the following addresses:
•
spam@access.ironport.com - for reporting missed spam
•
ham@access.ironport.com - for reporting false-positives
Due to the volume of submissions, Cisco IronPort cannot provide individual feedback or results to
customers.
customers.
For more information about reporting incorrectly classified messages, please see the Cisco Knowledge
base or contact your Cisco Support provider.
base or contact your Cisco Support provider.
Determining Sender IP Address In Deployments with Incoming
Relays
Relays
If one or more mail exchange/transfer agents (MX or MTA), filtering servers, etc. stand at the edge of
your network, between your Cisco appliance and the external machines that are sending incoming mail,
then your appliance cannot determine the IP addresses of the sending machines. Instead, mail appears to
originate from the local MX/MTA. However, IronPort Anti-Spam and Cisco Intelligent Multi-Scan
(using the SenderBase Reputation Service) depend on accurate IP addresses for external senders.
your network, between your Cisco appliance and the external machines that are sending incoming mail,
then your appliance cannot determine the IP addresses of the sending machines. Instead, mail appears to
originate from the local MX/MTA. However, IronPort Anti-Spam and Cisco Intelligent Multi-Scan
(using the SenderBase Reputation Service) depend on accurate IP addresses for external senders.
The solution is to configure your appliance to work with incoming relays. You specify the names and IP
addresses of all of the internal MX/MTAs connecting to the Cisco appliance, as well as the header used
to store the originating IP address.
addresses of all of the internal MX/MTAs connecting to the Cisco appliance, as well as the header used
to store the originating IP address.
•
•