Content Filters: drop mails to certain recipients (RegEx)

[cryptochrome]

Hi,

we need to reject incoming mail going to certain group mailboxes (of which there are many). These group mailbox addresses all start with z_, zz_ or zzv_ (for example, z_someGroup@domain.com). Unfortunately, neither the RAT nor the mail policies allow for using wildcards or RegEx in the address fields. 

So we built an incoming content filter that looks like this:

if (rcpt-to == "^(v|zz|zzv)_.*@.*.de(?i)") { bounce();

This works fine as long as the only envelope recipient in an incoming mail is matching the RegEx. However, if there are more than one envelope recipients in the mail and only one of them matches the RegEx, the content filter bounces all recipients, even those not matching the RegEx. 

For example:

One incoming mail has two recipients: 1. z_someGroup@domain.com, 2. joe@domain.com. Content filter bounces both mails. 

How can we prevent this?

Thanks

[Ken Stieers]

You want a separate incoming mail policy, with these as recipients. If you have too many, you can add them to a group and add that group as an LDAP lookup in the recipient selection. (Doesn't have to be mail enabled)

Mail policies splinter emails that come in with multiple addresses into one copy for each policy that applies, so you don't run into this issue.

[cryptochrome]

Thanks Ken,

I was looking at mail policies but they don't support RegEx. Doing it through an LDAP group is a good idea. I'll look into that. 

Thanks!

[marc.luescherFRE]

You need to splinter the messages prior to processing.

Check : https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01001.html#con_1121454

search for message splintering.

Regards

Marc

[shane.dollery]

It's not ESA config but we do this for almost all of our Exchange Groups. We set the Groups to accept mail from authenticated senders only in Exchange. That way the groups will drop mail from any sender that's external.

[cryptochrome]

Hey Shane,

that's a pretty good idea. Unfortunately, we are instructed to block these mails on the perimeter. For whatever reason :)

Thanks!

[marcin.nawrocki]

Hello,

try to use Content filter and Dictionary (you can use python regex).