Join Log in
Score:1
avatar Server

Exchange 365 Spam Filter Policy Block Domain TLD

hk flag
AdamRoof

We migrated to cloud from on premise Exchange 2010. In Sonicwall ESA, I was able to block TLDs (Top Level Domains). In the Exchange Admin Center, I see I can set individual or additional "Rules", however, no option I can see to test TLD against a dictionary to block the domain. In the Microsoft 365 Security Center, under Policies > Anti-Spam > (new policy), it appears I can edit "Allowed and blocked senders and domains" but do not see how to block against a list of TLDs, or if should enter ".domain" or just "domain". Locating the documentation of settings seems difficult to locate.

In the "Tenant Allow/Block Lists" it appears to allow entry of only 20 domains and might be temporary.

Where would be best to Create a dictionary of TLDs, and Create an organizational block of these sending domains?

In example, we would get spam from .bar, .date, .webcam, etc. I realize its a losing battle, but my list of about 75 TLDs was effective in a large reduction of daily spam. Now that we are on 365, they have returned to an offensive level with the default 365 filters.

If a spam filter connector is the best way to proceed, can you provide some experience with SonicWall, or TrendMicro, or your vendor of choice vs the cost, setup, and management of the hosted filter service?

76
0 + 0
Score:1
yagmoth555 avatar Server
cn flag
yagmoth555

I would use the Transport Rules of O365.

Exchange Admin Centre -> Mail Flow -> Rules

Apply this rule if…. The send address matches;

In the condition box you need to entrer the domain that way, \.domain$, or \.webcam$, etc..

And select to Reject the email.

0 + 0
hk flag
AdamRoof
Seems in 2016 an exact issue was had. And the result of MS support is to do an EXCEPT and a domain list, which is not viable (would have to enter all accepted domains instead). We have .com.tw and .co.tw , in example, but from many countries. What I am looking for is option to EXCLUDE a list. [link]https://answers.microsoft.com/en-us/msoffice/forum/all/blocking-tld-top-level-domain-in-office365-small/353e9e4f-713f-493e-9388-d5eb37ac6fc9[/link]
0
Reply
Appleoddity avatar
ng flag
Appleoddity
@AdamRoof the answer is correct. Create a transport rule and block the domains (using regex syntax) based on sender address. Send them to quarantine or reject them all together if you want. It’s fully configurable.
1
Reply
hk flag
AdamRoof
@Appleoddity no where in "spam filter of 0365" do I see where to apply any rules with regex against the send address. Where are the transport rules you speak of?
0
Reply
Appleoddity avatar
ng flag
Appleoddity
@AdamRoof you’re right. It is not spam filter rules - I overlooked that. It’s a transport rule, like I said. https://techwizard.cloud/2016/01/08/block-sender-in-office-365-based-on-regex-pattern/amp/
1
Reply
yagmoth555 avatar
cn flag
yagmoth555
I will edit, I typed too fast too (and the regex lost their formating due to the editor, correcting that too)
0
Reply
hk flag
AdamRoof
Ok, thanks for the edits! Helps clarify. I've added a rule and action of generate incident report, and test without policy tips, along with a few common TLDs we receive. I will let you know if get some matches, shouldnt be long :(
0
Reply
hk flag
AdamRoof
It WORKS! EAC > Mail Flow > Rules > + Create New Rule > Name: Block Bad Domains > Apply this rule if: The sender is located "Outside the Organization" (prob not needed) > Click More options... (blue link toward bottom) > Add condition button > And The sender address matches... > enter your domain list one at a time to list " \.bad$ " format works. > Do the following... > delete the message without notifying anyone (or generate incident report) > Enforce (or Test with Policy Tips) > Stop Processing more rules (set priority to 0
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.