Messaging Gateway

It looks like my whitelisting rules are being overridden somewhere?

I have email addresses and domains that I always want email from to be delivered.

These addresses and domains are listed in my Local Good Sender Domains. They are enabled and applied to the default policy.

The Local Good Sender Domains is set to

"Bypass All Content Filtering Policies"

"Deliver Message Normally"

Yet, new messages from senders in this list are still being seen in the Email Spam quarantine.

Is this the correct way I should be whitelisting senders to "bypass" being blocked by the Brightmail appliance? I followed the Admin guide but it doesn't seem to function correctly.

What policy does Message Audit Logs report as being the cause of the spam quarantine?

Looks like it is being blocked because of a banned file attachment.

How do I set up my Good Senders List/Domain to not be spam or virus/attachment scanned? I want no scanning or filtering done to any emails from addresses/domains in my good senders list.

Thanks

I think JDavis partially answered in this thread (https://www-secure.symantec.com/connect/forums/good-sender-list-being-ignored-emails-blocked-because-unscannable-attachment).

The short answer is you can't.  You can setup a group of recipients for whom your attachment policy does not apply, but it would allow any sender to send in nasties to these recipients.

Do you really need to ban this particular attachment type?   What attachments are causing the problem.

Hey Guys,

Actually this is partly possible, in your Good Senders Domain Based list, along with the 'Deliver message normally' action, also add the 'Bypass content filtering policy' action.  You then need to select whether you want to bypass all content filtering policies or individual content filtering policies.  So the only thing you currently can't bypass with Good Sender Domain Based list is virus scanning, and to be honest there aren't really situations where you are going to want to do this and my solution should solve your current problem.

Cheers,

Kevin

Apologies guys,

Just reread the post, I thought it was a content filtering policy that was firing, but it looks like it's an AV policy firing(most likely unscannable), so unfortunately as I mentioned there is currently no way to bypass AV scanning. 

I think we are going to be adding the bypass virus scanning option in the product in the future as well, but in the mean time what you may want to do is tag the subject of unscannable messages instead of deleting or quarantining.  My guess would be very few of these messages would have this verdict applied. 

The other thing you could as Cricket mentioned is create a new mailbox that no scanning will happen on and create a new group polic for that address only and don't enable AV, spam, or CF scanning for that mailbox.

Cheers,

Kevin