Mail Security rules

[bot 1]

Hello,

 

How would one apply a rule to block zip files, and ignore certain recipients?

 

Is this format correct for a NOT rule:

 

forbidden archive attachments rule

check message recipient

check attachment name

NOT "email1@domain.com" "email2@domain.com" <-- (should this be NOT ("email1@domain.com" OR "email2@domain.com")??)

*.7z;*.ace;*.arj;*.bz2;*.cab;*.dbx;*.gz;*.lha;*.msi;*.rar;*.sis;*.tar;*.zip;*.exe

take action for uncleaned threat/unsolicited email

 

Is there a more efficient way to exclude certain recipients/senders from rule filtering? I believe any AS exclusions (approved senders etc) would be performed after a rule check.

Thank you for your assistance.

Edited December 10, 2013 by bot

[Chadh 45]

Hello bot,

 

Thank you for your patience.

 

I believe any AS exclusions (approved senders etc) would be performed after a rule check.

 

You are correct, Rules will apply before the Antispam Engine filters the email.

 

For the By message recipient condition to work as expected, the value needs to be defined using the following syntax: “usera@contoso.com” OR “usera” (with the quotes included). For example: “Richard.Parker@contoso.com” OR “Richard Parker” (with the quotes included).

 

Next, you need to use operator OR for additional email addresses. For example: “Richard.Parker@contoso.com” OR “Richard Parker” OR “John.Doe@contoso.com” OR "John Doe" (with the quotes included).

 

To achieve your desired result, you will need to create two rules; this can’t be accomplished with only one rule. You need the following rules:

 

Rule 1:

• By message recipient
• condition: "usera@contoso.com" OR “usera” OR "userb@contoso.com" OR “userb”
• action: “No action”
• Evaluate other rules: leave unchecked (ensures to skip all other rules)
• Scan by AS: leave checked
• Scan by AV: leave checked

Rule 2: (Rule 1 MUST be a higher priority than Rule 2)

• By attachment type: *.7z;*.ace;*.arj;*.bz2;*.cab;*.dbx;*.gz;*.lha;*.msi;*.rar;*.sis;*.tar;*.zip;*.exe

Thank you,

ChadH