To mitigate the processing load from messages sent to invalid recipients, the Cisco Secure Email Gateway uses LDAP for recipient verification. This is a two-step process. First, an LDAP server profile must be created, which defines the connection details for the external directory server (e.g., IP address, port, base DN, bind credentials). Second, this profile is used to configure an LDAP query on the listener's Recipient Access Table (RAT). This enables the gateway to query the LDAP server during the SMTP RCPT TO transaction and reject connections for non-existent recipients before accepting the full message, thereby saving system resources.

A. Enable external LDAP authentication: "Authentication" verifies user credentials (username/password). The task is recipient validation (checking if an address exists), which is a different function.

D. Enable LDAP authentication on a listener: This is incorrect for the same reason as option A. The term "authentication" is not precise for recipient validation.

E. Configure incoming mail policy to query LDAP server: Mail policies are processed after the gateway accepts the message. Rejecting at the listener level is far more efficient for handling invalid recipients.

1. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: In the "Using LDAP Queries" chapter

the guide states

"To use LDAP queries

you must first create an LDAP server profile." This supports option C.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: Using LDAP Queries

Section: Creating an LDAP Server Profile.

2. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: The same guide explains how to use the created profile: "You can configure listeners to query an LDAP server to determine whether or not a recipient address is valid." This is configured in the Recipient Access Table (RAT). This supports option B.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: Using LDAP Queries

Section: Using an LDAP Query to Accept or Reject Connections to the Listener.

3. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: The documentation distinguishes between different uses of LDAP. LDAP for authentication is described for functions like end-user quarantine access

which is separate from recipient validation on a listener. This clarifies why options A and D are incorrect.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: System Administration

Section: End-User Quarantine Access.