IronPort - daily management guide - AsyncOS 7.6.1

Chapter 4 Quarantines
Ensuring that End Users Receive the Notifications
Receiving Multiple Notifications
OL-25138-01
Configuring the Cisco IronPort Spam Quarantines Feature
Consider recommending that end users add the From: address for the Cisco IronPort Spam Quarantine
notification emails to the “whitelist” in their Mail application’s (Outlook, Thunderbird, etc.) Junk Mail
Settings.
Users belonging to multiple email aliases or using several email addresses will receive multiple
notifications. This is also the case for users belonging to LDAP groups receiving email.
Table 4-4 Notifications per Address/Alias
User Email Addresses Aliases Notifications
Sam sam@example.com 1
Mary mary@example.com dev@example.com,
qa@example.com,
4
Joe joe@example.com,
admin@example.com
Note If you do not use LDAP and you do not want your end users to receive multiple email notifications,
consider disabling notifications and instead allow end users to access the quarantine directly and
authenticate via LDAP or POP/IMAP.
Determining Which Messages are Present for Each User
Depending on the method of authentication (LDAP or IMAP/POP) users may see mail for multiple email
address in the Cisco IronPort Spam quarantine.
When using LDAP authentication, if the Primary Email attribute has multiple values in the LDAP
directory, all of those values (addresses) will be associated with the user. Therefore, quarantined
messages addressed to all email addresses associated with the end user in the LDAP directory are present
in the quarantine.
If, however, the user accesses the quarantine directly via a notification, or if the authentication method
is IMAP/POP, the quarantine will only display messages for that user’s email address (or the address to
which the notification was sent). For more information about how end user authentication works, see
End Users Accessing the Cisco IronPort Spam Quarantine, page 4-31.
Keep in mind that email addresses are case insensitive in the Cisco IronPort Spam Quarantine, so for
example, email for Admin@example.com and admin@example.com will both be present in the
quarantine for a user associated with “admin@example.com.”
Limiting which Addresses have Mail Quarantined
pm@example.com
hr@example.com 3
You can use multiple mail policies (Mail Policies > Incoming Mail Policy) to specify a list of recipient
addresses for which mail will not be quarantined. Select ‘Deliver’ or ‘Drop’ instead of quarantine when
configuring the anti-spam settings for the mail policy.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-33