Message filter to determine if multiple recipients from a list.

[Tony Kilbarger]

So, I have a request asking if I can ( using our Cisco Ironport ESA's) redirect email to a different recipient if the following conditions are met:

1 - it is addressed to a specific recipient at our domain. (user@mydomain.com)

2 - It is also addressed to 4 or more recipients from a list of perhaps 20 defined recipients. These are primarily outside of our domains.  So they may be user2@someotherdomain.com, user3@anotherotherdomain.com, etc).  These ideally could be a combination of To and CC addresses.

I played around with an incoming mail filter using a dictionary for the list of recipients.  I could do an Other Header dictionary match on the "To" header but I cannot specify number of matches.  I also can't look at both the To header and CC header in some way to combine the counts.

I assume this will require a message filter entered using the CLI but I am pretty new to those.

Any ideas or advice?

Thanks in advance.

[syeda3]

Please refer to the User guide for Message filters to enforce email policies.

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa10-0/ESA_10-0_User_Guide.pdf#M11.9.95150.Title.Using.IronPort.Message.Filters

Hope to help

[Ken Stieers]

Regrettably, threshold searches for the headers can't be done.

(taken from the help file for 10.0.0)

[Libin Varghese]

Hi Tony,

I do not think this could be configurable as dictionaries work on first match wins. So once it validates one of the recipients in the dictionary it would not look at the further recipients to consider number of matches.

You can certainly use a message filter to get a count of recipients.

if (rcpt-count == 5) AND (rcpt-to == "user@mydomain\\.com")
{
alt-rcpt-to ("redirectuser@mydomain\\.com");
}

Thanks
Libin Varghese