Messaging Gateway

 View Only
  • 1.  mail from global bad sender still getting through

    Posted Oct 18, 2013 10:08 AM

    Hi,

    For a while now, myself and some of my users have been getting emails containing suspicious files.
    Always seeming like they come from the same email adress, but behind the screens they originate from the most diverse email adresses.
    So blocking the sender is out of the question.

    Is there a way to block emails contaning certain data? (strings?)

     

    When looking into the senders IP adress this is listed among the Global Bad Senders, and Global bad senders are configured as Reject SMTP connection.
    However the e-mail still gets through... How do I get this resolved?

    Symantec Messaging Gateway - Sender Groups_2013-10-18_16-04-05.png

    Symantec Messaging Gateway - IP Reputation Lookup_2013-10-18_15-59-11.png

    Kind regards,
    Domien

     



  • 2.  RE: mail from global bad sender still getting through

    Posted Oct 18, 2013 03:21 PM

    The IP may have been added to the gobal bad senders list after the message was received. 

    What was the verdict seen in the Message Audit Log?

     



  • 3.  RE: mail from global bad sender still getting through

    Posted Oct 21, 2013 03:26 AM

    Goodmorning,

    Please find the verdict below.
    As far as I can see there is no mention of a global bad senders...?

    Thank you!

    Symantec Messaging Gateway - Message Audit Logs_2013-10-21_09-19-47.png



  • 4.  RE: mail from global bad sender still getting through

    Posted Oct 22, 2013 06:07 AM

    Is there a way to block emails contaning certain data? (strings?)

    Yes, please check content filter.



  • 5.  RE: mail from global bad sender still getting through

    Posted Oct 22, 2013 08:21 AM

    Okay I've set this up using the content filtering... I'll let you know how that works out.

    But I'm still curious as to why the system still allows these mails to get through?



  • 6.  RE: mail from global bad sender still getting through

    Posted Oct 28, 2013 07:07 AM

    Hi,

    These mails are still getting through, even after me trying to create a content filter.
    I created the filter on the to/from/cc filter, perhaps this isn't the right way?

    What policy do I have to create to delete any emails from global bad senders?
    Or quarentine it but don't send any notifications... any way is fine as long as my users aren't bothered with this anymore !

    Kind regards,
    Domien