PDF(29.0 KB) View with Adobe Reader on a variety of devices
Updated:October 13, 2014
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document describes why the sending IP address of an Email Security Appliance (ESA) can have a low SenderBase Reputation Score (SBRS) and how this can be fixed.
Why does the sending IP address of my ESA have a low SenderBase Reputation Score (SBRS) and how can this be fixed?
SenderBase scores are attributed to IP addresses and range from -10 to +10, reflecting the likelihood that a IP address is trying to send spam. Highly negative scores indicate senders who are very likely to be sending spam; highly positive scores indicate senders who are unlikely to be sending spam. When companies first begin to use Cisco's SenderBase Reputation Service, they may discover that SBRS score for their Mail Transfer Agent's (MTA) is "None" or in low positive territory. An enterprise discovering that they have a "None" or low positive score should not be concerned. Cisco never recommends that mail be throttled or blocked for any positive score. A typical MTA score in the range of 0 to 3.5 is nothing to be concerned about. "None" or low positive scores may reflect any of a number of factors including:
Lack of history for a particular IP address
Low volume of mail for a particular IP address
Low or occasional history of complaints for a particular IP address
Negative scores, however, are a cause for concern. They indicate that the IP address in question has had numerous complaints, appears on DNS-based blacklists, or is otherwise suspected of sending spam. The basic strategy for resolving a negative SenderBase score calls for removing the IP address from DNS-based blacklists that contribute to negative scores. Also, ensure to find the root cause for being blacklisted and clean up any possible infected Spam sending hosts within your network. Using the SenderBase web interface (www.senderbase.org), you can enter the IP address and research blacklists which have the address listed. If the IP is not listed in any blacklists, or you need help determining the reason for a negative SBRS score, then contact customer support.