Incoming Blacklist in the Inbound Table

[mlynch_ironport]

How do I identify what triggered the dropping of the specific mails? I have created many Envelope Sender blocks in the Incoming Content Filter.

The message tracking shows that the mail has been dropped, but I can't see which of the filters caused it to drop that specific mail...

[kyerramr]

If a message is dropped by a content filter then this should be displayed in the tracking information as such "Dropped by content filter 'test' in ...." Also, check to see if the message is dropped by CASE (IronPort Antispam engine) or the content filter.

[mlynch_ironport]

Hi, Thanks for your response. I use the created, "Incoming_XXX_Blacklist as the top level folder and have many "envelope senders within it. I guess I should have kept the individual envelope senders at the "root" of the filter. Is there a way to copy the file and import it to the "root" as separate entries? It is working just fine, I just can't see some of the causes for dropping some of the mails. By the way, this C160 appliance is light years ahead of the old SurfControl mail filter and will save me umpteen hours a week of management. I love it already. The only thing that I can't find, is a way to see the mails content to be sure it deserves to be dropped. We do not allow any non-business mailings and I could need to know if what appears to be personal chatter could be sales generated chatter.

[jmonrad]

Hi, Thanks for your response. I use the created, "Incoming_XXX_Blacklist as the top level folder and have many "envelope senders within it. I guess I should have kept the individual envelope senders at the "root" of the filter. Is there a way to copy the file and import it to the "root" as separate entries? It is working just fine, I just can't see some of the causes for dropping some of the mails. By the way, this C160 appliance is light years ahead of the old SurfControl mail filter and will save me umpteen hours a week of management. I love it already. The only thing that I can't find, is a way to see the mails content to be sure it deserves to be dropped. We do not allow any non-business mailings and I could need to know if what appears to be personal chatter could be sales generated chatter.

Hi,

I can also recommend using the trace functionality, under System Administration -> Trace .. Here you can test a policy or see which policy is triggered when filing in details like body, ip, sender and recipient..

[mlynch_ironport]

I have not found the Trace feature able to view a specific mails body content. I would need to see the actual text (body) of certain mails to further decide if it is junk or valid in a Pharma environment. Example:

Viagra Pfizer 50mg $2 (junk) or Viagra Pfizer 50mg 2 up (good)

The subject matter does not show the full picture. Is there a method to view the mails?

M.L.

[jmonrad]

I have not found the Trace feature able to view a specific mails body content. I would need to see the actual text (body) of certain mails to further decide if it is junk or valid in a Pharma environment. Example:

Viagra Pfizer 50mg $2 (junk) or Viagra Pfizer 50mg 2 up (good)

The subject matter does not show the full picture. Is there a method to view the mails?

                                                      M.L.

I see your point, there is not really an easy way to read e-mails on the Ironport appliance as it don't store full e-mails. But perhaps one thing you could do is to quarantine and copy, then you will have a copy of the e-mail and the e-mail will not be delayed as it will be delivered to the recipient..