Cisco ESA allow specific sender domain

[jrct7]

I'd like to configure Cisco ESA for allowing only a  specific sender domain 

Thanks for your support

[Ken Stieers]

Can you give us more information? What's the bigger picture?

Lots of ways to accomplish this, but what is best will depend upon what you're trying to do.
P

[jrct7]

Hello Ken,

We have a cluster of six ESAs that works for outgoing mails only.  We need to filter the domain of outgoing emails to a specific one. (for example, user@mycompany.com)

I'd like to know if that's possible and how to do it. Can you help me with that please?

[Nasreen Al Haddad]

I understand that you want to allow only one domain to send through the ESA for outgoing emails

You can create an outgoing content filter with the following rule :

Envelope Sender : does not end with --> @mycompany.com
Action : Quarantine

It's advisable to use quarantine action for testing purposes instead of drop

Make sure to assign the outgoing filter to your outgoing mail policies

[jrct7]

Hello Nasreen, 

Thank you for the reply. 

May I configure this in the relay policies?

[Nasreen Al Haddad]

Since this is an ESA which handles Outgoing Mail only ,then this filter should be an outgoing content filter assigned to your outgoing mail policies as the ESA is acting as RELAY 

Let me know if you have any questions or need any clarification 

Best Regards, 

[jrct7]

Thanks @Nasreen Al Haddad 

The client told me that it was 3 domains intead 1. So in that case, when I add more than one domain, the apply rule option appears with two conditions:

if one or more conditions match and only if all conditions match.

Which one should I choose so that only emails are sent from the domains I entered?

[Nasreen Al Haddad]

If you need to except multiple domains then there should be an AND rule between them which is equivalent to "only if all conditions match."

mail-from != "domain1$"
mail-from != "domain2$"
mail-from != "domain3$"

let's assume for example that you are sending from domain4 which you want to block and evaluate the conditions :

mail-from != "domain1$" ----> True
mail-from != "domain2$" ----> True
mail-from != "domain3$"----> True

then action will apply

If you need more help please let me know