cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.2.0-616
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.2.0-203
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

938
Views
0
Helpful
1
Replies
Rick Williams
Beginner

Alter Reputation based on other factors

Hi,

Recently I had an issue where a legitimate sender had their emails dropped on our gateway (C650) due to a poor SBRS reputation.

I believe this is possible, but I'm not quite sure how so any help would be greatly appreciated.

What I would like to do is to increment a senders reputation score on our system based on various factors.

The factors are SPF pass, DKIM pass and Domain Key pass.

eg

If a sender has a negative reputation but their SPF, DKIM and DomainKey all are valid to allow the mail through the systems as if it had a positive score.

If a sender has a valid SPF increase the reputation score by 1. If the DKIM is valid increase the score by 2 etc etc.

Obviously I would not want to alter the users SBRS rating at Cisco as that is their own problem to fix.

My thoughts are that this may be able to be done on the HAT or on a filter.

Any thoughts or resolutions would be greatly appreciated.

1 REPLY 1
Donald Nash
Participant

I don't know of any way to change the SBRS value locally. But even if that were possible, it isn't possible to do so with SPF or DKIM. The SPF verdict can be queried in message or content filters, but that's all. And you can't evaluate the DKIM status in the HAT because the message isn't received until after the HAT processing has already been done.

We handle the problem of "legitimate sender with a bad SBRS" by having a separate sender group that disables reputation filtering but not IronPort Anti-Spam. When a legitimate sender contacts us to complain about this problem, we put them into this sender group for a while until their reputation recovers (assuming that they aren't still spamming). This sender group has to be put into the HAT above the sender groups which are based on SBRS, so it will override them.

++Don

Create
Recognize Your Peers
Content for Community-Ad