Cisco ESA domain exception

[yevgen1991]

Hi all!

When I receive the new mail, i get the log:

There are situations when the domain underlined in blue is blocked and generates an error from the sender:

554 smtp.example.com Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.

What exception should I add a domain to, so that even in case of a bad rating, this mail is not blocked at the first stage, but moves on to policies?

Thanks!

[Libin Varghese · Accepted solution]

The error mentioned suggests that the sending server IP has a poor senderbase reputation score, which would lead to it matching HAT sendergroup BLACKLIST and getting rejected.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200436-Identify-and-allow-poor-SenderBase-Reput.html

The solution would be to identify these IP's and add them to a custom HAT sendergroup or WHITELIST sendergroup to allow those connections.

Do note that these appear to be cloud hosted servers and the IP's could be dynamic or be used by non-legitimate domains as well.

Sendergroups allow IP, FQDN and partial hostnames for sending servers as entries.

Regards,

Libin

[yevgen1991]

@Libin Varghese , do you mean that I may add ".google.com" in whitelist, and all the subdomains, for example xxx.google.com, yyy.google.com will be pass the HAT verification even if they have a bad reputation on the site?

Do I understand right?

[Libin Varghese]

Correct, adding .google.com as a partial hostname to the HAT Whitelist would bypass sender IP reputation checks.

However, again its not recommended practise to do that for cloud servers since you would effectively be bypassing the reputation check for all of their servers.

Regards,

Libin