Whitelisting - can't match sender

[MiamiJack]

Hello All,

Trying to match a sender's email to whitelist and not having any success.

In Who Objects we have a whitelist which has
email: noreply@SendingDomain.com
Domain: SendingDomain.com
Regular Expression: .+SendingDomain\.com

Unfortunately still gets quarantined.

email header attached.

There has to be an easier way to simply whitelist something without trying all 3 methods above and still failing.

Any assistance appreciated.

 

[dcsapak]

who object matches on the envelope sender (@sendgrid.net in this case), not the from header
if you want to match the from header, use a 'what object' with 'from' as the field

 

[MiamiJack]

In the what I would then basically put from the email address, what if I was trying to match the exact domain, so lets say all users @SenderDomain.com, could I use wild cars with the match field? I have tried without success and was thinking the who domain option would work, but as you mentioned above, for the same reason it doesn't.

Thank you, will try that!

 

[dcsapak]

not wildcard, but regex, so all domains which end in 'foo.com' would be '.*foo\.com'

 

[MiamiJack]

I'm actively testing this, however I have come up with a potential issue.
If I whitelist a domain, or an email address using the from rule, then real spam impersonating that sender would also go through, right?

It's almost like I need a 2 condition rule, lets say we know that sender uses sendgrid, then if it's that email address & comes from accepted sender locations....

Just trying to think of the potential for an issue.

Thanks!

 

[dcsapak]

sure, if you have a whitelist then that is applied. if you have a rule with a 'who' and 'what' object, both must be valid to trigger that rule,
so when you have a 'what' match for 'from' = '.*somedomain\.com' and a who object for e.g. sendgrid.net then it would only trigger if both
happen to match

but normally this is exactly the thing SPF is for, declaring which sending mail servers are allowed to send from my domain.
the sender just has to configure that

 

[MiamiJack]

Understood, thank you!

 

[MiamiJack]

We would try whitelisting one way, no success add the other but not necessarily cleaning up the opposite try of what vs who, so we will have to go back in there and clean those up, and try to get some test emails.
Its a little strange if they are 2 independent rules that they are technically a compound rule... ( at lease in my opinion )