using a content policy, but not for all-inbound-mails(domains)

[peter-forum-21]

Hello, 

the owner have  C195 and he have 4 email-domains.

Question:  Is it possible to enable the URL-Malware-demasking-rule only for inbound-company3.com and company4.com Mails?   Thx in advance!

company1.com

company2.com

company3.com

company4.com

[Udupi Krishna.]

I am assuming you are referring to URL-defang action?. If yes, absolutely. You can setup message or content filter. An easiest e.g. 

condition - recipient domain == "inbound-company3.com" OR "company4.com" then enforce URL defang based on the reputation score range selected. (refer to attached image)

[Ken Stieers]

The right way to do it is to create a mail policy that applies to mail with the recipients of company 3 and company 4.  Then enable the content filter so it runs for these mails.

You can do it as a condition in the content filter, but then it will still affect mail that is addressed to people in multiple companies, even it it only applies to one of them (e.g. a mail to someone@company1.com and someone@company3.com will be defanged). 

If you create a mail policy then the mail is splintered, and only the copy to company3/4 get affected.