Bounce Profile

[Mike Kwilosz]

Could someone walk me through how I can configure a single domain to be capable of sending outbound email with a 1 day bounceback timeout.  I think currently we have a global setting for 6days.  But we have one domain in particular who thinks this is too long and would prefer if we could make it so they are notified that there is a bounceback in only 1 day.

Thanks,

Mike

[Rehan Latif · Accepted solution]

Hi Mike,

Settings about soft and hard bounces are configured under GUI -> Network -> Bounce Profiles. In you situation, you need to create a new bounce profile with "Maximum number of seconds in queue" set to 86400 seconds (1day).

The bounce profiles can be attached to a message at three places:

1. Listeners - While IronPort receives a message

2. Message Filters - While the message is processed by the appliance

3. Destination Controls - When IronPort queues a message for delivery.

In your situation, newly created bounce profile should be attached to that message using message filters will give you desired results. Message filters can be configured only via CLI using following:

CLI -> filters -> new

Following filter will help you in simply attaching a bounce profile (in this example "fastbounce") to a message coming from a domain "@yourdomain.com".

fastbounce:
if (sendergroup == "RELAYLIST") AND (mail-from == '(?i)@yourdomain\\.com$')

{
bounce-profile ('fastbounce');
}

Hope this will help.

Regards,

Rehan Latif

CSE

Cisco IronPort Customer Support

[Mike Kwilosz]

Thank you for the reply!

I applied this message filter and it did the trick!  Thank You!

Mike

[Greg Muszynski]

---

Following filter will help you in simply attaching a bounce profile (in this example "fastbounce") to a message coming from a domain "@yourdomain.com".

fastbounce:
if (sendergroup == "RELAYLIST") AND (mail-from == '(?i)@yourdomain\\.com$')

{
bounce-profile ('fastbounce');
}

---

I don't understand why you are using \\ double backslashes in your regular expression for the email address domain isn't that saying

@yourdomain\.com

[ppreenja]

Hi Greg,

"\" is the escape character used in the regular expressions.

The behavior in which we add a regex using a backslash in syntax content, but then added with an additional backslash is normal, as the use of the backslash character differs across content filters and message filters. Because the backslash is first parsed by the ESA filters engine, and then passed to the Python regex engine, all backslash characters must be doubled.

Within the message filters, we need to escape all regular expressions with two backslashes.
However, within the content filters, we need to insert only one backslash to escape for example a dot, the appliance will insert a second backslash at the time you submit the condition/action to the filter.

Regards,
Pratham