@amazonses.com

[jheadley]

We were getting hammered with unwanted messages that companies are using Amazonses.com to send their messages.  What we did was drop alll messages with @amazonses.com in the Sender field.  However we have found there are legitimate messages that originate from @amazonses.com so I need to be able to allow them through. 

I tried adding an Incoming Content Filter at the top of the filters and put in a keyword to bypass further filters.  This has worked with messages from Constant Contact because the sending address has a consistant piece of the address I can use as the key word.  However what I have found is the Amazon messages are always different.

The messages are coming from Right Signature and should have a from address of documents@rightsignature.com but I am not seeing that any were in the message details.  I removed the filter to block @amazonses.com messages and received a test message in Outlook and when I look at the header information it shows the From: address as documents@rightsignature.com so i need to figure out how to filter for that information that Ironport is not showing in the message details.

Attached are the message details for one the was blocked and one that was received.

[Stephan Bayer]

Hi Jamie,

I noticed in your message tracking example the mail-from is from XXXXXXXX @email.amazonses.com

So, if I'm understanding correctly you should be able to add '@email.amazonses.com to the same mail policy as constantcontact.com specifying @email.amazonses.com as a sender. This regular expression will match any address with that ending...

Regards,

Stephan

[jheadley]

Unfortunately that will allow ALL messages from @email.amazonses.com to come through.  The sender address always changes so I can not filter on that.

Here is an example:

000001428fce32eb-1cf1584a-0dbf-4c7f-92f6-e2c79e4d6dc1-000000@email.amazonses.com where everything before the @ changes for each message.

I tried to filter for rightsignature when it is in the Sender field but that does not work.  I tired this because when I remove @amzonses.com from content filter messages come through and when I looked at the header of the message in Outlook it showed that in the From: field.

[Stephan Bayer]

Hi Jamie,

I imagine there must be a way for the message to have a mail-from that is from a domain other than the default.

Please check with Amazon SES resources such as this one.

http://sesblog.amazon.com/

If you can get the mail-from email address to be changed the above recommendation should work.

Also, If you could open up a case with TAC with a copy of the original message we can take a look to see if there are any other options.

http://www.cisco.com/support

US Toll Free Customer Support +1 800 553 2447 Option #1

Thanks.

Stephan

[Stephan Bayer]

it looks like once you verify your domain with Amazon SES the  mail-from will change.

http://stackoverflow.com/questions/10866971/customize-amazons-ses-remove-amazonses-com

http://docs.aws.amazon.com/ses/latest/DeveloperGuide/easy-dkim.html