What to whitelist on Incoming Mail policy - envelope-from=,x-sender= (or) From:

[pbabu6001]

Please find the below header of the email and suggest which email address needs to whitelist under Incoming mail policy (datasend@example.com or files@example.com)?

envelope-from="datasend@example.com"; x-sender="postmaster@example.com"; x-conformance=spf_only; x-record-type="v=spf1"
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: 
X-IPAS-Result: 
X-Ironport-AS: Suspect
X-IronPort-AV: E=Sophos;i="5.39,279,1493679600"; d="scan'208";a="41784298"
Received: from ........................................................................................................................................................
Received: by ........................................................................................................................................................
To: user@domain.com
From: files@example.com
Subject: Download track
Content-Type: text/plain
Message-Id: <..........................................................................>
Date: Thu, 1 Jun 2017 13:15:34 +0100 (BST)

Also, I have observed that I am unable to find email logs from "files@example.com". But, found on spam quarantine.

Thank you!

[Libin Varghese]

Hi,

Both the envelope sender and From header are checked when processing incoming mail policies.

However, envelope sender takes preference over the From header and it is recommended to use "datasend@example.com", if confirmed through message tracking that this is the envelope sender. I would not rely on only the headers to confirm the envelope sender.

Thank You!

Libin Varghese

[Libin Varghese]

To clarify on the last point, the from header in not recorded in the message tracking and mail_logs as the email is processed based on the envelope sender and envelope recipient.

You should be able to track the email in tracking and logs using the envelope sender.

- Libin V