IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Blank “From:” Filter
SRBS Filter
OL-25137-01
Use the archive() line for verification of proper action, with drop() enabled or disabled for extra safety:
toTooBig:
if(header('To') == "^.{500,}") {
}
archive('tooTooBigdropped');
drop();
Identify blank “From” headers,
This filter can alleviate various forms of blank “from” addresses:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND header("From") == "^$|") {
}
drop ();
If you also want to drop messages with a blank envelope from, use this filter:
blank_mail_from_stop:
if (recv-listener == "InboundMail" AND (mail-from == "^$|" OR header ("From") ==
"^$|"))
{
}
drop ();
SenderBase Reputation filter:
note_bad_reps:
if (reputation < -2) {
}
strip-header ('Subject');
insert-header ('Subject', '***BadRep $Reputation *** $Subject');
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-99