Mail Policies allow ldap user in security group

[balmis]

I'm using SEG Virtual C300V and there have a policy to allow email who are in our MS AD only.

One email user in below group and tested in LDAP server profile>Accept Query>Test Query

OU=MIS,OU=OFFICE,OU=BALANCE,DC=BALANCE,DC=network  (All user under OU)
CN=Domain Users,CN=Users,DC=BALANCE,DC=network  (security group)

but not pass my policy in Incoming Mail Policies> Find Policies

If the distribution group is fine

CN=EmailGroup,CN=Users,DC=BALANCE,DC=network  (distribution group)

Is there any problem in setting?

[Ken Stieers]

Based on your first sentence, if you only want mail to be accepted if the account exists in AD, then use an accept query, which is the top option in your LDAP profile. Then enable that in the Listener, under Network/Listeners, pick your inbound listener, near the bottom is LDAP queries.
Then if the mail is coming in for an account that doesn't exist the Listener can drop it before actually getting the whole email... saves a TON of processing.
Your Accept query should just be (proxyAddresses=smtp:{a})
That's basically "any email addresses in the system".
Pointing that at a group is more work that needed...
This won't show up in the "find Policies" because it's actually happening BEFORE policies and isn't actually configured there.