GFI Forums: Kerio Connect » External Email Warning

Home » GFI User Forums » Kerio Connect » External Email Warning (Add warning when email was not sent from domain)

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

External Email Warning [message #149578]

Thu, 08 April 2021 15:11

ohioits
Messages: 1
Registered: April 2021

To help stop spoofing I would like to add an EXTERNAL EMAIL warning message on the subject line or body of the email.

I have already set up a Rule in Message Filters Incoming that has
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
add [WARNING - External email] ${subject}

But is still adding it to all emails, replies, and forward to our users

[WARNING - External email] Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite
Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite

How can I configure this?

Report message to a moderator

Re: External Email Warning [message #149600 is a reply to message #149578]

Tue, 13 April 2021 15:46

brandonh75
Messages: 62
Registered: June 2011
Location: Burnsville, MN

This seems to work correctly for us...

ALL
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
SENDER --> DOES NOT CONTAIN --> (MYDOMAIN.COM)
SUBJECT --> DOES NOT CONTAIN --> [EXTERNAL]
CHANGE HEADER SUBJECT [EXTERNAL] ${subject}

I don't remember why we have both FROM and SENDER. The SUBJECT line is to keep [EXTERNAL] from showing up repeatedly.

Report message to a moderator

Re: External Email Warning [message #149611 is a reply to message #149600]

Thu, 15 April 2021 11:05

OliviaParcker
Messages: 6
Registered: April 2021

Outlook 2019 is already supported.

Why do you ask for this?

Report message to a moderator

Re: External Email Warning [message #149617 is a reply to message #149578]

Fri, 16 April 2021 09:17

freakinvibe
Messages: 588
Registered: April 2004

ohioits wrote on Thu, 08 April 2021 15:11

To help stop spoofing I would like to add an EXTERNAL EMAIL warning message on the subject line or body of the email.

I have already set up a Rule in Message Filters Incoming that has
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
add [WARNING - External email] ${subject}

But is still adding it to all emails, replies, and forward to our users

[WARNING - External email] Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite
Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite

How can I configure this?

While I can't help you with the rules, I have a suggestion: You can avoid external senders from spoofing your own email domain in the sender address with some controls in Kerio Connect. This will block the emails, so no need to flag them in the subject:

Go to Configuration > Domains > yourmaildomain.com

Click on the Security tab

Tick "Reject messages with spoofed sender identity"

Click "OK"

That will avoid these messages from arriving at the users.

In addition you can also set up SPF to prevent spammers from using your domain as a sender address to send mail to anyone in the world.

Dexion Services AG - IT Support Services in Basel, Switzerland
https://dexionag.ch

Report message to a moderator

Re: External Email Warning [message #150536 is a reply to message #149617]

Tue, 16 November 2021 11:43

nitrocoffee
Messages: 1
Registered: November 2021

Hi,

I was wondering how the progress is here about this topic. I want this in the body of all incomming emails from other domains.

Warning: this email is from outside this domain, do not click on links unless you trust the sender... etc etc

in the spamfilter rules there is no option for body, just in the header or topic. anyone other ideas ?

thanks

Report message to a moderator

Re: External Email Warning [message #151500 is a reply to message #150536]

Fri, 22 April 2022 20:59

jdavidson
Messages: 8
Registered: December 2018

Hello;

I was wondering if this has ever been addressed. I would like to ability to insert/inject a warning line into the BODY of all emails that do not originate from my own domain.

Is this possible?

Report message to a moderator

Re: External Email Warning [message #151501 is a reply to message #151500]

Sat, 23 April 2022 00:08

Nick.Geary
Messages: 73
Registered: January 2021

We are able to insert a dislaimer in the subject using inbound filter rules. However, modifying the body of an email is not possible.

https://support.kerioconnect.gfi.com/hc/en-us/articles/36001 5189560-Creating-Incoming-Rules

Nick Geary
GFI Software

Report message to a moderator

Re: External Email Warning [message #152535 is a reply to message #149578]

Sat, 20 August 2022 05:56

Rahm-o
Messages: 8
Registered: September 2013

This is a revision to the sample filter code mentioned in an earlier post.

I've added the "at sign" (yes, I spelled that out, because the forum doesn't allow the sign) before your domain name. It's necessary because spammers/scammers are adding in YOUR domain name into the return path of their emails, which then allows those emails to get past the filter code if it's written as described in the earlier post. By doing this, it filters the use of your own domain name in the Return Path.

This is an example of how they put your domain into the return path (visible in mail headers):

Return-Path: <bounces+12345678-myemail=mydomain.com<_at_>spammerdomain.com >

OK, so here's how you should write the filter:

ALL of the following conditions must be met:
FROM - DOES NOT CONTAIN - <_at_>mydomain.com
SENDER - DOES NOT CONTAIN - <_at_>mydomain.com
SUBJECT - DOES NOT CONTAIN - [EXTERNAL]

Perform the following actions:
CHANGE HEADER - SUBJECT - [EXTERNAL] ${subject}

DON'T ACTUALLY ADD "<_at_>" BEFORE YOUR DOMAIN NAME - REPLACE IT WITH THE "AT SIGN" - THE GFI FORUM PREVENTS THAT SIGN FROM BEING ENTERED. SEE THE ATTACHED SCREENSHOT FOR CLARITY.

/index.php?t=getfile&id=5361&private=0

In regards to the question as to why you need to have both FROM and SENDER in the filter: both of these fields are used in email sending. The SENDER domain is what the receiving email server sees when initiating the session. The FROM address is what your recipients will see. Including both is a way to ensure both are covered.

Attachment: external-warning.png
(Size: 122.70KB, Downloaded 448 times)

[Updated on: Fri, 26 August 2022 10:59] by Moderator

Report message to a moderator

Re: External Email Warning [message #152546 is a reply to message #151501]

Mon, 22 August 2022 10:12

raymondalston
Messages: 2
Registered: August 2022

Nick.Geary wrote on Sat, 23 April 2022 00:08

We are able to insert a dislaimer in the subject using inbound filter rules. However, modifying the body of an email is not possible.

https://support.kerioconnect.gfi.com/hc/en-us/articles/36001 5189560-Creating-Incoming-Rules drift hunters

Thanks!

Report message to a moderator

Re: External Email Warning [message #152547 is a reply to message #152535]

Mon, 22 August 2022 10:14

raymondalston
Messages: 2
Registered: August 2022

I was curious as to the current state of this discussion. I'd want this to appear in the body of all emails coming into my inbox from other domains.

Report message to a moderator

Re: External Email Warning [message #152827 is a reply to message #152547]

Fri, 07 October 2022 16:15

npaul62
Messages: 3
Registered: November 2020

hello,

the Kerio team has planned an update ?? with the body of all emails coming into my inbox from other domains.

Thx.

Report message to a moderator

Re: External Email Warning [message #152945 is a reply to message #152535]

Wed, 19 October 2022 14:37

robinbateman
Messages: 225
Registered: April 2012
Location: Oxford(ish) UK

Would be great if it was possible to create an outgoing rule to remove the [EXTERNAL] warning but his does not seem possible

Robin Bateman
One Red Mouse
Blog: http://bit.ly/OWjcGL

Report message to a moderator

Re: External Email Warning [message #152951 is a reply to message #149600]

Wed, 19 October 2022 17:38

Bud Durland
Messages: 586
Registered: December 2013
Location: Plattsburgh, NY

Quote:

I don't remember why we have both FROM and SENDER.

As I recall, FROM is the content of the "from:" line as visible in the message. "Sender" is the sender as specified in the SMTP envelope, which doesn't have to be the same. It can be seen in the message headers as the "X-ENVELOPE-FROM" line.

Report message to a moderator

Previous Topic:	KC 9.4.2 experiences?
Next Topic:	Calendar Availability Mac OS Big Sur

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Fri Feb 03 12:17:13 CET 2023

Total time taken to generate the page: 0.03021 seconds