What is IronPort-PHdr Mail Header?

Question: What is IronPort-PHdr Mail Header?

Applies To:

Cisco Email Security Appliance (ESA aka Ironport) ver 9.6.0-042

Answer:

ESA now has new feature called Gray Mail. Which classifies marketing, social media and bulk mailing and allows you to take an action for those mails.

The new IronPort-PHdr is added for Gray Mail classification. The value of the header is too long, you cannot miss it if you take look at the header!

Currently IronPort-PHdr is added by Out Break Filters NOT by Gray Mail feature. Which means Gray Mail works with Out Break Filter process although this is not documented. (For example URL Filter works with Out Break Filters too but this process is documented.)

And Out Break Filters applies after the content filters in e-mail pipeline process. That means, IronPort-PHdr header is added after content filter operations.

More Info:

Email Pipeline Flows section on User Guide for AsyncOS 9.6 for Cisco
Email Security Appliances

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-6/ESA_9-6_User_Guide.pdf

Advertisements
Gallery | This entry was posted in Cisco Email Security (Ironport) and tagged , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s