IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
OL-25137-01
{
}
The bcc action also supports up to three additional, optional arguments that allow you to specify the
subject header and Envelope Sender to use on the copied message, as well as an alt-mailhost. These
parameters must appear in order, so a subject must be provided if the Envelope Sender is to be set.
The subject parameter may contain action variables (see Action Variables, page 6-48) that will be
replaced with data from the original message. By default, this is set to the subject of the original message
(the equivalent of $Subject).
The Envelope Sender parameter may be any valid email address, or alternatively, may be the action
variable $EnvelopeFrom, which will set the return path of the message to the same as the original
message.
This example expands the previous one by setting the subject to be [Bcc] , and the
return path set to badbounce@home.org:
momFilter:
bcc('mom@home.org');
if ((mail-from == '^johnny$') and (rcpt-to == '^sue$'))
{
}
The alt-mailhost is the fourth parameter:
momFilterAltM:
bcc('mom@home.org', '[Bcc] $Subject', 'badbounce@home.org');
if ((mail-from == '^johnny$') and (rcpt-to == '^sue$'))
{
bcc('mom@home.org', '[Bcc] $Subject', '$EnvelopeFrom',
'momaltmailserver.example.com');
}
Warning The Bcc(), notify(), and bounce() filter actions can allow viruses through your network. The blind
carbon copy filter action creates a new message which is a full copy of the original message. The
notify filter action creates a new message that contains the headers of the original message. While
it is rare, headers can contain viruses. The bounce filter action creates a new message which
contains the first 10k of the original message. In all three cases, the new message will not be
processed by anti-virus or anti-spam scanning.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-55