How to block emails from specific country using policy filter

06/20/2020 1,022 People found this article helpful 484,546 Views

Description

Policy & Compliance feature is powerful module of Email Security solution. Policy part is related to: Filters and Policy Groups, but Compliance contains: Dictionaries, Approval Boxes, Encryption, Record ID Definitions, Archiving. Policy extension allows us to create vary rules for inbound and outbound mail traffic. This article focuses on rules blocking traffic from specific countries.

Please Note: Policy filters take 4th place of Email Security judgement order.

Resolution

Excercise:
Customers would like to block incoming emails from Hungary, Uruguay and Israel. They would like to use only one filter for that and mails have to be placed in Approval Box, so the administrator has control over them.

Example/Application:

Step 1: Login to Email Security's GUI>Policy & Compliance>Filters>Inbound>Add New Filter
Any of these conditions are met:"
B) Select: From
C) Matching: Ends with
D) Search Value: .hu
E) Press Plus sign (+), it adds extra condition
F) Repeat steps from A-E, in Search Value adding .uy
G) Repeat steps from A-D, in Search Value adding .il
Step 3: Choose a following action (Store in Approval Box) and specify name of the filter (Certain countries block policy):
Conclusion:

When it is done all emails containing in the FROM field, in email header, domain that ends with .hu, .uy, .il will be blocked and stored in Approval Box for future investigation by the administrator of the appliance.