SPAM FILTER TAKES ACTION BASED ON ENVELOPE SENDER

[mahadevan.v@netcon.in]

I am facing a problem in ESA regarding Whitelist/Blacklist. I am adding senders email addresses/IP addresses in incoming email policy.

But SPAM filters takes action based on envelope sender only(Other Email Security solutions works based on "from header" "Replyto header", Hence the whitelist policies not working. So I have end up in configuring message filter which works before SPAM filtering. It has been warned by technical support that creating many message filters/dictionaries will impact device utilization

1) Is there way I can modify SPAM filter to take action based on from/replyto header

2) Can someone confirm whether message filters impacts device utilization.

2)

[Ken Stieers]

Theres an option under Mail Policies /Mail policy settings where you can set what fields mail policies match, and in what order/priority.

[José L. Dávila]

Hello There,

Regarding the second question, for a small number of filters or simple conditions, device utilization is not a significant concern. However, if there is a greater number of filters in place or complex, longer filters, it is recommended to monitor the device's utilization to check if the ESA is running smoothly.

I would recommend keeping an eye on the device's utilization as you add more complex message filters. Also, feel free to take a look at this helpful documentation regarding writing more efficient message filters: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117886-qanda-esa-00.html

Let me know if this helps.

Cheers.

[ShamilaGul58174]

I have little information regarding spam folder and that is spam folder is defined to protect junk email. 

But i have no idea regarding modifications or adjustments regarding spam filter.