ESA | Search rejected connection thru Domain not working

[ccg-security]

Hello Team,

Search rejected connections using Domain is not working, while Sender IP Address is working.

[dmccabej]

Hello,

You may be trying to search by mail-from domain instead of the domain of the connecting server. We do not have the mail-from (envelope sender domain) in the logs at the time of rejection, so you would need to search by connecting server domain/fqdn.

For example :

Mail-From: user@gmail.com

Rcpt-To: user@example.com

Sender-IP: 1.1.1.1

Server FQDN: smtp1.google.com

Domain to search for :

google.com

Thanks!

-Dennis M.