Explicit SPAM Exception against CRM Integration

[Shivbala]

Looking for possibilities where I can integrate Ironport SPAM filtering against our CRM portals such as Zoho, Freshworks, salesforce etc to whitelist our customers emails against SPAM filtering policy.

Any inputs?

[haydan]

If the goal is to target emails coming from CRM platforms and allow them to bypass the Anti-SPAM, you'll need to use a Message Filter as this occurs before the IPAS in the mail flow path. I setup a similar filter last year that allows select salesforce.com emails to bypass the Anti-SPAM engine. Typically with CRM or mass mailing platforms (ie: sendgrid.net), the envelope sender will contain a client ID which is represented in the form of a series of numbers. For example; "Client_ID"=domain@salesforce.com 3242325=domain.com@salesforce.com The client ID can be used as the identifiable condition. If you have many entries, you can use a dictionary combined with regex to get the best results. Here's some sample regex that would work. SPAMBYPASS_Sendgrid if (mail-from ="(?=\b789458\b)(?=.*(?i)sendgrid.net$)") Another condition option if you want to use dictionaries. SPAMBYPASS_Salesforce: if ((mail-from-dictionary-match("Salesforce_Senders", 1)) AND (mail-from == "(?i)salesforce\\.com$")) OR (mail-from-dictionary-match("Salesforce_Hosts", 1)) The actions will be the same. { skip-spamcheck(); log-entry("$FilterName"); skip-filters(); }

[marc.luescherFRE]

We approached the problem as part of our DMARC implementation project.

Every external trusted sender must have a valid DKIM key.

While this took some time to get all our 10+ Salesforce instances to be compliant it allowed us to leverage basic message filters afterwards to trust our own Salesforce email(s).

CLIHeader_Salesforce_I6_v4: if (header("DKIM-Signature") == "xxxxxsalesforce") AND (mail-from == "donotreply@salesforce.com")) {
log-entry("--CLIHeader_Salesforce_I6_v4--");
insert-header("X-IronPort-ApplicationHeader", "Defaultv2");
add-heading("External_Warning_TrustedApp");

skip-spamcheck();

}

This can be done for 95% of all externals enders and you will end up with good controls.

-Marc