Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

message filter problem

Hi,

The filter below works very well but when I add OR (sendergroup != "ALLOWSPOOF") part it does not. It begins to quarantine messages.

WORKS-

Spoofed_Email_Filter: if (recv-listener == "IncomingMail") AND ((header-dictionary-match("spoof-domains","From", 1)) AND
(sendergroup != "ALLOWSPOOF")) {
                          insert-header("X-Ironport-Quarantine", "SPOOF
from[$EnvelopeFrom]_To[$EnvelopeRecipients]_IP[$RemoteIP]_rep[$Reputation]");
                          skip-filters();
                      }

 

DOES NOT WORK-

Spoofed_Email_Filter:
 if (recv-listener == "IncomingMail") AND ((header-dictionary-match("spoof-domains","From", 1)) AND
(sendergroup != "RELAYLIST") OR (sendergroup != "ALLOWSPOOF")) {
                          insert-header("X-Ironport-Quarantine", "SPOOF from[$EnvelopeFrom]_To[$EnvelopeRecipients]_IP[$RemoteIP]_rep[$Reputation]");
                          skip-filters();
                      }

 

helo
mail from:evren@mailtest.domain.com
rcpt to:evren@evren.gen.tr
data
From:evren@mailtest.domain.com
Subject:testtest
.

quit

1 REPLY
Cisco Employee

I understand that the 2nd

I understand that the 2nd Filter is not working as expected.  However, I'm unsure how that particular example would have matched on your configuration.  So that the community can better help, please reply with the Tracking or mail_logs details for the test emails o we can see exactly which Sender Group it matched on.  Also please let us know if this example should have matched the Filter or not.

164
Views
0
Helpful
1
Replies
CreatePlease to create content