IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
SPF-Status Rule
OL-25137-01
When you receive SPF/SIDF verified mail, you may want to take different actions depending on the
results of the SPF/SIDF verification. The spf-status rule checks against different SPF verification results.
For more information, see Verification Results, page 5-31.
You can check against the SPF/SIDF verification results using the following syntax:
if (spf-status == "Pass")
If you want a single condition to check against multiple status verdicts, you can use the following syntax:
if (spf-status == "PermError, TempError")
You can also check the verification results against the HELO, MAIL FROM, and PRA identities using
the following syntax:
if (spf-status("pra") == "Fail")
The following example shows the spf-status filter in use:
skip-spam-check-for-verified-senders:
if (sendergroup == "TRUSTED" and spf-status == "Pass"){
}
skip-spamcheck();
quarantine-spf-failed-mail:
if (spf-status("pra") == "Fail") {
if (spf-status("mailfrom") == "Fail"){
} else {
}
# completely malicious mail
quarantine("Policy");
if(spf-status("mailfrom") == "SoftFail") {
}
# malicious mail, but tempting
quarantine("Policy");
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-35