Force specific IP for a specific domain

[Escimo]

Hello,

In order to increase security for a specific domain, we need to restrict email sending from sender@example.com to only be able to send us emails from IP xyz. Is this possible using Ironport/ESA?

We usually rely on DMARC with DKIM and SPF alignment, but in this case we cannot.

[Ken Stieers]

You can't force it, you can only decide to drop mail from that doamin that didnt come from a specific IP, and there is no mechanism to tell the remote system to resend/retry.

The ESA doesn't give you the option of making that decision until the message is in the work queue, so the sending system has sent it, it has completed its part of the transaction.

Put yourself in the sending systems shoes... how would their system tell yours to only send via a specific IP?

You can call them/email and come to an agreement for them to do that... maybe?

[Andres Vega · Accepted solution]

You can configure a message filter to drop the messages when the remote IP address of sender@example.com is not the one you are expecting from. 

MF_Example:
 if (mail-from == "sender@example.com") AND ((not(remote-ip == "192.168.10.10")) { drop(); }

MF_Example:
 if (mail-from == "sender@example.com") AND (remote-ip != "192.168.10.10")) { drop(); }

if there's more than one IP address, then you can have multiple ways to do it, I like the approach of creating a Sender Group and adding the IP addresses and later using the "sendergroup" rule to drop the message if the sender IP address is not matching the SG you created for that sender.

MF_Example:
if (mail-from == "sender@example.com") AND ((not(sendergroup == "3RDPARTY")) { drop(); }

As Ken mentioned in his reply, once the message is dropped by the ESA the sender side, cannot retry so the best option is to agree with them on sending the messages from some specific IP addresses, and at the same time deploy filters or other mechanisms on your side to make sure messages from that sender are coming from the agreed IP addresses.

[Escimo]

Thanks for an excellent answer. I will try this solution, seems like it will work. 

The specific SMTP servers are of course agreed upon already.