Mail Bouncing

[ajay1969]

Hi 

Attached Mail log which is bounced need reason and how to allow this email to be whitelisted.

Regards

Ajay Sharma

[Dustin Anderson]

By the log, it was bounced by CASE (Cisco Anti-Spam Engine) so it thought it was spam.

1) I would not bounce suspected spam and quarantine it. Bouncing can let bad actors know it failed and to try new tactics. And in this case if it was quarantined you could release it.

2) Whitelist. This can be done in the HAT (Host Access Table) First part is to go to Mail Polices and Mail Flow Policies and create a policy that turns off spam detection. 

Second go to Mail Policies and HAT Overview and create a new sender group and call the policy to bypass CASE. you then add the server to bypass it.

The issue with this is by your example they use office, so adding .outbound.protection.outlook.com would allow anything from any office user to bypass spam detection.

[Donald Nash]

I wouldn't use the HAT for this since, as Dustin pointed out, the mail originated from Microsoft's infrastructure. You could use a message filter to check the MAIL FROM address and skip the anti-spam based on that. Or you could create an incoming mail policy that matches that address and disables anti-spam.

Nit picking: CASE = Context Adaptive Scanning Engine. The name goes back to before Cisco bought IronPort.

++Don