Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

SPAM and content filters

In order to ensure SPAM gets sent to the spam quarantine and skips susequent filters, we have implemented somehting similar to what is outlined below:

1. Edit the Antispam settings in your mail policies. Set

'Positively-Identified Spam Settings' > 'Apply This Action to Message' to deliver.

2. Set 'Add Custom Header' to 'X-Ironport-Quarantine'.  The value can be anything. (i.e. True)

3.  Create a Content Filter checking for this header, and if it exists,  skip all following filters (Deliver). Or modify your existing filter not  to match when that header exists.

Background:   Any message containing a X-Ironport-Quarantine header will be delivered  to the spam quarantine instead the recipient destination. A quiet  common way to redirect messages to that quarantine with a filter.

My question concerns what happens when a user requests the message and it is released from quarantine?  Will it be delivered without going through Anti-Virus and content filtering? 

Everyone's tags (2)
Cisco Employee

SPAM and content filters

From the ISQ - released messages proceed directly to the destination queue, skipping any further work queue processing in the email pipeline.

See the Daily Management Guide for full details:

Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide

This is in the "Delivering Messages in the Cisco IronPort Spam Quarantine" section.

Hope this helps!


(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)