Allow Only Certain Emails From Constant Contact?

donaldmonteith · ‎02-19-2015

I have some users who have chosen to use Constant Contact as a mailing list for a professional association, however all those emails are bounced as Marketing by my Ironport appliance. I'm trying to figure out a way to get these emails through without having to whitelist the entire constantcontact.com domain since these emails are only a small slice of what comes in from Constant Contact (with most of the rest being complete junk). Almost all of the wanted emails contain at least a similar string of text within the Body or Subject, so I thought about setting up a new Incoming Content Filter looking for that string AND coming from constantcontact.com with Skip Remaining Content Filters as the Final Action, but I know Content Filters are applied AFTER SPAM scanning and I'm not sure it would work anyway.

Anybody run into anything like this and have a way to help?

Mathew Huynh · ‎02-19-2015

Hey,

If you know the string you're looking for and the sender is from constantcontact you can go forward with the content filter if you're most comfortable with it.

Even if the content filters are being taken in account after anti-spam we can organise to create a custom incoming mail policy, where if sender is from @constantcontact.com or so, it will use this policy./

Then on this policy for anti-spam settings, you can set Marketting emails to deliver rather than quarantine/drop.

Then it should no longer be actioned by your existing setup (unless you have a content filter dropping/bouncing these emails, then you can disable this content filter JUST for this policy).

<<Not required unless you want to handle marketting emails differently >>

Then click on 'advanced' for marketting email (this is found inside the anti-spam setting for the policy in GUI > Mail Policies > Incoming Mail Policies).

Then add a custom header if you want to take action on the emails in a different manner (can be ignored if you simply want to deliver it as it is).

If you decide add a customer header, name it something conventional life X-Marketting

(You can skip the content filter if you simply just want to deliver all marketing email)

Then on your content filter, you'll have the conditions you created with the message body -> contains -> the string

Envelope sender -> contains -> @constantcontact.com

Other Header -> X-Marketting -> Exists

> Other action you can implement

Hope this helps

donaldmonteith · ‎02-20-2015

I actually have Marketing emails set to Bounce. I'm not really keen on changing that except to maybe Quarantine or drop them. I really don't want to deliver these as I consider them a risk and my users have a real bad habit of just clicking on things that I have not yet been able to break them of.

What if I set the Incoming Policy for Marketing to Deliver with an Add Text to Subject rule that Prepends "Marketing Message" (or something like that), then applied 2 Incoming the Content Filters. One would look for "Marketing Message" PLUS "<the text string>" PLUS Envelope Sender that contains "constantcontact.com" and has a Final Action of Skip Remaining Content Filters. The second would be applied after that one and would only look for the text string "Marketing Message" with a Final Action of either Bounce or Quarantine or Drop (something like that). Would that work or even be advisable?

Paul Cardelli · ‎02-20-2015

I actually agree with Mathew, even if you have Marketing set to bounce, unless you have it set in the message filters, your content filter will see the message before it is actually bounced. I did not realize this before.

You can test this by setting up a test policy Quarantine, and duplicate the message as the last action form your ESA.

Set your condition as Mathew stated
for actions choose to modify the header X-Marketting as the first action. You may want to setup a test mail policy to yourself or a test subject to minimize issues while testing. You can then see how the message was modified (avoiding the bounce action).
duplicate the message to your policy quarantine
Finally drop the message for now (until your done testing)

Then once you feel confident you are capturing all the targeted messages in the policy without all the other junk your already dropping you can remove the duplicate and drop rule.

donaldmonteith · ‎02-23-2015

No kidding? Huh.

I think I'll try that out and get back to you guys. Thanks, guys!

Mathew Huynh · ‎02-24-2015

Hey Donald,

Sorry haven't had time to review this thread.

Like Paul mentioned, you can always set it to 'deliver as is' on the anti-spam setting, if you truly do want to bounce them.

Use the X-Header setup and run a content filter which will bounce emails that contains the X-Marketting header so it will not really change your setup :)

But this way you have some flexibility to allow certain emails should this header exist from a certain sender, but bounce everything else.

Anyhow, keep us posted :)

donaldmonteith · ‎02-26-2015

I'll definitely keep you guys posted, but it may be a while before I know if it TRULY worked. These particular emails really only come in MAYBE once a month. Usually once a quarter.

Thanks guys!

Mathew Huynh · ‎02-26-2015

Hey Donald,

No worries :) I hope it all works out though.

Regards,

Matty