Views:
Deep Discovery Email Inspector first determines the message direction (inbound or outbound) based on the Internal Domains list to apply policies. For more information, see Internal Domains.
If more than one policy applies to a recipient or sender, Deep Discovery Email Inspector matches the enabled policy with the highest priority and applies the associated actions.
For example, consider the following policies.

Example policies

Priority
Policy Name
Target
Direction
1
High_Profile_Recipient
Recipients:
  • ceo@example.com
  • cfo@example.com
Inbound
2
High_Profile_Recipient_Sender
Sender: jim@partner.com
Recipients:
  • finance_group (Active Directory)
  • alex@example.com
Inbound
3
Trusted_Partner
Senders: *@partner.com
Sender exception: john_doe@partner.com
Inbound
4
Sales_Team
Recipients:
  • joe@example.com
  • larry@exmple.com
Inbound
5
IT_Team
Recipients: IT_group (Active Directory)
Inbound
6
Acquired_Domain
Recipients: *@example.com
Inbound
7
Outbound policy
Senders: *@example.com
Note
Note
The domain "example.com" is in the Internal Domains list.
Recipient exception: jane_doe@partner.com
Outbound
8
Default policy
All recipients and senders
Inbound or outbound
The following describes how Deep Discovery Email Inspector matches the policies in a top-down approach based on the message direction and priority settings:
  • A message from leo@partner.com to the recipient (joe@example.com) matches the policy Trusted_Partner, because this is an inbound message (the domain "partner.com" is not in the Internal Domains list) and the priority for the Trusted_Partner inbound policy (matching the sender setting: *@partner.com) is higher than the Sales_Team inbound policy (matching the recipient setting: joe@example.com).
  • If a message is sent from jim@partner.com to three recipients (ceo@example.com, alex@example.com, and joe@exmple.com), Deep Discovery Email Inspector considers the message as an inbound message (the domain "partner.com" is not in the Internal Domains list) and matches the following inbound policies:
    • High_Profile_Recipient: Matching the inbound message direction and recipient ceo@example.com
    • High_Profile_Recipient_Sender: Matching the inbound message direction and recipient alex@example.com
    • Trusted_Partner: Matching the inbound message direction and recipient joe@exmple.com
  • If a message is sent from joe@yahoo.com to four recipients (larry@example.com, alex@example.com, bill@example.com, and jane@newdomain.com) and only bill@example.com belongs to the IT_Team Active Directory group, Deep Discovery Email Inspector considers the message as an inbound message (the domain "yahoo.com" is not in the Internal Domains list) and matches the following policies:
    • Sales_Team: Matching the inbound message direction and recipient larry@exmple.com
    • Acquired_Domain: Matching the inbound message direction and recipient alex@example.com
    • IT_Team: Matching the inbound message direction and recipient bill@example.com
    • Default policy: Matching the inbound message direction and recipient jane@newdomain.com
  • If a message is sent from alex@example.com to two recipients (larry@example.com and jane@newdomain.com ), Deep Discovery Email Inspector considers the message as an outbound message (the domain "example.com" is in the Internal Domains list) and matches the Outbound policy that has a higher priority than the Default policy (matching outbound message direction, sender, and recipients).
  • If a message is sent from john_doe@partner.com to the recipient henry@example.com, Deep Discovery Email Inspector considers the message as an inbound message but only the Acquired_Domain is matched since the sender address john_doe@partner.com is on the exception list for the policy Trusted_Partner.
  • If a message is sent from ceo@example.com to the recipient jane_doe@partner.com, Deep Discovery Email Inspector considers the message as an outbound message but only the Default policy is matched since the recipient address jane_doe@partner.com is on the exception list for the policy Outbound policy.
Note
Note
Message splintering occurs when a message with multiple recipients results in multiple policy and policy rule matches in Deep Discovery Email Inspector. For more information, see Policy Splintering.
Keywords: policy matching