Filtering Messages based on Sender Domain Verdict

Note	The recommended blocking threshold is "Awful." For more information about SDR verdicts, see SDR Verdicts.

Syntax:

drop_msg_based_on_sdr_verdict:
if sdr-reputation (['awful', 'poor'], "<domain_exception_list>")
{drop();}

Where:

• 'drop_msg_based_on_sdr_verdict'is the name of the message filter.

• 'sdr-reputation' is the Domain Reputation message filter rule.

• 'awful','poor' is the range of the sender domain verdict used to filter messages based on SDR.

• 'domain_exception_list' is the name of a domain exception list. If a domain exception list is not present it is displayed as "".

• 'drop' is the action applied on the message.

Example

In the following message, if the SDR verdict is 'Unknown', the message is quarantined.

quarantine_unknown_sdr_verdicts:
if sdr-reputation (['unknown'], "")
{quarantine("Policy")}

Filtering Messages based on Sender Domain Age

Syntax:

<msg_filter_name> 
if sdr-age (<‘unit'>, <‘operator'> <‘actual value’>)
{<action>}

Where:

• ‘sdr-reputation' is the Domain Reputation message filter rule.

• ‘sdr_age’ is the age of the sender domain used to filter messages based on SDR.

• ‘unit' is the number of ‘days,’ ‘years,’ ‘months,’ or 'weeks' option used to filter messages based on the sender domain age.

• ‘operator' are the following comparison operators used to filter messages based on the sender domain age:

  • – > (Greater than)

  • – >= (Greater than or equal to)

  • – < (Lesser than)

  • – <= (Lesser than or equal to)

  • – == (Equal to)

  • – != (Not equal to)

  • – Unknown

• ‘actual value' is the number used to filter messages based on the sender domain age.

Examples

In the following message, if the age of the sender domain is unknown, the message is dropped.

In the following message, if the age of the sender domain is less than one month, the message is dropped.

Filtering Messages based on Sender Domain Unscannable

Syntax:

<msg_filter_name> 
if sdr-unscannable (<'domain_exception_list'>)
{<action>}

Where:

• 'sdr-unscannable' is the Domain Reputation message filter rule.

  'domain_exception_list' is the name of a domain exception list. If a domain exception list is not present it is displayed as "".

Example

In the following message, if the message failed the SDR check, the message is quarantined.

Quarantine_Messages_Based_On_Sender_Domain_Unscannable: if (sdr-unscannable ("")) {quarantine("Policy");}