IronPort - Configuration Guide - AsyncOS 7.6.1

Positively Identified versus Suspected Spam
9-16
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
Chapter 9 Anti-Spam
Because Cisco IronPort Anti-Spam and Cisco IronPort Intelligent Multi-Scan make the distinction
between positively identified and suspected spam (Positive and Suspect Spam Threshold, page 9-15),
many users configure their systems in one of the following ways:
Table 9-1 Common Example Configurations of Positively Identified and Suspected Spam
Spam
Positively
Identified
Method 1 Actions
(Aggressive)
The first configuration method tags only suspected spam messages, while dropping those messages that
are positively identified. Administrators and end-users can check the subject line of incoming message
for false positives, and an administrator can adjust, if necessary, the suspected spam threshold.
In the second configuration method, positively identified and suspected spam is delivered with an altered
subject. Users can delete suspected and positively identified spam. This method is more conservative
than the first.
See Table 6-6 on page 6-29 for a further discussion of mixing aggressive and conservative policies on a
per-recipient basis using the Email Security Manager feature.
Unwanted Marketing Message Detection
Method 2 Actions
(Conservative)
Drop Deliver with “[Positive Spam]” added to
the subject of messages
Suspected Deliver with “[Suspected Spam]”
added to the subject of messages
Cisco IronPort Anti-Spam and Cisco IronPort Intelligent Multi-Scan can distinguish between spam and
unwanted marketing messages from a legitimate source. Even though marketing messages are not
considered spam, your organization or end-users may not want to receive them. Like spam, you have the
option to deliver, drop, quarantine, or bounce unwanted marketing message. You also have the option to
tag unwanted marketing messages by adding text to the message’s subject to identify it as marketing.
Headers Added by Cisco IronPort Anti-Spam and Intelligent Multi-Scan
If Cisco IronPort Anti-Spam scanning or Intelligent Multi-Scan is enabled for a mail policy, each
message that passes through that policy will have the following header added to the message:
X-IronPort-Anti-Spam-Filtered: true
A second header will also be inserted for each message filtered by Cisco IronPort Anti-Spam or
Intelligent Multi-Scan. This header contains information that allows Cisco IronPort Support to identify
the CASE rules and engine version used to scan the message:
X-IronPort-Anti-Spam: result
Deliver with “[Suspected Spam]” added to
the subject of messages
Cisco IronPort Intelligent Multi-Scan also adds headers from the third-party anti-spam scanning
engines.
OL-25136-01