You can customize or reset the X-header text by using the Email Security - Server appliance Web UI or CLI:
For details about the default X-headers and the associated verdicts, see About the X-header.
Note
When changing the X-header, be aware of these results:
If the X-header is modified after the email is processed with the default X-Header on the Email Security - Server appliance, the email does not contain the new X-header and the verdict when it is released from the quarantine.
The X-header feature marks the email headers that are present at the time the email reaches the Email Security - Server appliance. If the X-header title and the header text string are frequently modified, the quarantined emails will show different X-headers for the same verdict depending on the X-header configuration at the time the email reaches the appliance.
If a block notice that has the default X-header text string is sent to the Email Security - Server appliance after modifying the X-header (for example, X-Trellix to X-MyCompany), the current X-header text string is also added to the email header and the default X-header text is not changed.
Important
When the Central Management System appliance is used to manage your Email Security - Server appliance, use backslashes (\) to escape double quotation marks if the header text string contains spaces, as shown in the following configuration command examples:
cmc execute appliance <appliance_name> command "email-analysis policy xheader mal-att\"This email contains a malicious attachment\""
cmc execute group <group_name> command "email-analysis policy xheader mal-att\"This email contains a malicious attachment\""
After you change the X-header, use the email-analysis mta smtp start command in CLI configuration mode to restart the SMTP interface.
Important
Do not change the X-header while the appliance is processing email traffic.
Usage Guidelines
Follow these usage guidelines when you customize the name of the header title and the content of the header message:
The name of the custom header title must contain at least three characters and begin with the uppercase character X-.
The name of the custom X-header title can contain up to 32 characters. Do not include spaces in the X-header title.
The content of the custom X-header message can contain up to 128 characters.
Custom X-header text can include letters (a–z, A–Z), numbers, dashes (-), slashes (/), underscores (_), spaces, and commas (,). When specifying an X-header text string that contains spaces, enclose the string in double quotation marks.
The custom X-header text string cannot contain a period (.).
Prerequisites
Administrator or Operator access to the Email Security - Server appliance.
Verify that the Email Security - Server appliance is deployed in Block analysis mode or Monitor analysis mode. Use the
show email-analysiscommand. For details about how to configure Block analysis mode or Monitor analysis mode, see Configuring the analysis mode using the Web UI or Configuring the analysis mode using the CLI.Disable the X-header feature if it is enabled. Use the
show email-analysis policycommand. For details about how to disable the X-header feature, see Enabling or disabling the X-header using the Web UI or Enabling or disabling the X-header using the CLI.Enable the advanced X-header feature to insert the riskware X-header line. See Enabling or disabling the advanced X-header using the CLI.
Stop the SMTP interface temporarily during maintenance activities before you change the X-header. Use the
email-analysis mta smtp stopcommand to stop the SMTP interface. Verify that the emails in the hold queue are completely processed before you change the X-header. For details about how to stop or restart the SMTP process, refer to the "Maintenance Support" section of the Email Security — Server System Administration Guide.