Whitelist a whole domain in IronPort C370?

[David Rahmn]

Hi!

I have a customer that can't send emails to us cause of bad reputation.  Not sure how am going to whitelist their domain.

Their domain is: domainABC.com

Their SMTP servers is A.domainXYZ.com, B.domainXYZ.com, C.domainXYZ.com.

What should i put in the HAT - Whitelist?

domainABC.com? domainXYZ.com? A, B, C.domainXYZ.com? The IPs of the SMTP-servers?

Thanks for the help!

[Tom Foucha · Accepted solution]

To whitelist or blocklist any domain including subdomains use .domainABC.com, the "." in front of domainABC.com instructs any sub domain as well. Now you have to understand if domainABC.com is sending from their own servers. If they are using a hosted system that is shared by others it could create issues. Generally it would be advisable to get the IP address of the servers with the bad reputation and put them in a temporary allow list. I say allow because if you use the default whitelist please understand it by default does not do spam scanning.

Tom

[David Rahmn]

Hi!

Thanks for the answer! So if i white list the domain: ".domainABC.com". Can anyone with a sender address of *domainABC.com email us? In this case it would be easy to just spoof the sender address.

I actually did what you said and just whitelisted the IP of the bad SMTP-server and it started ti work again. I will remove them from the whitelist in a while.

Thanks!

[Tom Foucha · Accepted solution]

On the spoofing depends on where you whitelist the domain and if you have it configured to perform reverse DNS validation. 

White listing the IP is not bad unless that IP also sends mail for other domains as well. 

Both methods have good points and bad points. 

Glad your mail is flowing again!

[David Rahmn]

Ok, then i understand!

Thank you so much for the help Tommy!