Cisco Talos is a cloud service that provides a reputation verdict for email messages based on the sender domain and other attributes such as IP address, sender behavior, message content, and attachment analysis. Cisco Talos is integrated with Cisco Secure Email Gateway and provides real-time threat intelligence and protection against spam, phishing, malware, and other email- borne threats.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-0/user_guide/b_ESA_Admin_Guide_13-0.pdf P.402

DKIM verifies message integrity using a cryptographic signature. If headers or body content are modified after signing, validation fails. SPF may still pass because SPF validates sending server authorization rather than message integrity.

To trust the TLS connection with an external party using its own internal CA, the engineer must enable a custom list on the Network > Certificates page and upload the external CA's certificates.
This allows the Cisco Secure Email Gateway to validate and trust certificates signed by that internal CA.

The Spam Quarantine (also known as ISQ) and End-User Quarantine (also known as EUQ) provides a safeguard mechanism for organizations that are concerned about "false positives".
https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true