User Guide

9-64
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Actions
Caution The Bcc(), notify(), and bounce() filter actions can allow viruses through your network. The blind
carbon copy filter action creates a new message which is a full copy of the original message. The notify
filter action creates a new message that contains the headers of the original message. While it is rare,
headers can contain viruses. The bounce filter action creates a new message which contains the first 10k
of the original message. In all three cases, the new message will not be processed by anti-virus or
anti-spam scanning.
To send to multiple hosts, you can call the
bcc() action multiple times:
Related Topics
• The bcc-scan() Action, page 9-64
The bcc-scan() Action
The bcc-scan action functions similarly to the bcc action, except that the message that is sent is treated
as a brand new message and is therefore sent through the entire email pipeline.
Quarantine and Duplicate Actions
The quarantine(‘quarantine_name’) action flags a message for inclusion into a queue called a
quarantine. For more information about quarantines, see the “Quarantines” chapter. The
duplicate-quarantine(‘quarantine_name’)action immediately places a copy of the message into the
specified quarantine and the original message continues through the email pipeline. The quarantine name
is case sensitive.
multiplealthosts:
if (recv-listener == "IncomingMail")
{
insert-header('X-ORIGINAL-IP', '$remote_ip');
bcc ('$EnvelopeRecipients', '$Subject', '$EnvelopeFrom', '10.2.3.4');
bcc ('$EnvelopeRecipients', '$Subject', '$EnvelopeFrom', '10.2.3.5');
bcc ('$EnvelopeRecipients', '$Subject', '$EnvelopeFrom', '10.2.3.6');
}
momFilter:
if ((mail-from == '^johnny$') and (rcpt-to == '^sue$'))
{
bcc-scan('[e-mail]');
}