content filter if EXTERNAL SENDER condition | MDaemon Technologies Community Forum
  1. Forum
  2. MDaemon
  3. content filter if EXTERNAL SENDER condition

content filter if EXTERNAL SENDER condition

  • A

    Hi All!

    I couldn't find in help the description of this condition. How does exactly it define that sender is external?

    0 likes
  • A

    It compares the domains in the Return-Path, Sender, and From headers to the recipient's domain. 

    --
    Arron Caruth

    0 likes
  • A

    Thank you for the answer!

    We have  the office mailboxes  in CRM, Mdaemon uses as MTA to send\receive mail from Internet. CRM is in the same LAN network with Mdaemon. Mdaemon has one mailbox all@mycompany.com with alias *@mycompany.com. CRM receives all mail from Mdaemon via IMAP and sends to Mdaemon via  SMTP with TLS and authentication. SPF, DKIM and DMARC works fine in this configuration.

    I  add the rule in content filter "if EXTERNAL SENDER and Header From contains "@mycompany.com" move message to Spam folder". I thought it will be nice to filter fishing mails, but it routes all our outgoing mail directly to spam folder. I was sure that trusted, LAN,  and authenticated SMTP means internal sender, but I was wrong. Would be great  if you add description of this feature in the Mdaemon help in next versions.

    0 likes
  • A

    Sorry, just read again your answer "It compares the domains in the Return-Path, Sender, and From headers to the recipient's domain."

    and see recipient's domain, not sender domain. I dont understand how it works, could you please explain bit more with some examples?

     

    0 likes
  • A

    It is compairing the domains in the Return-Path, Sender, and From headers to the domain of the person receiving the email. 

    The condition will actually flag messages anytime the domain in the Return-Path, Sender, or From headers are different than the domain of the person receiving a copy of the message.  If you apply the rule to the remote queue, it can flag messages that are being sent out. You can control this when editing the rule, click on Local & Remote queue in the rule editor and uncheck Remote Queue.

    This message is not matched by the External Sender condition.

    Fri 2023-11-03 07:34:25.533: * Message return-path: arron@localdomain.com
    Fri 2023-11-03 07:34:25.533: * Message from: arron@localdomain.com
    Fri 2023-11-03 07:34:25.533: * Message to: george@localdomain.com
    Fri 2023-11-03 07:34:25.533: * Message subject: Test 405
    Fri 2023-11-03 07:34:25.533: * Message ID: <WC20231026160357.880001@localdomain.com>
    Fri 2023-11-03 07:34:25.533: Start Content Filter results
    Fri 2023-11-03 07:34:25.537: * Matched 0 of 1 active rules

    This message is matched by the external sender condition:

    Fri 2023-11-03 07:37:39.683: * Message return-path: arron@localdomain.com
    Fri 2023-11-03 07:37:39.683: * Message from: arron@externaldomain.com
    Fri 2023-11-03 07:37:39.683: * Message to: george@localdomain.com
    Fri 2023-11-03 07:37:39.683: * Message subject: Test 406
    Fri 2023-11-03 07:37:39.683: * Message ID: <WC20231026160357.880001@localdomain.com>
    Fri 2023-11-03 07:37:39.683: Start Content Filter results
    Fri 2023-11-03 07:37:39.684: * Message matched rule: 11 "Check External Sender" (Hits: 2)
    Fri 2023-11-03 07:37:39.689: *    Action: Message moved to bad queue (this action ends further rule processing)
    Fri 2023-11-03 07:37:39.689: * Matched 1 of 1 active rules

    We can repeat the same process, changing the email address in the Return-Path, Sender, and From headers.  As long as the domain in any one of those headers does not match the domain of the recipient, then the message will be flagged by the condition.  Also, the condition is looking at the email address it is send that specific copy of the message to, in order to determine the domain of the recipient.  It is not looking at the To or CC headers.

    --
    Arron Caruth

    0 likes
  • A

    I  add the rule in content filter "if EXTERNAL SENDER and Header From contains "@mycompany.com" move message to Spam folder". I thought it will be nice to filter fishing mails, but it routes all our outgoing mail directly to spam folder. I was sure that trusted, LAN,  and authenticated SMTP means internal sender, but I was wrong. Would be great  if you add description of this feature in the Mdaemon help in next versions.

    There are easier ways to protect the From header and stop people from using your domain in the From header.  The best way is to implement SPF, DKIM and DMARC for your domain and configure MDaemon to check them on all inbound email.  DMARC protects the From header. 

    You can also enable IP Shielding in MDaemon and check the box for "Check FROM header address against IP Shield." 

    --
    Arron Caruth

    0 likes
  • A

    Thank you, Arron, now everything is clear. Also will check ip shield option. 

    0 likes
  • V

    We want to use a content filter based on the condition "If EXTERNAL SENDER...", adding "Add a warning to the top of the message". we use two domains, MDaemon when processing emails in a local queue within a company from one domain to another, a filtering rule is triggered.

    0 likes
  • A

    As I mentioned previoulsy in this thread, the condition will actually flag messages anytime the domain in the Return-Path, Sender, or From headers are different than the domain of the person receiving a copy of the message.

    If you don't want the warning being added to messages sent between two domains in MDaemon, you'll have to adjust the rules in the content filter.  The easisest way to do this is to create anothe content filter that will skip the next message if the From header contains either of your local domains.  Something like the following:

    [Rule010]
    RuleName=Skip Next Rule
    Enable=Yes
    ThisRuleCondition=Any
    ProcessQueue=LOCAL
    Condition01=FROM|contains|OR|@domain.com|@domain2.com|
    Action01=skip rule|"1"
    [Rule011]
    RuleName=Check External Sender
    Enable=Yes
    ThisRuleCondition=Any
    ProcessQueue=LOCAL
    Condition01=body|external sender|AND|
    Action01=add warning html|"External Sender Warning...."

     

    --
    Arron Caruth

  • I

    Hello,

    So, if I have more than 50 domains in Mdaemon and I want to add the warning message only for emails outside the Mdaemon server, the only solution is to add the 50+ domains one by one in a rule like the one above?

    Thank you!

     

    Ilie Voinea

    0 likes
  • A

    No.  You can use any criteria you want to check the from header.  I'd suggest trying if the From "contains a local account" then skip the next rule.  

    --
    Arron Caruth

  • V

    @Arron 
    What does such an entry for the filter look like - "contains a local account"?

    0 likes
  • A

    In the MDaemon UI go to Security / Content Filter / New. 

    Check the box for If the From header contains, in the area where the rule is built click on "Contains".  

    In the dialog where you enter the search text for the from header, in the "Currently specified settings" section, click contains again.

    In the drop down for If the From header... select "Contains a local account."

     

    --
    Arron Caruth

  • I

    I found it, I will test with this option:

     

    Thank you!

  • V

    I found it. Thank you!

    0 likes
  • V

    To warn users, when receiving emails from external senders, we add a warning with the html flag, however, from some senders, we receive this text without html formatting.

    0 likes
  • A

    Are the messages that do not have the HTML formatting sent in plain text?  

     

    --
    Arron Caruth

    0 likes
  • V

    @Arron , I uploaded an example of an incoming email that did not receive html, but was inserted as text.

    0 likes
  • A

    @Vladimir Thank you for the message.  The warning was added in plain text because the message only contains a plain text body.  It has the following Content-Type set:

    Content-Type: text/plain; charset="UTF-8"

    --
    Arron Caruth

    0 likes
  • V

    @Arron , There are six blank lines before and after the insertion of the warning, which makes it difficult to respond to the letter, as a lot of these blank lines are added. With a large number of responses, it ceases to be easy to read.

    0 likes
  • 1 / 2
  • 2
Please login to reply to this topic!

Participants