I would like to see if it is possible to replace the recipient domain

[tperkins99]

I would like to see if it is possible to replace the recipient domain though a content rule using the Cisco Cloud Gateway.

For example:

Email received addressed to testuser@testdomain.com

Address replaced with testuser@testdomain.mail.onmicrosoft.com

Just the domain of the recipient is changed.

Thanks.

[Ken Stieers]

Yes there's a "change recipient to" action.
But if you're doing a lot of different emails, you might want to look at doing it with a message filter.

[tperkins99]

It would need to be something that accepts a regex query as I just need to domain changed for any user (there are thousands).

[Ken Stieers]

You may want to look at the Domain Map feature.
Its covered in the online help, or here:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0-2/user_guide/b_ESA_Admin_Guide_16-0-2/b_ESA_Admin_Guide_12_1_chapter_011010.html#con_1108422

[tperkins99]

Thanks for the reply. It would need to be for a subset of users (an LDAP group associated with a filter), not every address in the original domain.

[Ken Stieers]

Add/edit header with a search and replace... driven by an incoming or outgoing Mail Policy, so only recipients with the wrong email are touched. This will take advantage of splintering...
Ex: I send an inbound mail with 2 recipients, 1 that needs it this change, 1 that doesn't.
If its just content filter in the default policy, that To: header will have both emails on it, and both might get edited.
If there's a policy that matches on the To:, the ESA will create 2 copies, one for each address on the To: line, and send them down the appropriate policy path... only one of which has the search and replace...

[tperkins99]

Understood. In this case, these are single recipient emails from a specific sender, so this should not be an issue. I am unsure of how to formulate the query for the domain replacement. Any insight would be much appreciated.

[Ken Stieers]

in the content filter, set an action as Add/Edit Header, the header is "To", the search for is @testdomain.com, and the Replace with is @testdomain.mail.onmicrosoft.com