Filtering Messages based on Sender Domain Verdict

Note	The recommended blocking threshold is "Untrusted." For more information about SDR verdicts, see SDR Verdicts and for tuning SDR policy, see Tuning Sender Domain Reputation Policy

Syntax:

drop_msg_based_on_sdr_verdict:
if sdr-reputation (['untrusted', 'questionable'], "<domain_exception_list>")
{drop();}

Where:

• 'drop_msg_based_on_sdr_verdict'is the name of the message filter.

• 'sdr-reputation' is the Domain Reputation message filter rule.

• 'untrusted','questionable' is the range of the sender domain verdict used to filter messages based on SDR.

• 'domain_exception_list' is the name of a domain exception list. If a domain exception list is not present it is displayed as "".

• 'drop' is the action applied on the message.

Example

In the following message, if the SDR verdict is 'Unknown', the message is quarantined.

quarantine_unknown_sdr_verdicts:
if sdr-reputation (['unknown'], "")
{quarantine("Policy")}

Filtering Messages based on Sender Maturity

Note

The Sender Domain Age option is replaced with Sender Maturity from AsyncOS 14.2.x release onwards. Sender Maturity is already incorporated into the SDR verdict. It is generally not recommended to filter messages based on Sender Maturity, except for special use-cases. Sender Maturity is set to a limit of 30 days, and beyond this limit, a domain is considered mature as an email sender, and no further details are provided.

Syntax:

<msg_filter_name> 
if sdr-maturity (<‘unit'>, <‘operator'> <‘actual value’>)
{<action>}

Where:

• ‘sdr-maturity' is the Sender Maturity message filter rule.

• ‘unit' is the number of ‘days,’ ‘years,’ ‘months,’ or 'weeks' option used to filter messages based on the sender maturity.

• ‘operator' are the following comparison operators used to filter messages based on the sender maturity:

  • – > (Greater than)

  • – >= (Greater than or equal to)

  • – < (Lesser than)

  • – <= (Lesser than or equal to)

  • – == (Equal to)

  • – != (Not equal to)

  • – Unknown

• ‘actual value' is the number used to filter messages based on the sender maturity.

Examples

In the following message, if the maturity of the sender domain is unknown, the message is dropped.

In the following message, if the maturity of the sender domain is less than one month, the message is dropped.

Filtering Messages based on Sender Domain Unscannable

Syntax:

<msg_filter_name> 
if sdr-unscannable (<'domain_exception_list'>)
{<action>}

Where:

• 'sdr-unscannable' is the Domain Reputation message filter rule.

  'domain_exception_list' is the name of a domain exception list. If a domain exception list is not present it is displayed as "".

Example

In the following message, if the message failed the SDR check, the message is quarantined.

Quarantine_Messages_Based_On_Sender_Domain_Unscannable: if (sdr-unscannable ("")) {quarantine("Policy");}