cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1211
Views
0
Helpful
1
Replies

Mail Coming with Reputation "rfc1918"

rockbd
Level 1
Level 1

Can anyone tell me what the "rfc1918" in SBRS Score of mail in Iroport. If it is spam then how i can block it. And another query lot of mail is coming with [SPAM] tag and most of the case it is SPAM who to avoid/block/quarantined those spam mail.

1 Reply 1

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

rfc1918 means the sender IP address is a private IP address and hence there is no known reputation score for it.

Senderbase can only provide reputation scores for public IP addresses. If you feel these emails are spam you would need to locate the internal senders of these spam emails, I would suspect these to be outbound emails.

If these are inbound emails then you may have another device placed before the ESA which is hiding the original sender IP and you may want to look at configuring an incoming relay.

To take action on spam emails you would need to review the device configuration under Mail Policies -> Incoming Mail Policies -> Anti-Spam and ensure action for positive spam is set to quarantine.

Thank You!
Libin Varghese