Can't get rules to apply, being ignored?

[vigilante]

Hi, I hope someone can answer this pickle!

In the default MS config, the "Find Phishing Fraud" value was set to yes, but this caused an issue where our own outgoing mail to a customer got scary red text in their Email (from us) warning it's a phishing fraud! MS didn't like the link we used I guess.

In MS it says I can use a rules file for this setting, so I created a rules file and pointed the setting to "%rules-dir%/phish.scanning.rules".

I have run a bunch of tests using the original problem Email and having them send it to my Gmail. When I change the MS value to "no", the red text doesn't appear, that's normal. When I used a rules file and inside the rules file I simply put FromorTo: default no, the red text doesn't appear either, so I know the rules file is working (I think?).

Here is the problem, I just want our incoming mail scanning for phishing, NOT our outgoing, so I put entries like this in the rules file:
To: *@ourdomain yes
To: *@anotherdomain yes
FromorTo: default no

And with this setup, the red text still appears, as if the "To" entires are being ignored. I've resaved the file, made sure there were tabs between text, restarted services etc etc.

So basically, how can I used a rules file for phishing such that it only scans incoming mail?

Thanks!

[vigilante]

I would like to get this fixed.

I've read all about rules files and how they work, but it seems it's just ignoring the "To:" entries and is still doing phishing scans on our outgoing mail, I don't get it.

How do I set up a phishing scan rules file to only scan incoming mail?

[Sarah]

The mail that you are referring to as "outgoing" - is a copy actually being sent to any users on your server? If so, then it is considered "incoming" even if some copies are being sent off server. For instance, if any of the recipients match any of the "yes" entries, then the mail will be scanned and marked for all recipients.

[vigilante]

I imagine sometimes that is the case, especially if we CC certain customer support Emails.
Would this apply to BCC too?


I will test that theory some more.