Introduction
This document describes why the sending IP address of an Email Security Appliance (ESA) can have a low SenderBase Reputation Score (SBRS) and how this can be fixed.
Why does the sending IP address of my ESA have a low SenderBase Reputation Score (SBRS) and how can this be fixed?
SenderBase scores are attributed to IP addresses and range from -10 to +10, reflecting the likelihood that a IP address is trying to send spam. Highly negative scores indicate senders who are very likely to be sending spam; highly positive scores indicate senders who are unlikely to be sending spam. When companies first begin to use Cisco's SenderBase Reputation Service, they may discover that SBRS score for their Mail Transfer Agent's (MTA) is "None" or in low positive territory. An enterprise discovering that they have a "None" or low positive score should not be concerned. Cisco never recommends that mail be throttled or blocked for any positive score. A typical MTA score in the range of 0 to 3.5 is nothing to be concerned about. "None" or low positive scores may reflect any of a number of factors including:
- Lack of history for a particular IP address
- Low volume of mail for a particular IP address
- Low or occasional history of complaints for a particular IP address
Negative scores, however, are a cause for concern. They indicate that the IP address in question has had numerous complaints, appears on DNS-based blacklists, or is otherwise suspected of sending spam. The basic strategy for resolving a negative SenderBase score calls for removing the IP address from DNS-based blacklists that contribute to negative scores. Also, ensure to find the root cause for being blacklisted and clean up any possible infected Spam sending hosts within your network. Using the SenderBase web interface (www.senderbase.org), you can enter the IP address and research blacklists which have the address listed. If the IP is not listed in any blacklists, or you need help determining the reason for a negative SBRS score, then contact customer support.
Related Information
Feedback