IronPort - advanced configuration guide

6-10
Table 6-2 Message Filter Rules
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Rule Syntax Description
Envelope Recipient rcpt-to-group Is the Envelope Recipient, (i.e. the Envelope To,
in Group
) in a given LDAP group? See
Envelope Recipient in Group Rule, page 6-22.
Remote IP remote-ip
Note: The rcpt-to-group rule is
message-based. If a message has multiple
recipients, only one recipient has to be found in
a group for the specified action to affect the
message to all recipients.
Was the message sent from a remote host that
matches a given IP address or IP block? See
Remote IP Rule, page 6-24.
Receiving
Interface
recv-int Did the message arrive via the named receiving
interface? See Receiving IP Interface Rule,
page 6-25.
Receiving Listener recv-listener Did the message arrive via the named listener?
See Receiving Listener Rule, page 6-25.
Date date Is current time before or after a specific time and
date? See Date Rule, page 6-25.
Header header() Does the message contain a specific header?
Does the value of that header match a certain
pattern? See Header Rule, page 6-26.
Random random() Is a random number in some range? See Random
Rule, page 6-27.
Recipient Count rcpt-count How many recipients is this email going to? See
Recipient Count Rule, page 6-28.
Address Count addr-count() What is the cumulative number of recipients?
This filter differs from the rcpt-count filter rule
in that it operates on the message body headers
instead of the envelope recipients. See Address
Count Rule, page 6-28.
SPF Status spf-status What was the SPF verification status? This filter
rule allows you to query for different SPF
verification results. You can enter a different
action for each valid SPF/SIDF return value. See
SPF-Status Rule, page 6-35.
SPF Passed spf-passed Did the SPF/SIDF verification pass? This filter
rule generalizes the SPF/SIDF results as a
Boolean value. See SPF-Passed Rule, page 6-36.
Image verdict image-verdict What was the image scanning verdict? This filter
rule allows you to query for different image
analysis verdicts. See Image Analysis,
page 6-67.
OL-25137-01