Have you raised a ticket? If not I'd suggest you do this and include a copy of the return message that you're getting complete with the mail headers. We should then be able to assess why it's happening and hopefully sort it out for you.

A character string has been placed in the subject header of all emails that needs to be encrypted. This string is [LOCKIT]
Enter the syntax that is needed to search for this string in the Condition Menu of the content filter.

Answer: subject == "^\\[LOCKIT\\]" is this correct?

What command string from a sending MTA, tells a recieving MTA that a new mail transaction is about to occur and who it is coming from?

Answer: HELO is this correct

After an installation of an ESA, you need to verify that it will be able to access the Active Directory server my.ad.server.com. What CLI command string would you enter to verify this?

Not sure what command tring i would Enter?

After installing an IronPort email appliance, you need to verify that it has SMTP access to your internal mail server smtp.myserver.com. You do this by logging into the appliance cli and entering a test string. Enter that string below.

Not sure of the answer?

last question, the high lighted item what I think is correct only, but would love to confirm

A character string has been placed in the subject header of all email that needs to be encrypted. The string is [SECURE]. Which of the following options in the subject header menu of the content filter conditions must be chosen to trigger this filter?

(please confirm asnswers) select all that apply and we selected only 1 item.

(Select all that apply), i think contains (correct only) but I can be wrong

Does not contain
Ends with
Does not begin with
Contains (correct)
Does not equal
Begins w
Equals
Does not end with

please help me with these questins, very much limited info out there and I am hoping you will be able to help.

thank you in advance
Ala Al-khouri
ala.al-khouri@hotmail.com

@Mark G, not on an individual basis it isn't. IronPort do have training addresses that you can forward emails to though and we'll probably decide to start forwarding email sent to our spam training addresses to them at some point. Have you checked the headers of this message though as there's a chance it came via Postini (we haven't switched it off yet).

I got spam from Frontierpharmacies.com about some blue pills. Clearly spam.

Was pleased to hear of this solution...

It is a shame that those who are so quick to critise this solution and think your intend is to break what is perceived as a fixed solution don't really appreciate the time and human effort it has taken to help rid us all of a problem created by a small number of destructive people.

Well done:)

An internal problem is open regarding this (ref: 54522), however the problem is due to the reputation of Demon's mail servers. From what I can tell they have four that are used for domain forwarding:

213.253.179.5 - Good
213.253.179.6 - Good
213.253.179.7 - Poor (Critical)
213.253.179.8 - Poor (Very High)

The value after each IP address is the servers current reputation. As you can see, some of them are really bad - http://www.senderbase.org/senderbase_queries/rep_lookup?search_name=213.253.179.7&action%3ASearch=Search

This doesn't seem all that dissimilar to the problems we've had with uk2.net in the past (although the senderbase reputation of their servers wasn't quite as bad as this).

We'll try getting in touch with Demon (have you queried this with them yourselves?), and assess whether or not we can put any measures in place at this side to sort this out for you.

In the meantime, you might want to consider switching spam protection off on your account. This would result in your email completely bypassing the spam filters (but would also result in an increase in the volume of junk email that gets through to you).