Introduction:
This document explains about white-listing the clocked email address by ESA.
Problem:
Email address is being blocked due to poor reputation by the ESA(Email Security Appliance). How can we white list this email address?
Solution:
To blacklist or drop the mail when you see a certain sender's email address or domain, you need to use a combination of a new Incoming Mail Policy and Incoming Content Filter.
1) From the Web GUI, choose Mail Policies > Incoming Mail Policy. Create a new Incoming Mail Policy. You can label the policy, "Block-Sender-Domains." Select the "Sender" option and put in the sender's email address or domain that you want to block.
2) Submit and Commit Changes.
3) Go back to Mail Policies > Incoming Mail Policy. You should now see an additional incoming mail policy called "Block-Sender-Domain" that is above the Default Policy. All mail coming from this sender's domain will be matching only this incoming mail policy.
4) Now create an incoming content filter that will drop the message. Choose Mail Policies > Incoming Content Filter. Create a new filter called "Always_drop."
5) For the condition, leave this empty.
6) For the action, set it to drop the message.
7) Click Submit.
8) After creating the incoming content filter, enable it on the correct incoming mail policy. Also, when you were modifying the "Block-Sender-Domains" mail policy, you should disable the anti-spam, anti-virus, and virus outbreak filters to not waste resources. So, for the "Block-Sender-Domains" mail policy click on the anti-spam link and select Disable and Submit. Repeat for the anti-virus scanning and outbreak filter. For the content filters, set it to Yes and enable the content filter that was created in Step 4, "Always_drop."
9) Submit and Commit the changes.
Source:
https://supportforums.cisco.com/discussion/11835876/how-can-i-whitelist-single-email-address-mikefoofoocom-get-blocked-poor
Reference:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118204-qanda-esa-00.html
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118551-qa-esa-00.html
