Sender Based Reputation Score

BCHCAdmin
BCHCAdmin used Ask the Experts™
on
We recently implemented an Ironport eMail and web filtering solution when we switched ISPs.  It seems to be working very well but just in the last few days our Sender Based Reputation Score has shown  up as being poor.  So some sent emails have been rejected to vendors that I'm pretty sure are using the same IronPort solution which uses SBRS filtering.  So my question is - how do I find out why our score has turned to "poor".  I've checked our virus application and I'm not seeing any issues with viruses (at least that it reports).  Is there another way to check to see if a computer on our network may be sending out spam email?   There is no spike or anything alarming on our Ironport machines.  
Could it be something else causing this?  Any help would be very much appreciated.  I want to stop this before it gets worse - especially if its something on our network causing this.   Also - we are using a Cisco ASA firewall.

Thanks!

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
On thing you can do is to do an open relay check on all your IP addresses (external) using something like this

http://www.checkor.com/

That will verify that external people are not able to SMTP through your gateway/mail servers

Also check to see that your IP address(s) are not blacklisted,

http://www.mxtoolbox.com/blacklists.aspx

I like that service - but you can just google "email blacklist check" to find other services.

Sometimes if only one or two blacklists have your IP, you find sporadic results that may be similar to what you are experiencing.
Have you check-ed hostname with which Ironport sends email? Does this match with the reverse and forward DNS information?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial