Emails Ending up in the Spam Quarantine

[Hector Ramirez]

Hello

I have an Ironport C170 and I would like to know how to stop emails from certain domains from ending up in the Spam Quarantine? I have gone into the HAT overview and added these domains to the Whitelist, Unknown list and All list. All of these lists have a mail flow policy of accepted or trusted. Even though I added them to these lists one of these domains emails was processe by the Suspect list.

Thank you,

[ravi saini]

you can create Incoming mail policies.

Go to Mail Policies -->Incoming mail policies --> add a new policy(Define sender domain in that policy) and you can disable antispam for that particular policy.

[brusso]

Simply adding a domain name to the HAT will not work. The HAT is matching hostnames and IP addresses. It is not matching sender domain names. Your configuring the host access table, not a DOMAIN access table.

Look at the mail logs of the appliance to make sure the sender that needs to be whitelisted has a hostname that ends with the domain example.com.

If it does; alter your entry in the HAT from 'example.com' to '.example.com

Entering the name like so will then match all hostnames which DNS PTR record ends with example.com.

It will match entries such as mx1.example.com.

If the hostname does not end with example.com, you can add the IP address directly to the HAT. You can find this address in the mail logs as well.

Hope this helps!

For more information please refer to Article #160: How do I whitelist a trusted sender?

Link:

http://tools.cisco.com/squish/7d096