Sender group SBRS and added senders

[matthewshipman]

Hi All

Hope you can help.

When it comes to Sender Groups where you add a SBRS scoring filter and add domains to the Sender List, do both of these rules have to be matched for the sender group to work, or is there a way you can do this?

Some background on my issues is that we seem to be rejecting genuine emails from .yahoo.com as they are hitting our suspect list due to low reputation from -2 to 0. I just want to create a new sender group with this SBRS range, and add .yahoo.com but I would like both of these rules to be met. This new group would then be in a higher order than our suspect list which is where they are getting dropped.

This is in close relation to https://supportforums.cisco.com/discussion/11148196/yahoo-ips-low-sbrs-and-mail-delays

Thanks

Matt

[Mathew Huynh · Accepted solution]

Hey Matthew,

With regards to your enquiry;

In short; No both do not need to be matched so your requested setup will not work to use both, however anti-spam scanning will still be done even if SBRS score were not considered at sendergroup level.

Sendergroup if you enable both SBRS filtering and also add the .yahoo.com SMTP hostname directly into the sendergroup, it'll use the 'or' clause.

Meaning if the host ends with .yahoo.com it'll match this sendergroup, OR if (any other hosts) matches that SBRS score, it will also hit this sendergroup, so it's not restricted.

Sendergroup matching takes a top-down approach, and it'll match SBRS or added host-names depending on which is matched first.

EG: 

If you created a sendergroup just for .yahoo.com with no SBRS filter scores added to it and moved it above the BLACKLIST, this means all emails from .yahoo.com regardless of SBRS will go through this sendergroup and ignore the rest.

However anti-spam filtering will still be done to assist to remove obvious spam emails.

However if this sendergroup is put BELOW the BLACKLIST but above SUSPECTLIST, should the SBRS score for .yahoo.com servers be bad, it'll be blocked by the BLACKLIST, but should it not match the SBRS threshold on BLACKLIST, it'll fall into this custom sendergroup.

I hope this helps the understanding.