IronPort - daily management guide - AsyncOS 7.6.1

Working with Safelists and Blocklists
Accessing Safelists and Blocklists
Syntax for Safelists and Blocklist Entries
4-42
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
Chapter 4 Quarantines
Access safelists and blocklists. Depending on authentication settings, end users may need to log
into their Cisco IronPort Spam Quarantine accounts. For more information, see Accessing Safelists
and Blocklists, page 4-42.
Add safelist entries. Users add safelist entries from the Options menu or the list of quarantined
messages in Cisco IronPort Spam Quarantine. For more information, see Adding Entries to Safelists,
page 4-42.
Add blocklist entries. Users add blocklist entries from the Options menu of the Cisco IronPort
Spam Quarantine. For more information, see Adding Entries to Blocklists, page 4-44.
To access safelists and blocklists, end users whose accounts are authenticated using LDAP or Mailbox
(IMAP/POP) authentication must log into their accounts on the Cisco IronPort Spam Quarantine. The
end user must log into their account even if they are accustomed to accessing their messages via a spam
notification (which usually doesn’t require authentication). If the end-user authentication is set to
NONE, end users do not need to log into their accounts to access safelist/blocklist settings.
Entries can be added to safelists and blocklists using the following formats:
user@domain.com
server.domain.com
domain.com
Adding Entries to Safelists
Method 1
End users cannot add a sender or domain to both safe and block lists at the same time. However, if the
end user adds a domain to a safelist, and the email address for a user of that domain to the blocklist (or
vice versa), the Cisco IronPort appliance applies both rules. For example, if the end user adds
example.com to the safelist, and adds george@example.com to the blocklist, the Cisco IronPort appliance
delivers all mail from example.com without scanning for spam, but will treat mail from
george@example.com as spam.
End users cannot allow or block a range of sub-domains using the following syntax: .domain.com.
However, an end user can explicitly block a specific domain using the following syntax:
server.domain.com.
End users can add senders to safelists in two ways:
Step 1 From the IronPort Spam Quarantine, select the Options drop-down menu.
OL-25138-01