Transport Rules - Restricting inbound Domains (How to allow subdomains?)

We have a transport rule that blocks all outside emails unless a user is in a security group then it will allow the domains that are in the "except when the from address contains" exception.
What we are finding is if we have contoso.com in the exception list and its abc.contoso.com the abc.contoso.com gets blocked. But we would need to allow both contoso.com and abc.contoso.com
I read somewhere (can't find it now) you could do contoso.com$ and it would allow subdomains but it does not seem to be working.
Any assistance would be great.

Hi Ryan,
Agree with Jatin's opinion, you can use "*.contoso.com" instead of "contoso.com" as an exception.
The asterisk ( * ) character matches zero or more instances of the previous character. For example,
ab*c matches the following strings: ac, abc,
abbbbc.
More details refer to the following article:
Regular Expressions in Transport Rules
Best regards,
Niko Cheng
TechNet Community Support

Similar Messages

How to restrict inbound delivery in migo

hi,
for inbound delivery we can do gr via. migo as well as vl32n.
but migo doesnt update inbound del docs after gr, so it remains open.
while vl32n updates inbound del docs, but doesnt allow partial gr.
but here users use vl32n to gr ...and when its partial del...they simply change the quantity in inbound del doc to the received qnty.
but sometimes new guys do gr via migo for inb. del..and it doesnt update their inb. del. docs.
so they want to restrict inbound del in migo. how do we do it??
regards
rahul

Hi,
you can take them the authorization for the transaction migo, then they are not allowed to enter this transaction.
regards, Paul.

Mail transport rule to block email with recipients in 2 different domains

Is it possible to set up a mail transport rule (Exchange 2007) to block or put on hold emails that are sent to recipients in more than one domain?
Eg if the recipients /cc/bcc are
[email protected];[email protected]
then the email is held for approval before sending
Can this be limited to only process from certain sending addresses?
If it can't be done in 2007 can it be done in a later version or can it be done in a non microsoft product eg Postfix
This topic first appeared in the Spiceworks Community

Hi,
From your description, you want to prohibit retired users from sending emails to
[email protected] If I have misunderstood your concern, please let me know.
In your case, these retired users are hosted on Exchange Online, this is Exchange 2013 forum. I would like to tell you how to achieve it on Exchange 2013.
I recommend you verify it on Office 365 forum. For your convenience:
https://community.office365.com/en-us/f/158.aspx
What's more, I would like to clarify the following thing:
If you prohibit A from sending email to B, B send an email to A and C, when A reply all this email, C still can receive this email, only A can't receive it.
Hope my clarification is helpful.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

Powershell script to add multiple domains to a transport rule

I have a transport rule in Exchange 2013 that I created in the EAC (mail flow>rules). it is set so *Apply this rule if.. the sender's domain is.. and then I entered a few domains.
I want to use a powershell script to enter multiple domains into the senderdomainis parameter using the set-transportrule. I would like to do this from a csv input file. The file has header row of domains and then the domains are listed
under it. This is also used successfully in a script that does content and sender id filter additions.
I tried the following:
$allowed = import-csv c:\temp\allowed.csv
$Rule=get-transportrule "safe domain List"
$Senderdomains =$rule.senderdomainis
foreach($row in $allowed)
$Senderdomains +=$row.domain
#Set-Transportrule "Safe Domain List" -senderdomainis $Senderdomains
It just adds a long line of all the domains mashed together without separation.
Any ideas would be helpful.
Thanks.

This isn't the most elegant solution, but I was able to accomplish it with this script:
$allowed = import-csv c:\temp\allowed.csv
$domains=Get-TransportRule "Safe Domain List" | select -ExpandProperty senderdomainis
foreach ($a in $allowed)
$domains += $a.domain
$domainstoadd = $domains | select -Unique
Set-TransportRule "Safe Domain List" -SenderDomainIs $domainstoadd
It's key to note that the column in the CSV file has a heading of "Domain". Basically the script pulls the existing array into a variable so you can add values from the CSV to the array. This creates duplicates,
so the "Select -Unique" is a quick and easy way to eliminate the duplicates.

Exchange2003 - How to allow a specific sender while the domain has been block from "sender filtering"

We have a Exchange 2003 SP2 Ent server. And we have blocked a specific domain by adding it on Global Settings - Message Delivery - Sender filtering
*@abc.com. It has been set for over a few years and until recently one of our user voice out that she can't receive a legitimate mail with
[email protected] Since there are lots of junk and malicious mail from abc.com, our manager is not willing to remove that domain from sender filtering. How can I exclude that specific address from sender filtering?
I've try on "Connection filtering -Configure an exception list to the block list service rule" to exclude that RECEIPIENT (To allow the user to receive every mail, buts seems only work for the mail blocked by "block list service" )
Is there any method to allow that user to receive the specific email address?
Thanks!

HI,
It will not be possible as the filters are applied in the sequence below
Connection control filter (per SMTP virtual server)
Connection filtering
Recipient filtering
Sender filtering
Sender ID filtering
Intelligent message filtering
Refer to the below for more detailed explanation
http://www.msexchange.org/articles-tutorials/exchange-server-2003/security-message-hygiene/order-which-Exchange-2003-SP2-Connection-Filters-applied.html
Connection control filter (per SMTP virtual server)
Connection filtering
Recipient filtering
Sender filtering
Sender ID filtering
Intelligent message filtering
Connection control filter (per SMTP virtual server)
Connection filtering
Recipient filtering
Sender filtering
Sender ID filtering
Intelligent message filtering
Connection control filter (per SMTP virtual server)
Connection filtering
Recipient filtering
Sender filtering
Sender ID filtering
Intelligent message filtering
Blog: Http://theinfraguys.com
Follow me at Facebook http://www.facebook.com/theinfraguys
Please remember to click 'Mark as Answer' on the answer if it helps you in anyway

Transport rule doesn't work (trying to prepend a subject when mail comes to a second domain).

This is an SBS2011 and accepts mail for two mail domains (successfully), but I am trying to phase out one of the two domains.
I cannot find a better way to do it, but I have simply created this rule:
priority 0
when a recipient's address contains '@<olddomain>.gr'
prepend message subject with '[GR!] '
It doesn't do anything.
It's not a matter of restarting services or waiting for some kind of replication. This rule is created (and is enabled yes) more than a month.
Any ideas?
EDIT: In Message Tracker, I find a test message has the following entry just after receiving from remote mail server:
"The e-mail address for recipient "<myself>@<olddomain>.gr" was updated to the e-mail address "<myself>@M<newdomain>.com". The message is in the process of being delivered.
...then I have the successful delivery, without transport rule kicking in.
So is the problem related to the recipient having BOTH email addresses set? Then why system replaces the old with the default? Probably this is why the rule doesn't kick (as it doesn't match any more).
Is there a way to prevent this replacement, since I want the recipients to still get reached by the mail?
NLS

Hi NLS,
I would like to verify if you apply the rule for your primary email address.
You can try to use the following cmdlet to achieve your goal.
New-TransportRule -Name 'New Rule' -Comments 'Comment' -HeaderContainsMessageHeader 'Received' -HeaderContainsWords 'olddomain.com'-FromAddressContainsWords
'[email protected]' -PrependSubject "OLDDOMAIN"
Hope it helps.
If you need further assistance, please feel free to let me know.
Best regards,
Amy
Amy Wang
TechNet Community Support

Create Transport rule for restrict message size and send a rejected message CC: to Administrator

I want to create a Exchange Transport rule for message size restriction (10 MB) when message size is exceed to 10 MB it rejected by the Exchange server and
also rejected message CC: to Administrator. I also create it but unable to configure rejected message CC: to Administrator. Thanks.
Babu

Hi Babu,
I have some tests in my environment using Exchange 2013, you can create a transport rule such as follows to achieve your goal.
Hope this can be helpful to you.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

Transport Rule - Mail Tip Per Domain

I need to setup a transport rule to do the following:
If mail sent from a group of users, lets call it Group1
Apply a policy tip that blocks the message and allows override
Except if the message is sent to a member of Group1.
Sounds simple, right? But, I can't find a rule setup that gives me what I need.
Any help would be appreciated!!

Hi,
From your description, I recommend you create the following transport rule to achieve your goal.
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

How to allow website using the domain name in zone based firewall ?

Hi,
I need to give a restricted access to internet by allowing few sites. How will I do it with the url of a particular website. If I put the url in the configuration it resolves to only a single IP. How will I do it for a website like google where there are numerous number of IP addresses.
Regards,
Tony

Hi Bro
Please kindly refer to this URL https://supportforums.cisco.com/docs/DOC-17014
I hope this is what you're looking for :-)
P/S: If you think this comment is helpful, please do rate it nicely :-)

Exchange transport rule to redirect to a different domain?

This is an odd question. Is there any way to use a Transport Rule to redirect a message from one domain to another? Like if you were to send to: [email protected] , I would like to redirect it to [email protected] That possible??

Hi,
As far as I know, there is no feature which can redirect all messages from one domain to another in Exchange 2010 at the same time.
However, we can build distribution group and add users, then apply transport rule for the distribution group.
Alternatively, maybe some script can help you. And you’re welcomed to confirm it on our script center forum:
http://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?category=scripting
Thanks,
Angela Shi
TechNet Community Support

"that domain isn't allowed to be relayed thru this MTA " : Problem and fix

I am using Java mail to send emails out at work through my web email account.
Sometimes it works fine, but after a while, it gives me the following error :
javax.mail.SendFailedException: Invalid Addresses;
nested exception is:
com.sun.mail.smtp.SMTPAddressFailedException: 553 sorry, that domain isn't allowed to be relayed thru this MTA (#5.7.1)
at com.sun.mail.smtp.SMTPTransport.rcptTo(SMTPTransport.java:1196)
at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:584)
I waited for a few days, and tried one more time, it worked again for a few emails, then it failed again. I went into my Thunderbird where I had this web account set up so I can both send and receive emails, I tried to send out an email, it worked, then I used my Java email program to send email from work through this web account, it works again. It seems Thunderbird can fix the problem for me. Does any one know how I can fix it in Java so I don't have to start Thunderbird and send an email to fix the error ?
Frank

You're confusing things here by using your ISP's mail server at work instead
of your work mail server.
Still, your ISP's mail server is probably imposing similar restrictions as your
work mail server. It doesn't want to allow just anyone to connect and send
mail to anywhere. That's how spam is sent. Most people control this by requiring
you to login to the SMTP server before it will let you send mail. Some people use
the hack of requiring you to login to the POP3 server first, and then it will allow
you to connect to the SMTP server without logging in and will allow you to send
mail.
You seem to be missing some basic understanding of JavaMail and what it
means to "connect to a mail server". Maybe you don't understand the difference
between a Store and a Transport. POP3 is a Store protocol. SMTP is a Transport
protocol.
The JavaMail demo directory is full of programs that should how to connect to
a mail server (Store) to read messages, the most useful of which is the msgshow.java
demo program. JavaMail doesn't require you to wire in knowledge of the Store
protocol. You can write a program that can connect to any type of Store, and then
tell it at runtime to use the "pop3" protocol. Looking at msgshow.java, if you pass
"pop3" as the protocol argument ("-T pop3"), it will connect to a POP3 mail server.

Transport Rule does not appear to be working

hi,
I have an exchange 2013 environment. i have a requirement to intercept inbound emails from external senders addressed to [email protected] and forward it to a single recipient.
we have an internal distribution list already using [email protected] that has 30 members.
I have setup the following rule
apply this rule if: the recipient is [email protected] and the sender is:outside of the organization
Do the following:redirect the message to [email protected]
Priority 0
Audit : not specified
mode: enforce
when i send a test email from externally all 30 people still recieve the mail. i have tried restarting the transport service. Can anyone please help me as i am struggling to see what might be wrong.
thanks
Paul

Hi paul ,
From your description i came to understand that the E-mails from the external senders addressed to the distribution group [email protected] should have to be redirected to [email protected]
As per my knowledge ,There are two ways to achieve your scenario one is via transport rule and another one is via DL restriction .
via transport rule
1.If you wanted to check whether the transport rule is applied to that message or not you should have to do the message tracking first .
2.Then you have to enable the pipeline tracing log for the particular recipient in our exchange organisation . With the help of that logs you can able to identify what are all the transport rules has applied to the messages received by the that recipient
Note: Pipeline tracing is only for troubleshooting purpose , once you have completed your troubleshooting please turn it off .
Via DL restriction :
On that particular DL If you go to the option delivery management you can able to set the restrictions .
only senders inside my organization - This is the option where you can restrict who can able send an email to this DL and it would be some of the internal recipients or all the internal recipients .
Senders inside and outside of my organization - This is the option where you can restrict who can able send an email to this DL and it would be some of the internal recipients or all the internal recipients or some of the external recipients
or all the external recipients .
you should have to create a contact in case if you wanted to provide mail sending permission to this DL only for some external recipients
Please reply me if you have any queries .
Regards
S.Nithyanandham
Thanks S.Nithyanandham

Restrict non-domain computers

Does anyone know if it is possible to restrict access based on domain membership or an AD Group?
The purpose is to restrict non-domain computers even if the client has a legitimate domain credential to use for authentication.

That is correct. The only way to restrict these computers would be to make a rule (above your auth group policies), that states the specific IPs / subnets are granted certain / no access.
As long as the rule is above all your auth rules, it will trigger first and take precedence. Be sure to disable WBRS for this rule as well, since there is a potential for +6 sites to be allowed.

Exchange transport rule so a message classification

I can create the RMS template in the RMS management utility on the RMS server, put the templates in a shared location and enable RMS by specifying a template location in a Group Policy.
The result is that
users will see the message classifications in Outlook
… but when I try to create a transport rule based on the template, the templates are not available in ECP in the dropdown for message classification (the ones you see in the example below are there b/c I added them via Exchange
powershell.
The other way to add message classifications is to create them in PowerShell on the mail server. When created this way the Message classifications show up when creating a new rule (as seen above) but
the end users don’t see them in Outlook.
One source says to make a registry change on the user’s computers:
Next, copy the XML file to a location on the client or networked location which is readable by Users. On the client, make the
following registry changes:
[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Policy]
"AdminClassificationPath"="c:\\Classifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001
After trying both a network share and a local file, the Classifications still don’t show up in Outlook.
So the only way to get them to show up in Outlook doesn’t allow you to include them in a transport rule (and thus you’re not able to create a rule that allows forwarding inside the domain only)
and the way to get them to show up when creating a transport rule doesn’t seem to work as far as getting them to show in Outlook.
Adding them via PowerShell on the Exchange server actually does get them to show up in OWA the way you would expect, they just won't show in Outlook 2010.
I imagine the issue is with the reg entry that points Outlook to the xml
file….(and I do realize reference given is Offfice 2013) it’s entirely
possible that Office 2010 requires a new key in a slightly different place but
im only seeing references to office 2007 and 2013

Making message classification visible in Outlook 2010
On the CAS: New-MessageClassification -Name "Internal Use Only" –DisplayName “Internal Use Email” -RecipientDescription "Internal Only, Don’t forward outside Kdm"
-SenderDescription "tells recipient not to forward outside company”
From Program Files\Microsoft\Exchange Server\V14\Scripts
- Run .\Export-OutlookClassification.ps1 > c:\Temp\Classifications.XML
Copy the .XML file to the test client in root of C: (tried other locs also)
Create new reg key (office 2010)
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Policy]
"AdminClassificationPath"="C:\Classifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001
Reboot client
Should be able to see the message classification when creating a new email.
Why can I see this in my test lab using Outlook 2013 and also see it within OWA but I cannot see the classification within Outlook 2010 (which all my users have)?
Have tried on two laptops. One with MS Office prof. and the other with prof. plus.
I am local admin on both.

How to allow to run a perticular Progm. by SE38

Dear All Experts,
Can you tell me how to allow to run a perticular Progm. by SE38? Where SE38 is restricted for that user.

Hi Ujjal,
well, first of all you would use SA38 instead of SE38 if you just want to allow to submit reports.
You maintain the report authorization group assignments which are based on the authorization object S_PROGRAM using report RSCSAUTH. See the documentation of that report to get more details.
However, I believe, that the main issue with SA38 etc. and S_PROGRAM is, that you first have to assign authorization groups to thousands of reports which are not assignd to any group yet. If you only have to deal with a couple of reports there exist a better solution:
Avoid to authorize users for SA38 etc. but create individual transactions for reports and assign these transactions to roles. In your development system you can perform both steps using transaction PFCG: You just have to add reports to the role menu and you will be asked for new transaction codes and of course a transport order.
Kind regards
Frank.

Transport Rules - Restricting inbound Domains (How to allow subdomains?)

Similar Messages

Maybe you are looking for