Senders or Recipients in conditions

[Guillermo Hurtado]

Hi Team

Please let me know if there is a limit to add conditions with envelope senders or recipients in the Incoming - Outgoing Content Filters.

We have an Email Security Appliance.

Regards!

[Ken Stieers]

I wasn't able to find one... keep in mind you can use dictionaries instead of just editing them in the filter, so that may make more sense/be easier to maintain.



The other thing to keep in mind is how you want the filter action to apply to an email that is to several recipients.

If an email comes in with 5 recipients in your company, and the incoming POLICY applies to all of them (e.g. the Default Policy), but the content filter only applies to one of them, they ALL get a mail with whatever action the content filter applied is.



If you create a policy with the recipient as the addresses that need this specific filter, set everything to match the default policy, but just turn on a specific content filter, when a mail comes in for multiple people, the ESA will "splinter" the message so that only the people that need the filter get it. This happens EARLY in the process, before antispam or any of the other filters..

Search for "splintering" in the help.

[ppreenja]

Hi Guillermo,

There is no hard-coded upper limit for the number of conditions per filter, one can create a filter using as many conditions as he needs.
However, setting too many conditions will impact system performance of the ESA appliance.
Hence, you can make use of the dictionary option under Mail Policies-->Dictionaries and call the dictionary for the recipient/sender condition if the same action is required to be performed on the same.
If you require different action for different senders/recipients, you can configure multiple mail policies and make use of the "message splintering" option.
Please find below article to know more about message splintering:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118488-technote-esa-00.html

Regards,
Pratham