IronPort - advanced configuration guide

Chapter 5 Email Authentication
OL-25137-01
stamp-mail-with-spf-verification-error:
.
if (spf-status("pra") == "PermError, TempError"
spf-status Content Filter Rule in the GUI
or spf-status("mailfrom") == "PermError, TempError"
or spf-status("helo") == "PermError, TempError"){
# permanent error - stamp message subject
strip-header("Subject");
insert-header("Subject", "[POTENTIAL PHISHING] $Subject"); }
You can also enable the spf-status rule from the content filters in the GUI. However, you cannot check
results against HELO, MAIL FROM, and PRA identities when using the spf-status content filter rule.
To add the spf-status content filter rule from the GUI, click Mail Policies > Incoming Content Filters.
Then add the SPF Verification filter rule from the Add Condition dialog box. Specify one or more
verification results for the condition.
Figure 5-18 Using the spf-status Content Filter Rule
After you add the SPF Verification condition, specify an action to perform based on the SPF status. For
example, if the SPF status is SoftFail, you might quarantine the message.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
5-33