Cisco IronPort AsyncOS 7.5 for Email Daily Management Guide
Chapter 2 Using Email Security Monitor
Email Security Monitor Pages
Incoming Mail Details Listing
The top senders which have connected to public listeners of the appliance are
listed in the External Domains Received listing table at the bottom of the
Incoming Mail page, based on the view selected. Click the column headings to
sort the data. See Categorizing Email, page 2-9 for an explanation of the various
The system acquires and verifies the validity of the remote host’s IP address (that
is, the domain) by performing a double DNS lookup. For more information about
double DNS lookups and sender verification, see the “Configuring the Gateway
to Receive Email” chapter in the Cisco IronPort AsyncOS for Email Configuration
The Sender Detail listing has two views, Summary and All.
The default Sender Detail view shows the total number of attempted messages for
each sender, and includes a breakdown by category (the same categories as the
Incoming Mail Summary graph on the Overview page: number of clean messages,
stopped by reputation filtering, invalid recipients, spam detected, virus detected,
stopped by content filter). It also shows the total number of threat messages
(messages stopped by reputation or stopped as invalid recipient, spam, and
The value for Stopped by Reputation Filtering is calculated based on several
- Number of “throttled” messages from this sender.
- Number of rejected or TCP refused connections (may be a partial count).
- A conservative multiplier for the number of messages per connection.
When the appliance is under heavy load, an exact count of rejected connections is
not maintained on a per-sender basis. Instead, rejected connections counts are
maintained only for the most significant senders in each time interval. In this
situation, the value shown can be interpreted as a “floor”; in other words, at least
this many messages were stopped.
The Stopped by Reputation Filtering total on the Overview page is always based
on a complete count of all rejected connections. Only the per-sender connection
counts are ever limited due to load.
Additional columns that you can display are: