Deep Discovery Email Inspector first determines the message direction (inbound or outbound) based on the Internal Domains list to apply policies. For more information, see Internal Domains.
If more than one policy applies to a recipient or sender, Deep Discovery Email Inspector matches the enabled policy with the highest priority and applies the associated actions.
For example, consider the following policies.
|
Priority |
Policy Name |
Target |
Direction |
|---|---|---|---|
|
1 |
High_Profile_Recipient |
Recipients:
|
Inbound |
|
2 |
High_Profile_Recipient_Sender |
Sender: jim@partner.com Recipients:
|
Inbound |
|
3 |
Trusted_Partner |
Senders: *@partner.com |
Inbound |
|
4 |
Sales_Team |
Recipients:
|
Inbound |
|
5 |
IT_Team |
Recipients: IT_group (Active Directory) |
Inbound |
|
6 |
Acquired_Domain |
Recipients: *@example.com |
Inbound |
|
7 |
Outbound policy |
Senders: *@example.com Note:
The domain "example.com" is in the Internal Domains list. |
Outbound |
|
8 |
Default policy |
All recipients and senders |
Inbound or outbound |
The following describes how Deep Discovery Email Inspector matches the policies in a top-down approach based on the message direction and priority settings:
-
A message from leo@partner.com to the recipient (joe@example.com) matches the policy Trusted_Partner, because this is an inbound message (the domain "partner.com" is not in the Internal Domains list) and the priority for the Trusted_Partner inbound policy (matching the sender setting: *@partner.com) is higher than the Sales_Team inbound policy (matching the recipient setting: joe@example.com).
-
If a message is sent from jim@partner.com to three recipients (ceo@example.com, alex@example.com, and joe@exmple.com), Deep Discovery Email Inspector considers the message as an inbound message (the domain "partner.com" is not in the Internal Domains list) and matches the following inbound policies:
-
High_Profile_Recipient: Matching the inbound message direction and recipient ceo@example.com
-
High_Profile_Recipient_Sender: Matching the inbound message direction and recipient alex@example.com
-
Trusted_Partner: Matching the inbound message direction and recipient joe@exmple.com
-
-
If a message is sent from joe@yahoo.com to four recipients (larry@example.com, alex@example.com, bill@example.com, and jane@newdomain.com) and only bill@example.com belongs to the IT_Team Active Directory group, Deep Discovery Email Inspector considers the message as an inbound message (the domain "yahoo.com" is not in the Internal Domains list) and matches the following policies:
-
Sales_Team: Matching the inbound message direction and recipient larry@exmple.com
-
Acquired_Domain: Matching the inbound message direction and recipient alex@example.com
-
IT_Team: Matching the inbound message direction and recipient bill@example.com
-
Default policy: Matching the inbound message direction and recipient jane@newdomain.com
-
-
If a message is sent from alex@example.com to two recipients (larry@example.com and jane@newdomain.com ), Deep Discovery Email Inspector considers the message as an outbound message (the domain "example.com" is in the Internal Domains list) and matches the Outbound policy that has a higher priority than the Default policy (matching outbound message direction, sender, and recipients).
Message splintering occurs when a message with multiple recipients results in multiple policy and policy rule matches in Deep Discovery Email Inspector. For more information, see Policy Splintering.