This document describes how the SenderBase Reputation Score (SBRS) for your ESA is determined.
Cisco recommends that you have knowledge of these topics:
Cisco Email Security Appliance (ESA)
All versions of AsyncOS
The SBRS is based on an IP address's overall reputation for sending email on the Internet. SenderBase incorporates a number of variables into the score. Some of these variables are: spam traps, public blacklists, user complaints, and volume data.
The SBRS is rated from +10 to -10, where positive scores indicate a good reputation and negative scores indicate a bad reputation. The further the number is from zero, the more data supports that determination. IP addresses that have a SBRS of None are senders who send a very low volume of mail or where there is not enough data yet in order to determine a score.
Senders who suddenly have a large, percentage increase in mail volume will see their scores drop one to two points. This is because spammers and infected hosts often suddenly begin sending massive amounts of mail. If the IP address in question is new and sends legitimate mail, the score will start to rise in a few days.
ESAs have the ability to block or rate-limit messages from senders based on the SBRS of the connecting IP address. The exact SBRS range and action varies from installation to installation. The most common configuration is to rate-limit scores of None and slightly negative scores, while more negative scores are blocked.
You can get general SenderBase information from http://www.senderbase.org. This site includes any blacklist listings that affect the SBRS of a given IP address. However, only Cisco customers and employees can discover the exact SBRS of a given IP address. If further information is needed on a given IP address, contact Cisco Support.