Hi,

I create a policy in which I create condition (regular expression) that if subject  contain "^$" hold that message in quarantine. this policy work fine but when email  from yahoo domain come and suject is blank that message delivered normally.

Kindly guide me

Best regards

Isahq

Hi there:

someone reply on this post because I am facing this issue in production.

Best regards

Ishaq

Kindly use Audit logs to see what are the verdicts passed .It could be that Yahoo IP Addresses are configured in your FastPass or Good Sender List .They could be part of Symantec global good senders .Check from this angle and you may find out .

Dear,

I also analysis Audit log but did not find any thing helpful.

I also lock a support ticket, but very slow response from symntec technical support. everytime symantec engineer ask me that upload this and this logs... which have too much size and almost take 7 to 8 hours to upload on FTP server.

Kinldy someone reply back as soon as possible.

Best regards

Ishaq

Hi Ishaq,

Can you attach a screenshot with the audit log details for these messages?

Remember that messages will only skip content compliance policies if you have changed the good senders policy to do so, even if an IP is in the good senders list it will still be checked against AV/Content filtering, good senders will only bypass SPAM scanning.

Maybe these messages do not have proper subject fields? Policies to detect blank subjects can be very tricky.

Thank you,
Marco Bicca

Dear Marco Bicca,

Kinldy find attached screenshot.....

I agree with you that policy to detect blank subject can be very tricky... but my policy work fine for all domain but yahoo domain can not be cover by this policy

regards

Ishaq

I have had success using the following to identify blank, or non-existant subject fields. 

^[\s]*$  

As indicated above, subjects can be tricky and the message audit log can identify if another policy is acting on the message(s).

Hi Ishaq,

I don't see any attachments, the Message Audit Log is your best friend about tracking what's happening with these messages.

Thank you,
Marco Bicca

Filter using @ 

HI Ishaq , I thing I recently faced myself was the order of the content filtering rules .It might be possible that you have a content filtering rule for Yahoo.com which has a higher priority as compared to the rule with blank subject . Since I couldn't see the screenshot so can't confirm . Once the screenshot is attached, I will check it again .

Blank Subject Email rule not triggering for a particular domain

http://www.symantec.com/docs/TECH165239

I think that this is quite relelvant .I Just sent two test emails from Yahoo to my email Account .One of the email was with a subject and one without subject and I noticed that the Yahoo email without subject was missing the Header "Subject" .I did a similar test from Gmail and even when I kept the subject empty ,the email still had the header "Subject" .Too bad ,Ishaq is not following this thread anymore .

@Dennis , Referring to the solution ,can you guide on how to add this  condition(Bold) .

------------------------------------------

Add another condition to the Content rule:

(If the Message header "Subject" does not exist)

The entire conditions would be looking like:

(If text in Subject part of the message matches regular expression "^$")
or
(If the Message header "Subject" does not exist) 

-------------------------------------------------

hi every body!

thank for your reply on this post. Atlast symantec resolved this issue, now in my case I added two conditions, now that policy block blank subject email from any domain including yahoo.com.

Policy conditions are:

1. If text in Subject part of the message matches regular expression "^$"

2. If the Message header "subject" does not exist

regards

Ishaq

Dear Ishaq ,

        can you share on how to add the 2nd condition (Header does not exist) as I was not able to find any such option under content filtering conditions .

Hi Subhani

Kindly follow the instruction below:

-          Add condition, and select “Text in this specific part of the message:” radio button. Select Message header in scroll bar.

When you select Message header you will find two additional options          

“Header name” and “The message header”, you select subject and does not exit according.

(find screenshot)

Kindly feel free for any further query. If you feel any confession kindly call me at my cell#923008203854.

Best regards

Ishaq

I got it now .the only part I missed earler  was that I had to Type Suject in front of Header Name .