Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

We were getting hammered with unwanted messages that companies are using to send their messages.  What we did was drop alll messages with in the Sender field.  However we have found there are legitimate messages that originate from so I need to be able to allow them through. 

I tried adding an Incoming Content Filter at the top of the filters and put in a keyword to bypass further filters.  This has worked with messages from Constant Contact because the sending address has a consistant piece of the address I can use as the key word.  However what I have found is the Amazon messages are always different.

The messages are coming from Right Signature and should have a from address of but I am not seeing that any were in the message details.  I removed the filter to block messages and received a test message in Outlook and when I look at the header information it shows the From: address as so i need to figure out how to filter for that information that Ironport is not showing in the message details.

Attached are the message details for one the was blocked and one that was received.

Cisco Employee

Hi Jamie,

I noticed in your message tracking example the mail-from is from XXXXXXXX

So, if I'm understanding correctly you should be able to add ' to the same mail policy as specifying as a sender. This regular expression will match any address with that ending...



New Member

Unfortunately that will allow ALL messages from to come through.  The sender address always changes so I can not filter on that.

Here is an example: where everything before the @ changes for each message.

I tried to filter for rightsignature when it is in the Sender field but that does not work.  I tired this because when I remove from content filter messages come through and when I looked at the header of the message in Outlook it showed that in the From: field.

Cisco Employee

Hi Jamie,

I imagine there must be a way for the message to have a mail-from that is from a domain other than the default.

Please check with Amazon SES resources such as this one.

If you can get the mail-from email address to be changed the above recommendation should work.

Also, If you could open up a case with TAC with a copy of the original message we can take a look to see if there are any other options.

US Toll Free Customer Support +1 800 553 2447 Option #1



Cisco Employee

CreatePlease to create content