IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Too Many Recipients Bounce Filter
OL-25137-01
Bounce all outbound email messages with more than 50 recipients from more than two unique domains:
Routing and Domain Spoofing
Using Virtual Gateways Filter
}
insert-header ('X-HAT', 'Sender Group $Group, Policy $Policy applied.');
bounce_high_rcpt_count:
if ( (rcpt-count > 49) AND (rcpt-to != "@example\\.com$") ) {
}
bounce-profile ("too_many_rcpt_bounce"); bounce ();
Segment traffic using virtual gateways. Assuming you have two Interfaces on the system, 'public1' and
'public2', and the default delivery interface is 'public1'. This would force all of your outbound traffic over
the second interface; since bounces and other similar types of mail do not go through filters, they will
be delivered from public1:
virtual_gateways:
if (recv-listener == "OutboundMail") {
}
alt-src-host ("public2");
Same Listener for Deliver and Injection Filter
Use the same listener for delivery and receiving. This filter will allow you to send any messages received
on the public listener “listener1” out the interface “listener1” (you will have to set up a unique filter for
each public injector configured):
same_listener:
if (recv-inj == 'listener1') {
}
alt-src-host('listener1');
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-101