The HAT entry looks fine. You'll also need to put in a message filter that will grab the sendergroup and mail flow policy when the message is coming in.
Also, I'd recommend your quarantine it and go over the msgs that get put in there. This way, you can review your catch of the day. Once you feel confident that it's matching what you intended you can drop them.
Insert Policy into Header Filter
Show which mail flow policy accepted the connection:
Policy_Tracker:
if (true)
{
insert-header ('X-HAT-SG", '$Group');
insert-header ('X-HAT-MailFlowPolicy', '$Policy');
}
Prerequisite is that you have an entry in the HAT, with "Connecting host PTR record does not exist in DNS." enabled (say you call it "NoPTR"). Then you add a mail filter, that adds the HAT to the e-mail through an X-header (let's say we take X-HAT-SG).
Conditions:
mail-from == "^$"
header("X-HAT-SG") == "^NoPTR$"
Action:
quarantine or drop"
Has anyone used this or have any other suggestions?
