Cisco Email Security Appliance

Simple Mail Filter on How to Quarantine a Message

Document ID: 118139

Updated: Jul 31, 2014

Contributed by Jason Sikorski and Stephan Bayer, Cisco TAC Engineers.




Can you provide an example mail filter on How to Quarantine a Message?


Below is an example of a correctly written filter for quarantining certain messages:

if (mail-from == 'foo@bar\\.org')


When creating a message filter or content filter, keep in mind the difference between final and non-final filter actions.

Non-final actions allow additional actions to be applied by the current filter and subsequent filters. 

A final action stops the current message from being processed further.

There are three (3)  final actions:

  • drop()
  • bounce()
  • deliver()

When writing a filter to quarantine a message, it is important not to use a final action after quarantining the message. Doing so will release the message from the quarantine so the final action can be performed.

For more information about message filters, see the AsyncOS Advance User Guide on the Cisco Support Site.

Updated: Jul 31, 2014
Document ID: 118139