Views:

Before Deep Discovery Email Inspector applies scanning settings on messages, message sender email addresses and IP addresses first go through Approved Senders and Blocked Senders list filtering. Sender email addresses and IP addresses are evaluated until the first match is found.

  • By default, Deep Discovery Email Inspector applies sender filtering and sender authentication settings in the following order:

    • For SMTP traffic throttling:

      • Approved Senders list (IP address)

      • Blocked Senders list (user-defined IP address)

      • SMTP traffic throttling (IP address)

      • Approved Senders list (email address)

      • Blocked Senders list (user-defined email address)

      • SMTP traffic throttling (email address)

    • For sender filtering (ERS, DHA, and Bounce Attack) and domain-based message authentication (SPF, DKIM, and DMARC):

      • Approved Senders list (IP address and email address)

      • Blocked Senders list (user-defined IP address and email address)

      • Sender filtering (ERS , DHA, Bounce Attack)

      • Domain-based message authentication (SPF, DKIM, and DMARC)

  • If a sender IP address or email address is not in the Approved Senders list and does not match user-defined entries in the Blocked Senders list, Deep Discovery Email Inspector applies sender filtering and sender authentication settings in the following order:

    • SMTP traffic throttling (IP address and email address)

    • Email Reputation Services (ERS)

    • Directory harvest attack (DHA) protection

    • Bounce attack protection

    • Sender Policy Framework (SPF)

    • DomainKeys Identified Mail (DKIM)

    • Domain-based Message Authentication, Reporting & Conformance (DMARC)

  • If a sender IP address or email address is in the Approved Senders list, Deep Discovery Email Inspector does not apply user-defined entries in the Blocked Senders list, and sender filtering (ERS, DHA, and bounce attack) and sender authentication (SPF, DKIM, and DMARC) settings on messages from the sender.

  • If a sender IP address or email address matches a user-defined entry in the Blocked Senders list, Deep Discovery Email Inspector blocks messages from the sender without scanning.

  • When you enable both IP address-based and email address-based SMTP traffic throttling, Deep Discovery Email Inspector blocks messages from a sender if both conditions are met:

    • The sender IP address is in the Blocked Senders list

    • The sender email address is in the Approved Senders list

Parent topic: Sender Filtering/Authentication Settings