User Guide

9-109
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Examples
Too Many Recipients Bounce Filter
Bounce all outbound email messages with more than 50 recipients from more than two unique domains:
Routing and Domain Spoofing
• Using Virtual Gateways Filter, page 9-109
• Same Listener for Deliver and Listener Filter, page 9-110
• Single Listener Filter, page 9-110
• Drop Spoofed Domain Filter (Single Listener), page 9-110
• Drop Spoofed Domain Filter (Multiple Listeners), page 9-110
• Another Drop Spoofed Domain Filter, page 9-111
• Detect Looping Filter, page 9-111
Using Virtual Gateways Filter
Segment traffic using virtual gateways. Assuming you have two Interfaces on the system, 'public1' and
'public2', and the default delivery interface is 'public1'. This would force all of your outbound traffic over
the second interface; since bounces and other similar types of mail do not go through filters, they will
be delivered from public1:
insert-header ('X-HAT', 'Sender Group $Group, Policy $Policy applied.');
}
bounce_high_rcpt_count:
if ( (rcpt-count > 49) AND (rcpt-to != "@example\\.com$") ) {
bounce-profile ("too_many_rcpt_bounce"); bounce ();
}
virtual_gateways:
if (recv-listener == "OutboundMail") {
alt-src-host ("public2");
}