DomainKeys and DKIM Authentication
With DomainKeys or DKIM email authentication, the sender signs the email using public key cryptography. The verified domain can then be used to detect forgeries by comparing it with the domain in the From: (or Sender:) header of the email.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010101.html?bookSea rch=true

To integrate Cisco Secure Email with Cisco Secure Endpoint and block zero-day threats, the engineer must enable File Reputation Filtering (to check files against Cisco's threat intelligence) and File Analysis (to send unknown or suspicious files to Threat Grid for sandboxing and behavioral analysis). These two settings work together to detect and block zero-day malware.

Undesirable URL protection is a feature that allows Cisco ESA to detect and block messages that contain URLs that lead to malicious or unwanted websites, such as phishing, malware, or adult content sites. To enable this feature, outbreak filters and antispam scanning must be enabled on Cisco ESA.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01111.html

Graymail management uses an integrated graymail scanning engine to identify graymail categories and a cloud-based unsubscribe service to process unsubscribe requests safely for supported messages.