Want to block emails from other countries or at least quarantine

[Former Member]

I tried to use envelope analysis ad add *.pw and it does not work. Do I need to just add a content analysis rule to block that? What is my best option to block anything from .ru or .tw, etc.?

[Former Member · Accepted solution]

What I've been doing is adding User Defined Header Rules, like this:

From Contains .pw>

and scoring 245 points. I've done 245 points for .eu>, and .pw>, 25 points for .in> and .ru>, and 75 points for .info>

The > symbol is critical, do not leave it off.

It works great here, dumping thousands of .eu and .pw spams a day.

Al McCann

[Former Member]

Thanks!! Step by step on doing this. Not available thisway in 7.6.

https://kc.mcafee.com/agent/index?page=content&id=KB63156&actp=null&viewlocale=en_US&showDraft=false...

Message was edited by: Mwilliam on 5/22/14 1:23:19 PM EDT

[Former Member]

Why the smaller numbers for .ru and .in?

[Former Member]

We have employees who have family in those countries. This just increases the score enough to quarantine the messages where the users can still see them, and release any personal ones.