Guest

Cisco Email Security Appliance

ESA SenderBase Reputation Score Determination

Document ID: 117919

Updated: Jul 11, 2014

Contributed by Jackie Fleming, Cisco TAC Engineer.

   Print

Introduction

This document describes how the SenderBase Reputation Score (SBRS) for your ESA is determined.

Prerequisites

Cisco recommends that you have knowledge of these topics:

  • Cisco Email Security Appliance (ESA)
  • All versions of AsyncOS

SBRS Determination

The SBRS is based on an IP address's overall reputation for sending email on the Internet. SenderBase incorporates a number of variables into the score. Some of these variables are: spam traps, public blacklists, user complaints, and volume data.

The SBRS is rated from +10 to -10, where positive scores indicate a good reputation and negative scores indicate a bad reputation. The further the number is from zero, the more data supports that determination. IP addresses that have a SBRS of  None are senders who send a very low volume of mail or where there is not enough data yet in order to determine a score.

Senders who suddenly have a large, percentage increase in mail volume will see their scores drop one to two points. This is because spammers and infected hosts often suddenly begin sending massive amounts of mail. If the IP address in question is new and sends legitimate mail, the score will start to rise in a few days.

ESAs have the ability to block or rate-limit messages from senders based on the SBRS of the connecting IP address. The exact SBRS range and action varies from installation to installation. The most common configuration is to rate-limit scores of  None and slightly negative scores, while more negative scores are blocked.

You can get general SenderBase information from http://www.senderbase.org. This site includes any blacklist listings that affect the SBRS of a given IP address. However, only Cisco customers and employees can discover the exact SBRS of a given IP address. If further information is needed on a given IP address, contact Cisco Support.

Updated: Jul 11, 2014
Document ID: 117919