Alter Reputation based on other factors

[Rick Williams]

Hi,

Recently I had an issue where a legitimate sender had their emails dropped on our gateway (C650) due to a poor SBRS reputation.

I believe this is possible, but I'm not quite sure how so any help would be greatly appreciated.

What I would like to do is to increment a senders reputation score on our system based on various factors.

The factors are SPF pass, DKIM pass and Domain Key pass.

eg

If a sender has a negative reputation but their SPF, DKIM and DomainKey all are valid to allow the mail through the systems as if it had a positive score.

If a sender has a valid SPF increase the reputation score by 1. If the DKIM is valid increase the score by 2 etc etc.

Obviously I would not want to alter the users SBRS rating at Cisco as that is their own problem to fix.

My thoughts are that this may be able to be done on the HAT or on a filter.

Any thoughts or resolutions would be greatly appreciated.

[Donald Nash]

I don't know of any way to change the SBRS value locally. But even if that were possible, it isn't possible to do so with SPF or DKIM. The SPF verdict can be queried in message or content filters, but that's all. And you can't evaluate the DKIM status in the HAT because the message isn't received until after the HAT processing has already been done.

We handle the problem of "legitimate sender with a bad SBRS" by having a separate sender group that disables reputation filtering but not IronPort Anti-Spam. When a legitimate sender contacts us to complain about this problem, we put them into this sender group for a while until their reputation recovers (assuming that they aren't still spamming). This sender group has to be put into the HAT above the sender groups which are based on SBRS, so it will override them.

++Don