The graymail engine classifies each graymail into one of the following categories:

• Marketing Email. Advertising messages sent by professional marketing groups, for example, bulletins from Amazon.com with details about their newly launched products.
• Social Network Email. Notification messages from social networks, dating websites, forums, and so on. Examples include alerts from:
  • LinkedIn, for jobs that you may be interested in
  • CNET forums, when a user responds to your post.
• Bulk Email. Advertising messages sent by unrecognized marketing groups, for example, newsletters from TechTarget, a technology media company.

• For graymail detection, anti-spam scanning must be enabled globally. This can be either the IronPort Anti-Spam, the Intelligent Multi-Scan feature, or Outbreak Filters. See Anti-Spam.

• For safe unsubscribing,

  • Add the safe unsubscribing feature key.

  • The end user machines must be able to connect to the cloud-based Unsubscribe Service directly over the Internet.

You can enable Graymail Detection and Safe Unsubscribing at the machine, group or cluster level.

The IronPort-PHdr header is added to all messages that are processed by the Graymail engine when:

• Graymail engine is enabled globally on the appliance .

• Graymail scanning is enabled for a specific mail policy.

  Note	If Graymail scanning is not enabled for a specific mail policy, the IronPort-PHdr header is still added to all messages, if the Graymail engine is enabled globally on the appliance .

The IronPort-PHdr header contains encoded proprietary information and is not customer-decodable. This header provides additional information about debugging issues with your Graymail configuration.

Note	If Anti-Spam engine or Outbreak Filter is enabled for a specific mail policy, the IronPort-PHdr header is added to all messages that pass through the specific mail policy.

If you do not want to apply graymail actions on certain messages, you can use the following message filters to bypass graymail actions:

The following example specifies that messages received on the listener “private_listener” must bypass graymail actions on social network emails.

internal_mail_is_safe:
if (recv-listener == 'private_listener')
{
skip-socialcheck
();
}

You can view data about detected graymail using the following reports.

If you had enabled Marketing Email Scanning under anti-spam settings for a mail policy, after upgrading to AsyncOS 9.5 or later, keep in mind that:

• The number of marketing messages is a sum of marketing messages detected before and after the upgrade.
• The total number of graymail messages does not include the number of marketing messages detected before the upgrade.
• The total number of attempted messages also includes the number of marketing messages detected before the upgrade.

If you have enabled service updates, scanning rules for the graymail management solution is retrieved from the Cisco update servers. But in some scenarios (for example, you have disabled automatic service updates or automatic service update is not working), you may want to manually update graymail rules.

To manually update the graymail rules, do one of the following:

• In web interface, go to Security Service > IMS and Graymail page, and click Update Now.
• In CLI, run the graymailupdate command.

To know the details of existing graymail rules, see the Rule Updates section of the IMS and Graymail page in web interface or use the graymailstatus command in CLI.

When an end user clicks on unsubscribe link, the Unsubscribe Service displays a Cisco branded Unsubscribe page indicating the status of the unsubscribe process (see How Safe Unsubscribing Works). You can customize the appearance of the Unsubscribe page and display your organization’s branding (such as company logo, contact information, and so on) using Security Services > Block Page Customization. For instructions, see Customizing the Notification That End Users See If a Site Is Malicious.

If the end users in your organization have configured Safelist for their own email accounts, graymail messages from a sender in the safelist will not be scanned by the graymail scanning engine. For more information about Safelists, see Using Safelists and Blocklists to Control Email Delivery Based on Sender.

The graymail detection and safe unsubscribing information is posted to the following logs:

• Graymail Engine Logs. Contains information about the graymail engine, status, configuration, and so on. Most information is at Info or Debug level.
• Graymail Archive. Contains archived messages (the messages that are scanned and associated with the “archive message” action). The format is an mbox-format log file.
• Mail Logs. Contains information about graymail detection and addition of banner for safe unsubscribing. Most information is at Info or Debug level.

Problem

After clicking on the Unsubscribe link, the end user sees the following message: “Unable to unsubscribe from...”

Solution

This problem can occur if the Unsubscribe Service is unable to perform the safe unsubscribe on behalf of the end user. The following are some of the common scenarios in which the Unsubscribe Service is unable to perform the safe unsubscribe:

• Unsubscribe URI or mailto address is wrong.
• Websites that require the end users’ credentials to unsubscribe.
• Websites that require the end users to confirm the request of unsubscribing by logging into their email accounts.
• Websites that require captcha to be solved and the Unsubscribe Service is unable to solve the captcha.
• Websites that require interactive unsubscribing.

The end users can use the URL provided at the bottom of the unsubscribe page to unsubscribe manually.