01-30-2020 03:00 AM - edited 01-30-2020 03:13 AM
Hi,
we need to reject incoming mail going to certain group mailboxes (of which there are many). These group mailbox addresses all start with z_, zz_ or zzv_ (for example, z_someGroup@domain.com). Unfortunately, neither the RAT nor the mail policies allow for using wildcards or RegEx in the address fields.
So we built an incoming content filter that looks like this:
if (rcpt-to == "^(v|zz|zzv)_.*@.*.de(?i)") { bounce();
This works fine as long as the only envelope recipient in an incoming mail is matching the RegEx. However, if there are more than one envelope recipients in the mail and only one of them matches the RegEx, the content filter bounces all recipients, even those not matching the RegEx.
For example:
One incoming mail has two recipients: 1. z_someGroup@domain.com, 2. joe@domain.com. Content filter bounces both mails.
How can we prevent this?
Thanks
01-30-2020 03:58 AM - edited 01-30-2020 07:07 AM
You want a separate incoming mail policy, with these as recipients. If you have too many, you can add them to a group and add that group as an LDAP lookup in the recipient selection. (Doesn't have to be mail enabled)
Mail policies splinter emails that come in with multiple addresses into one copy for each policy that applies, so you don't run into this issue.
01-30-2020 04:12 AM
Thanks Ken,
I was looking at mail policies but they don't support RegEx. Doing it through an LDAP group is a good idea. I'll look into that.
Thanks!
01-30-2020 04:47 AM
You need to splinter the messages prior to processing.
search for message splintering.
Regards
Marc
01-30-2020 01:41 PM
It's not ESA config but we do this for almost all of our Exchange Groups. We set the Groups to accept mail from authenticated senders only in Exchange. That way the groups will drop mail from any sender that's external.
01-31-2020 03:28 AM
Hey Shane,
that's a pretty good idea. Unfortunately, we are instructed to block these mails on the perimeter. For whatever reason :)
Thanks!
02-06-2020 09:47 PM
Hello,
try to use Content filter and Dictionary (you can use python regex).
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide