Cisco Email Security Appliance (ESA) – Handling Incoming and Outgoing Messages Differently

The Email Security appliances uses two different sets of mail policies for message content security:

• Incoming mail policies for messages are messages received from connections that match an ACCEPT HAT policy in any listener.
• Outgoing mail policies for messages are messages from connections that match a RELAY HAT policy in any listener. This includes any connection that was authenticated with SMTP AUTH.

Cisco Email Security Appliance (ESA) pipeline

Cisco Email Security Appliance (ESA) message flow