Ironport

What is the IronPort?

All incoming and virtually all outgoing email (with the exception of listservs) pass through the IronPort appliance. The IronPort is the main filtering mechanism for spam and email virus filtering.

To check what has been filtered from your acount go to: http://myspam.williams.edu

How does the IronPort work?

The IronPort email appliance accepts, throttles, and blocks emails depending upon the sending domain’s reputation score. The IronPort uses SenderBase (http://www.senderbase.org) to determine these reputation scores. Reputation scores are based upon a number of criteria:

  • spam complaints
  • blacklists
  • drastic changes in the number of emails sent
  • other factors

If the score for a sending domain or IP drops below 0, the IronPort automatically throttles incoming mail from that domain/IP. If the reputation score is extremely poor the IronPort will block incoming emails coming from that domain/IP.

Once the score is above 0, the IronPort will automatically resume normal connection rates with that domain/IP.

What can the email sender do if the IronPort is blocking/throttling their email?

  1. The best thing to do is to have the sender contact their ISP to have them fix the problem. Usually there is a “Contact Us” link on the ISPs website which will allow communication to tech support. The user can then forward the bounced email to the ISP and ask them to fix.
  2. The user could temporarily send an email using another email provider (gmail, hotmail, etc).

Can’t Networks and Systems just whitelist the domain?

  1. No.
    Whitelisting a domain means that we leave our network vulnerable to attacks. Once the sending domain’s reputation restored to a satisfactory score, the IronPort will automatically start accepting email at a normal rate from that domain.