Matching Distribution Group email addresses in ECM

This article applies to:

• Trustwave ECM/MailMarshal Exchange

Question:

• How do I match distribution group email addresses?
• Can't apply policy to a Distribution Group 

Background:

In Exchange mailflow, Distribution Groups are expanded into the individual recipient addresses before a message is passed to agents such as the ECM Exchange Agent. ECM User Matching will not match the distribution group address because it is not in the list of addresses provided in the meta-data of the message.

However the message file includes the text of the To: header and other headers of the message. These text headers do provide the original recipient information, including the SMTP address associated with a Distribution Group. You can use ECM Header Matching rule conditions to match Distribution Groups.

Procedure:

To set up a header matching condition:

1. In the ECM Configurator, use the Rule Wizard to create a rule.
2. Do not set any User Matching conditions.
3. Select the Rule Condition Where message contains one or more headers.
4. Click New to create a Header Match rule.
5. Use the following options:
   • Field Matching: To: (and/or any other fields where you want to match the address, such as CC: or BCC:)
   • Field Parsing: Entire Line
   • Do not select "Match case"
   • Field search expression: the SMTP email address of the list, enclosed in < > brackets (for example, if the address is mylist@exchange.local the expression should be <mylist@exchange.local> ).
6. If the distribution list has more than one SMTP address, add an additional Header Match rule (within the same condition) for each SMTP address.
7. Complete the main rule with Rule Actions, save, and commit configuration.

Notes:

• The purpose of adding the < > is to ensure that only the exact email address will match.
• This tip depends on the fact that all the SMTP addresses provided in the headers are enclosed in < >.
• If you do not include the leading < then the expression mylist@exchange.local would also match enemylist@exchange.local and any other address that includes the expression.
• To match the same local part in many local domains, you could use a field search expression that matches only up to the @ (for example, <mylist@ ). This option assumes the rule only applies to incoming or internal messages.
• To apply a rule to messages from both external and local senders, with the default ECM policy structure you must create two rules (one for Incoming and one for Internal messages). You could also create a new Policy Group that applies to both Incoming and Internal messages.