Views:

Placing your SPF Rule for None SPF to Do not Intercept Message for OOO emails and do the following policy configuration in Inbound Protection>Content Filtering>Content Policy

The Policy should be in this order
1. Allowing OOO Emails
2. Quarantine SPF None Emails

Below are the steps
1. In Inbound Protection>Content Filtering>Content Policy
2. Click Add
3. Enter the name of the Policy and Enable it.
4. Under Scanning Criteria>Select Specified header matches and Body matches and Change the Condition to All Match
Image_2024-03-21_07-21-33.png
5. For Keyword Expression for the Specified header matches, Select Other and enter X-TM-Received-SPF:
Image_2024-03-21_07-14-34.png
6. For the Keyword Expression Click Add and click Add Again
7. Add the following keyword below. Click Save once done
Image_2024-03-21_07-13-42.png
8. For the Subject match, Add a new Keyword Expression.
9. The Keyword expression below is an example for you to use and it will depend on the OOO emails you have been receiving based on the contents of the subject.
Image_2024-03-21_07-17-06.png
10. Click Save Once Done.
11. On the Actions Tab, Select Deliver Now.
Image_2024-03-21_07-20-05.png
10. Once Done Click Save and place the policy in the 1st order.

The Next Policy would be the SPF None Policy which will quarantine any Email that has SPF None
1. In Inbound Protection>Content Filtering>Content Policy
2. Click Add
3. Enter the name of the Policy and Enable it.
4. Under Scanning Criteria>Select Specified header matches 
5. For Keyword Expression for the Specified header matches, Select Other and enter X-TM-Received-SPF:
Image_2024-03-21_07-14-34.png
6. Add the created Keyword earlier to the policy. Click Save Once Done
Image_2024-03-21_07-27-21.png
7. On the Actions Tab, Select Quarantine. Once Done Click Save 
Image_2024-03-21_07-28-50.png
8. Place the policy following the Policy that we have created earlier in the 2nd priority

The Policy should be in this order
1. Allowing OOO Emails
2. Quarantine SPF None Emails
Comments (0)