I am curious to see if this is possible:
we have configured that if an email has score more than 40 MEG will "deny connection"
So the ip-address sending this email will be put in "blocked connections" for 300 seconds.
Suppose a user via MQM define a blacklist sender i.e. email@example.com, this will "comunicated and configured" on the MEG appliances.
Then, when MEG receive an email from firstname.lastname@example.org, it will deny the connection and put the cisco MX server on "blocked connection".
So suppose this user is receiving an email every 2 minutes from email@example.com, all the enterprise will never receive emails from @aol.com that are delivered from the same server that deliver firstname.lastname@example.org.
Ok quite unprobable, but to be thought if users will blacklist a lot.