Incoming mail policy recipient rmatching, and vs or

[Evan M]

When defining an incoming mail policy and specifying recipients, there is the option for "If one or more conditions match" which translate to an OR evaluation for any recipients listed under "following recipients" as well as the option for "Only if all conditions match", which translate to an AND evaluation for any recipients listed under "following recipients"

Using an example where two email addresses are specified under "following recipients"--user1@domain.com and user2@domain.com--how is the evaluation of AND vs. OR handled?

I've always used "if one or more conditions match" (OR) and my policies have always matched as expected.

But now I am curious how "Only if all conditions match" (AND) is evaluated. Given that fact that message splintering occurs as needed, and the user guide says each recipient is evaluated individually during splintering, what impact does using the AND have?  It doesn't seem like it would have any impact.

[Libin Varghese]

Hi,

The selection of "Only if all conditions match" would result in true only if a single email contains all recipients listed. If all recipients are present in a single email, the email itself would not be splintered since it would match a single mail policy.

If 2 of 3 recipients match this policy the email would be splintered into two, one for the 2 recipients and one for the unmatched recipient.

Examples for mail policy entries are provided in the end user guide (Page 10-9 onwards).

https://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa10-0/ESA_10-0_User_Guide.pdf

Regards,

Libin V