Cisco Secure Email

Fromenance is a communication provenance platform that answers forwards sent to verify@yourdomain.com. On Cisco Secure Email (the Email Security Appliance and Cloud Gateway, formerly IronPort), the redirect can be a content filter with the Alter Delivery action or a redirect behind the gateway on your mailbox platform.

By the end you will have chosen the placement, configured the redirect, DKIM signing confirmed for the outbound copy, and the forwarding test marked Working.

Choose where the redirect lives

Placement	When to use	Authentication Fromenance sees
Behind Cisco, in Google Workspace or Microsoft 365	Default. Cisco filters inbound; the platform redirects and signs	Platform DKIM or ARC for your domain
In Cisco, as an incoming content filter that alters delivery	The mailbox platform cannot redirect, or you want no mailbox at all	Cisco outbound DKIM signing for your domain

Option A: redirect behind Cisco

1. Mail Policies, Incoming Mail Policies: make sure verify@yourdomain.com is on a policy whose anti-spam action is deliver (with a subject prefix if you like) rather than quarantine, and whose Advanced Malware Protection and attachment filtering allow message/rfc822 attachments. Customers forward .eml files.
2. Configure the redirect on the mailbox platform: Google Workspace or Microsoft 365.
3. If Cisco is your outbound relay, Mail Policies, Outgoing Content Filters: any filter that adds a disclaimer must exclude recipients matching @verify.fromenance.com. Create a filter with condition Envelope Recipient ends with @verify.fromenance.com and action Skip Remaining Content Filters, and order it first.

Option B: redirect in Cisco

1. Mail Policies, Incoming Content Filters, Add Filter. Name fromenance_verify_redirect.
2. Condition: Envelope Recipient, Ends With or Is, verify@yourdomain.com.
3. Action: Alter Delivery, Alter Recipient To (the alt-rcpt-to action), value northfield@verify.fromenance.com. This rewrites the envelope recipient only; the sender and headers are untouched. Do not use Bcc or Send Copy To, and do not use a mailbox forward on the platform.
4. Add a second action Skip Remaining Content Filters so no disclaimer filter runs afterwards.
5. Apply the filter to the incoming mail policy that covers your domain and commit changes.

Because the message now leaves the appliance with an external sender and an external recipient, the appliance treats it as relayed mail. Confirm the outbound path:

6. Network, Listeners: the outbound listener’s Mail Flow Policy must allow relay for mail originating from the redirect. On a single listener deployment this is the default; on a two listener deployment add a rule so that recipients under verify.fromenance.com are accepted for relay from the incoming listener (Network, SMTP Routes, add verify.fromenance.com to route through your normal outbound path).
7. Mail Policies, Signing Profiles (DKIM): create a domain signing profile for yourdomain.com, generate the key, publish the selector TXT record, and enable DKIM Signing on the Mail Flow Policy that carries the redirected copy. The copy must be signed with your domain, or the forwarding test fails with auth_failed (unsigned) or domain_not_owned (signed with the appliance hostname domain).

Confirm with the forwarding test

1. Setup wizard, step 4, Send test, or POST /v1/domains/{id}/forwarding-test.
2. Status should read Working via dkim yourdomain.com within a minute.
3. failed: auth_failed with a body hash mismatch: a disclaimer or footer was stamped after signing, or the filter order lets a later filter touch the message. Check the Skip Remaining Content Filters action and the outgoing filter order.
4. Nothing arrives: Monitor, Message Tracking, search for the recipient verify@yourdomain.com; the tracking detail shows which filter or policy held it.

Then forward any message from a personal mailbox to verify@yourdomain.com and confirm a Not verified reply arrives.