Placing your SPF Rule for None SPF to Do not Intercept Message for OOO emails and do the following policy configuration in Inbound Protection > Content Filtering > Content Policy

The Policy should be in this order:

1. Allowing OOO Emails
2. Quarantine SPF None Emails

Below are the steps:

1. In Inbound Protection > Content Filtering > Content Policy
2. Click Add.
3. Enter the name of the Policy and Enable it.
4. Under Scanning Criteria > Select Specified header matches and Body matches and Change the Condition to All Match

   

   ^{Click the image to enlarge.}

5. For Keyword Expression for the Specified header matches, Select Other and enter X-TM-Received-SPF:

   

   ^{Click the image to enlarge.}

6. For the Keyword Expression Click Add and click Add Again
7. Add the following keyword below. Click Save once done.

   

   ^{Click the image to enlarge.}

8. For the Subject match, Add a new Keyword Expression.
9. The Keyword expression below is an example for you to use and it will depend on the OOO emails you have been receiving based on the contents of the subject.

   

   ^{Click the image to enlarge.}

10. Click Save Once Done.
11. On the Actions Tab, Select Deliver Now.

    

    ^{Click the image to enlarge.}

Once done click Save and place the policy in the 1st order.

The Next Policy would be the SPF None Policy which will quarantine any Email that has SPF None

1. In Inbound Protection > Content Filtering > Content Policy
2. Click Add.
3. Enter the name of the Policy and Enable it.
4. Under Scanning Criteria > Select Specified header matches
5. For Keyword Expression for the Specified header matches, Select Other and enter X-TM-Received-SPF:

   

   ^{Click the image to enlarge.}

6. Add the created Keyword earlier to the policy. Click Save Once Done.

   

   ^{Click the image to enlarge.}

7. On the Actions Tab, Select Quarantine. Once Done Click Save

   

   ^{Click the image to enlarge.}

8. Place the policy following the Policy that we have created earlier in the 2nd priority

The Policy should be in this order:

1. Allowing OOO Emails
2. Quarantine SPF None Emails