What "msg630" and "oh" said are both great points.
One thing I would add is that there may be situations where you need to let in an ISP traffic with a low SBRS score because there are some email senders coming from that IP that need to be let through (for important business reasons or the sender is a friend of the CEO).
In this case, the email sender/company is guilty by association. The email sender/company outsources their mail delivery to an ISP. The potential problem with this is what if the ISP (ie. comcast.net, verizon.net) has a low SBRS score because spammers also send out of this network.
For example, if the sender, joe@company.com sends mail to ceo@business.com, the sender's mail hits the Ironport appliance and the Ironport sees the connection coming from 183.29.29.1 (outgoing5.comcast.net ). When the SBRS score is looked up on 183.29.29.1, it has a SBRS score of -5.0 for example.
What the Ironport would do is categorize the connection as coming from a "spammy" source and do whatever is appropriate for a connection coming from -5.0. Unfortunately, even if the sender or the company is legitimate, they're coming from a spammy source.
----------
In this case, the workaround for this is to accept this IP or hostname into your network. You're just accepting them in and not whitelisting them. There is a big difference between the two. Whitelisting the IP/hostname usually means you're not going to run anti-spam on their traffic. If you accept the traffic, you let it through, allow particular senders/domains to get through, and then enforce the SBRS score after the fact.
Here is a knowledge base document that shows how to do this. Essentially, what you're doing is let the ISP in the door, letting select email senders/domains through, and then enforcing the SBRS score that you normally block.
If you're not sure about some of these steps, contact Customer Support and they can help.
-------------------------
Steps
For situations where some recipients are not receiving messages from sending MTA's that have low SBRS score, this is a workaround to allow those recipients to receive messages from this low-scoring sending MTA and then allowing the SBRS score to take effect.
Configurations that will be affected:
- HAT Overview, the addition of a new sendergroup
- message filters
Steps:
1. In "Mail Policies -> HAT Overview", add a new sendergroup. You can title it something like "Temporarly_Accept". Then add this as a sender, ".comcast.net". You are adding this hostname, IP address or IP address.
2. Order this new Sendergroup so that it above the "Blacklist sendergroup".
3. Create the following message filter below
4.
temporary_accept:
if ( mail-from == '(?i)joe@company.com' )
{
deliver();
}
5. Then create a message filter that enforces the blacklist sendergroup policy:
6.
enforce_blacklist_sbrs:
if ( reputation < -2 )
{
drop();
}
Warning: The order of the message filters are important, so make sure that filter #4 is above #6.
Here is a summary of what the above HAT Overview sendergroup and message filters do. The new HAT Overview Sendergroup was created (Step #1) so that it can be used to allow messages from a low-scoring SBRS host into the Ironport.
Next, the first message filter (Step #4) is created so that messages from specific email senders can be allowed into the machine.
The last message filter (Step #6) was put in place so that the low SBRS score of the sending MTA could be enforced and dropped if the connecting host has a low SBRS score.
References:
1. How do I add a new message filter to my IronPort Appliance?
http://tinyurl.com/mg8kp
Well I'll weigh in as well. We currently throttle -0.4 to -1.9 and block -2 to -10. We have 30,000 mail users and have had very few problems.
We have had 2 C600's in place for over two years and have had a few issues where we needed to whitelist a company. We will whitelist a company but not an ISP. If they are hosted and we can't find a way to just let their stuff in they the burden falls back to them. If you have uppermanagements buy off on this then stick to your guns and don't let it in. Our current clean message percentage is between 1 and 3%. If we were to loosen the belts per se then we would get flooded with calls over everything that we are now letting in. Unfortunately its a catch 22. Your gonna hear about it one way or another.
