How does Cisco determine what's a Sender?

[Greg Muszynski]

So I am looking at two Outgoing Senders reports:   

Top Senders by Clean Messages

Top Senders by Total Threat Messages

And on the first one I see our top level domain (Example: state.gov) and my Department's sub domain (Example: MyDepartment.state.gov) I don't understand why I see both, maybe the TLD option is not working correctly

We host email for two domains MyDepartment.state.gov and OtherDepartment.state.gov so I should see both, but I don't see the second one, yet in Message Tracking I show email going out from that second domain

On the second report I see just my Department's sub domain (Example: MyDepartment.state.gov) 

Forgive us for being so naive, we just recently got the sub domain expansion working so for years all we were seeing is just our single top level domain on these reports ie state.gov which wasn't helpful at all

hope you follow this and can shed some light on it,

G

[Greg Muszynski]

gleaned this from: http://www.ciscopress.com/articles/article.asp?p=1863030&seqNum=3 which helps but still doesn't explain why only one of the two domains that we host email for shows up in the Outgoing Senders report/bar graph chart

Outgoing Senders

Outgoing senders provides you with a view of the domains and IP addresses that are responsible for your outgoing mail. This should show you all the groupware and application servers that are using your ESA relay mail flow policies. It can also show you unexpected sources: Hosts in your network that shouldn’t be sending messages directly. Because the table provides statistics on virus and spam filtering, this report is useful for tracking down infected hosts or users.

There is no drill-down available here for more detail. For information on messages sent out by users and hosts in your organization, use the Message Tracking feature.