Amway wave, Ironport ESA is indeed a very cow fork mail gateway, features detailed to the outrageous.
For example, my demand, to reject a suffix sina.com from the message sender to send a large number of our users as spam, you can configure several aspects of the rules can achieve the desired effect on the graph Inbound processing stream.
But the official forum of the great God who is recommended to use Content control, the original post linked below:
https://community.cisco.com/t5/email-security/best-practice-to-blacklist-a-sender/td-p/3343921
Blocking an email at the connection level is certainly better, since it saves resources.
However, sender verification is DNS based and HAT Blacklist only accepts sending IP/hostname as entries. These do not provide you options to block a domain or email address specifically.Sender verification exception table is used to set exceptions for domains who you do not wish to run sender verification on, so that isn't used for blocking.To block a specific email address/domain you would always need message/content filters.
Well, simply record what configuration:
1, Mail Policies - Incoming Content Filters, a new Filter
Blow it again, here defined Condition and Action interface function is really powerful.
Conditional rules support wildcards, for example, I want to disable sender1 @ sina.com, sender2 @ sina.com, sender3 @ sina.com. . .
I can be combined in Envolope sender - Contains write sender*@sina.com
Action, in addition to the final Drop, I also added a log, to facilitate their access to the reject log.
2, the filter applied to the Incoming Mail Policies
Mail Policies - Incoming Policies, Default Policy that line, that position Content Filter column, click to enter the configuration.
Behind the new Filter to check on Enable.
Of course, you can not modify the default policy, add a rule on their own, only enable this custom filter, can be placed in front of the Default Policy.
Configuration finished, we must remember that the upper right corner click on Commit Changes button to validate the configuration.
3, verify:
Enter the Monitor - Message Tracking, check your emails using the sender address filtering processing records show already because of this filter and Drop.
