Method to block the emails going outside the organization in case of email outbreak. Organizations want to block the emails going out to avoid blacklisting the domain on ISP as a result of outbreak
Problem Statement:
Organizations wants to block the outbound emails which is going outside the organization when outbreak is triggered and allowing inbound email. This is required to avoid blacklisting the email domain on ISP due to email outbreak with same subject or attachment.
As SMSMSE has limitation to bifurcate the email message recipients as external and internal and block outgoing only; to resolve this problem we can leverage exchange transport rule capability in addition with SMSMSE outbreak management and Content Filter Rule.
Steps to apply the solution:
When an outbreak is triggered; for e.g. same attachment name; the attachment name would be updated in match list “Outbreak Triggered Attachment Names”.
- Here we have enabled the Outbreak rule to update the match list
![1.png]()
- Enable CF rule “Quarantine Triggered Attachment Names” for outbound emails only;
![2.png]()
- Select Action as “Log Only” with “Add X-header(s)” as shown below;
![3.png]()
Now we have to create the Exchange Transport Rule to block the outbound emails (Emails going out to internet) using above X-Header value
4. Open Exchange Management Shell and run the following command.
New-TransportRule -Name SMSMSEOutbreakManagement -SentToScope:NotInOrganization -HeaderContainsMessageHeader "X-SymOutbreak" -HeaderContainsWords "Outbreak" -RejectMessageReasonText "Rejected as a result of outbreak"
The Rule would look like in below image in Exchange Control Panel
![4.png]()
Now the entire system is ready to handle the Outbreak and in turn block the emails with outbreak terms going outside the organization.
The NDR email is sent to sender user when an outgoing email is sent with Outbreak triggered term.
![6.png]()
Here we have no limitation of having internal and external recipients in To field. Exchange will take care of blocking only external recipients using Exchange transport rule which we created in step 4.
Work Flow:
For e.g. an Outbreak is configured for Same Attachment Name.
- An outbreak is triggered for same attachment name
- As configured Outbreak manager would update the match list “Outbreak Triggered Attachment Names”
- For further email sent to outside recipient with the same attachment name the CF rule “Quarantine Triggered Attachment Names” would add the X-Header “X-SymOutbreak: Outbreak”
- The Exchange transport rule “SMSMSEOutbreakManagement” would block the emails going to external world.
For Subject use “Quarantine Triggered Subjects” CF rule with similar configuration as “Quarantine Triggered Attachment Names”
e.g.
![5.png]()
