We've have had a 5510 for a while now and I can't seem to work out how to address the following problem.

We have a public subnet set up as the 2nd IP on the 5510 and a mail server configured with one of our pool of public addresses (i.e. no NAT for the mail server).

I want to intercept email destined for our server. Then...
1 Destroy any emails from senders on a list in a keyword group.
2 Destroy any emails containing keywords from another keyword group.
3 Pass (without subjecting to the Grey List) any mails from a group of trusted senders in another keyword group.
4 Put everything else through the Grey List and then the external Spam filter.

In short Black list some addresses and subjects, white list some other addresses and Grey List everything else.

I can't seem to achieve this. I can get the parts to work independently but not together. I either end up passing all sorts through or subjecting known senders to the Grey List which can cause significant delays.

I think I must be missing something obvious but I can't figure out what it is.

Any help would be greately appreciated.


Sean.