Block and Unblock the .zip and .rar files based on doamin or user account base on incoming mails with ironport email security.

[lingaraj19]

Hi All,

Request you all to help me out in blocking/dropping only the attachments with the extension .rar and .zip in incoming mails for particular users or domains.

as of now I have did for all the domains or users.However, I want to unblock it only for some particular/specific users and for rest it should block.

kindly help me with the steps to do the configuration.

Thanks a ton in advance

Regards,

LRN

[srussell]

It sounds like you just need to use different incoming mail policies per group of individuals you want to block/drop .rar and .zip and those which you don't want this to happen.

The fact that you want a specific group to be allowed receipt of these and everyone else should have these blocked I would recommend creating an additional incoming mail policy that does NOT have a content filter that performs this blocking.  Add the appropriate users to this incoming mail policy.  Then create a incoming content filter that does this dropping of .rar and .zip files and apply this to the Default Incoming Mail Policy.

The content filter in this situation would not need a condition, just a action of strip attachments by file info , filename contains  .rar or .zip

Here is a useful regex for the content filter action:  (?i)\.(zip|rar)
 

Hope this helps!

Steve