01-15-2021 06:05 AM
Hi:
I have a strange issue that honestly I don't know how to solve.
Before opening a case I'm asking here to check if anybody can shed some light on it, I guess the problem is me.
In default policy I have a content filter with the following rules (both of the conditions must be true)
Other Header Reply-To exists
Header Reply-To does not equal $envelopesender
And actions:
Log
Quarantine-duplicate
Add Disclaimer text
Whenever I enable this filter in the default policy ALL of the messages with a reply-to header match the filter and get duplicated to quarantine and disclaimer text added, no matter if the reply-to is the same or different to the envelopesender
I tried several things like use "does not contain" instead of "does not equal" and using $envelopefrom instead of $envelopesender, but without luck. Is there something obvious I'm missing? I've seen examples of doing this everywhere, and it sounds to me that it's correct
Another test I did is to put the content filter in another policy, and apparently it works fine, it's happening when the filter is in the default. Any idea?
Solved! Go to Solution.
01-19-2021 04:37 AM
I just received the answer from TAC: apparently it is not supported, because in message/content filters the system cannot compare two variables.
Would you do me a favour and check if this effectively working in your environment? I honestly don't know what to think, because this is something I've considered possible for some time and not it surprised me a lot.
01-15-2021 07:01 AM
Hi Miguel,
our working sample is like this :
GUI_Check_From_ReplyTo: if (rcpt-to == "marc.luescher@fmc-na.com") AND (header("reply-to")) AND (header("reply-to") != "^$envelopefrom$") { add-heading("External_Warning_ReplyTo"); add-heading("External_Warning_ReplyTo_Fields"); insert-header("X-Ironport-Spoof", "yes"); }
Please check and let me know if that helps.
-Marc
01-15-2021 08:39 AM
01-15-2021 08:55 AM
What are your settings in mail policies / mail policy settings.
Do you have P1 and P2 visible ?
01-15-2021 09:07 AM
01-15-2021 09:15 AM
what ESA Release are you running ?
01-15-2021 09:43 AM
01-15-2021 09:23 AM
It does not matter priorities, the only thing I can come to is the following:
Have sender "someguy@domain.com"
Sends from Outlook and inserts header Reply-To: Some Guy <someguy@domain.com>
When message arrives, filter compares "someguy@domain.com" (the $envelopefrom variable) with "Some Guy <someguy@domain.com>" and fails, so the rule is true and all the conditions match.
I just tested the following: configure second rule to compare estrictly to "Some Guy <someguy@domain.com>" instead of $envelopefrom and now it matches, so second rule it's false and won't insert the heading ... It's very strange for me.
01-15-2021 10:26 AM
let me think about this as we use the same sw version in production and it is working as expected
01-15-2021 12:02 PM
01-19-2021 04:37 AM
I just received the answer from TAC: apparently it is not supported, because in message/content filters the system cannot compare two variables.
Would you do me a favour and check if this effectively working in your environment? I honestly don't know what to think, because this is something I've considered possible for some time and not it surprised me a lot.
12-20-2022 09:10 AM
Hi Miguel,
Were you able to find a solution for that?
I am trying to compare mail-from (sender address) with from header, to advertise end user if both are different.
Impossible to compare (as if ESA does not understand the $envelopefrom variable in may filter)
thanks
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide