Bypassing message filter

[cyberurmel]

Hello all, 

i have a message filter set which allows only a max amount of mails in a time space and if they are more - then they are send to a quarantine. It works fine.. 

But now it exists a new mail-server for special messages only outgoing to world which sends a lot of messages.

They are divided in mails are divided in internal recipients which is showing to ESA and the world recipients directly sent.

So all out sended  are not the problem ..its an own way.. but for internal recipients the ESA receive them and handle them like sent to outside and quarantine them with my message filter. 

Is there a way to bypass that in a way to say : Mails from IP x.x.x.x /and /or with recipient domain is @test.com is handled before the message filter is used? 

Thanks and Regards

[Ken Stieers]

There are a couple of ways to do what you're looking for depending upon what you actually implemented:. 

1. in the actual message filter you wrote, you could add the exception for the "From" header or ip.

2. Under Mail Policies/Mail Flow Policies, create a new mail flow policy, turn OFF message filters for that policy, and then create a Sender Group under Mail Policies/HAT Overview, select the mail flow policy you just created and then add the IPs you need.  This can only be applied based on what IP it came from, not the recipient or From address. 

The problem with number 2 is that it turns off ALL message filters for this sender, so if you're doing other things in message filters, this will turn them all off for that sender ip. 

[cyberurmel]

Hello Ken, 

thanks first of all. My Code with help from the community here looks like that :

if header-repeats('mail-from', 30,
'outgoing') {
notify
("own.mailadress");
notify ("$EnvelopeFrom");
quarantine("SPAM");
}

how do you mean to adjust with exception for the IP ? Can you give me a hint please or link where i can read that to learn more? 

Think had to add something like and not coming from IP X  or?

Thanks 

Regards