Message Filter for IronPort Spam Quarantine (Answer ID: 481)

Unanswered Question
Aug 2nd, 2007
User Badges:

Hi ,

after a few Dual C-Series Installations I have changed the filter described in the Ironport Support KnowledgeBase (Answer ID: 481):

Original Solution:

if (rcpt-to == [email protected]' ) {
insert-header("X-IronPort-Quarantine", "Policy");

Which needs the Mail to be rescanned by the AntiSpam Engine. If you have a Dual C-Series Setup with one Box being the IronPort Spam-Quarantine (ISQ) this would mean that a mail gets checked twice by the engines (on both machines).

I've now started to use the following filter for direct sending to the ISQ:

if recv-listener == "ISQ" {
alt-mailhost ("the.euq.queue");

The difference here is that i disable the spamcheck with skip-spamcheck(); and changing the next mailhost to the.euq.queue.
This solution is also much more resource friendly and works on both machines. The the.euq.queue is an internaly used Destination for the Spam Quarantine (no matter if external or local). So this should probably work on all installations, where a direct sending to the Spam Quarantine is needed.

Comments are more then welcome. ;-)

Best Regards,
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
morrow_ironport Sat, 08/04/2007 - 11:37
User Badges:

Hi Bart,

the release from the ISQ works fine with my 5.1.1 AsyncOS. Have you tried this recently again?



This Discussion