This article applies to:

• Trustwave MailMarshal (SEG)

Question:

• Why are my Connection (Receiver) rules not blocking some email addresses in my list of denied addresses?

Information:

Connection rules (known as Receiver rules in earlier versions) have access to the MAIL FROM information provided by the email server that delivered the message. They do not have access to the 'from' field included in the header of the email. The addresses provided in the two different locations are normally the same. However sometimes they may be different if a sender is trying to hide their email address or in case of newsletters and other legitimate bulk mail. The authoritative email address is contained in the MAIL FROM information. If you have made a deny list entry based on the addresses contained in the 'from' field sometimes there will be false positives or false negatives. 

For more technical detail, see Knowledge Base article Q12238.

Resolutions:

• Create a Content Analysis rule (Standard rule) as well as a Connection rule. Content Analysis rules check the MAIL FROM information and the 'from' address information in the header of the email. This will make sure the actual sending email address is checked.
• In order to ensure you create a Connection rule that catches a sender correctly review the MailMarshal SMTP receiver logs to find the details contained in the MAIL FROM information. Then add the address to the list of addresses to be blocked. If you archive the emails that are spam it is possible to see the MAIL FROM information in the console by selecting Copy message log file as well. 
  
  NOTE: It is beneficial to create Connection rules as they prevent wasting the bandwidth required to receive the entire email when using Content Analysis rules.