Setting Up Forged Email Detection
Identify the users in your organization (for example, executives) whose messages are likely to be forged. Create a new content dictionary and add the names of the identified users to it.
While creating a content dictionary,
Enter the name of the user and not the email address. For example, enter "Olivia Smith" instead of "[email protected]."
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_chapter_010101.html#co n_1260492