This happens when the mail server is set to accept mail from another host. Therefore, spam goes directly to the mail server without passing through the ProtectLink Gateway Email Protection servers.
In order to resolve the issue, please follow the below instructions:
Redirect your emails to the ProtectLink Gateway Email Protection servers:
yourdomain.com. 3600 IN MX 10 in.sjc.mx.trendmicro.com
Note: Insert your actual domain name in place of "yourdomain". If you do not know how to modify mail exchange (MX) records, contact your ISP helpdesk or DNS technician for assistance.
The full transition (DNS propagation) may take up to 48 hours. It is recommended that you continue any on-premise security during the transition. You may still receive emails directly until the transition is complete.
Restrict your firewall to accept mail only from the IP ranges of the ProtectLink Gateway Email Protection mail servers:
If you still receive spam, gather the actual spam samples in MSG or EML format and put them in a password-protected ZIP file (password: novirus). Send the ZIP file to http://homesupport.cisco.com/en-us/support.