GFI Software

Welcome to the GFI Software community forum! For support please open a ticket from https://support.gfi.com.

Home » GFI User Forums » Kerio Connect » External Email Warning (Add warning when email was not sent from domain)
External Email Warning [message #149578] Thu, 08 April 2021 15:11 Go to next message
ohioits is currently offline  ohioits
Messages: 1
Registered: April 2021
To help stop spoofing I would like to add an EXTERNAL EMAIL warning message on the subject line or body of the email.

I have already set up a Rule in Message Filters Incoming that has
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
add [WARNING - External email] ${subject}

But is still adding it to all emails, replies, and forward to our users

[WARNING - External email] Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite
Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite

How can I configure this?


Re: External Email Warning [message #149600 is a reply to message #149578] Tue, 13 April 2021 15:46 Go to previous messageGo to next message
brandonh75 is currently offline  brandonh75
Messages: 67
Registered: June 2011
Location: Burnsville, MN
This seems to work correctly for us...

ALL
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
SENDER --> DOES NOT CONTAIN --> (MYDOMAIN.COM)
SUBJECT --> DOES NOT CONTAIN --> [EXTERNAL]
CHANGE HEADER SUBJECT [EXTERNAL] ${subject}

I don't remember why we have both FROM and SENDER. The SUBJECT line is to keep [EXTERNAL] from showing up repeatedly.
Re: External Email Warning [message #149611 is a reply to message #149600] Thu, 15 April 2021 11:05 Go to previous messageGo to next message
OliviaParcker is currently offline  OliviaParcker
Messages: 6
Registered: April 2021
Outlook 2019 is already supported.

Why do you ask for this?
Re: External Email Warning [message #149617 is a reply to message #149578] Fri, 16 April 2021 09:17 Go to previous messageGo to next message
freakinvibe is currently offline  freakinvibe
Messages: 593
Registered: April 2004
ohioits wrote on Thu, 08 April 2021 15:11
To help stop spoofing I would like to add an EXTERNAL EMAIL warning message on the subject line or body of the email.

I have already set up a Rule in Message Filters Incoming that has
FROM --> DOES NOT CONTAIN ---> (MYDOMAIN.COM)
add [WARNING - External email] ${subject}

But is still adding it to all emails, replies, and forward to our users

[WARNING - External email] Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite
Fwd: [WARNING - External email] Fwd: [WARNING - External email] RE: P4800650 expedite

How can I configure this?


While I can't help you with the rules, I have a suggestion: You can avoid external senders from spoofing your own email domain in the sender address with some controls in Kerio Connect. This will block the emails, so no need to flag them in the subject:

Go to Configuration > Domains > yourmaildomain.com

Click on the Security tab

Tick "Reject messages with spoofed sender identity"

Click "OK"

That will avoid these messages from arriving at the users.

In addition you can also set up SPF to prevent spammers from using your domain as a sender address to send mail to anyone in the world.



Dexion Services AG - IT Support Services in Basel, Switzerland
https://dexionag.ch
Re: External Email Warning [message #150536 is a reply to message #149617] Tue, 16 November 2021 11:43 Go to previous messageGo to next message
nitrocoffee is currently offline  nitrocoffee
Messages: 1
Registered: November 2021
Hi,

I was wondering how the progress is here about this topic. I want this in the body of all incomming emails from other domains.

Warning: this email is from outside this domain, do not click on links unless you trust the sender... etc etc

in the spamfilter rules there is no option for body, just in the header or topic. anyone other ideas ?

thanks



Re: External Email Warning [message #151500 is a reply to message #150536] Fri, 22 April 2022 20:59 Go to previous messageGo to next message
jdavidson is currently offline  jdavidson
Messages: 8
Registered: December 2018
Hello;

I was wondering if this has ever been addressed. I would like to ability to insert/inject a warning line into the BODY of all emails that do not originate from my own domain.

Is this possible?
Re: External Email Warning [message #151501 is a reply to message #151500] Sat, 23 April 2022 00:08 Go to previous messageGo to next message
Nick.Geary is currently offline  Nick.Geary
Messages: 73
Registered: January 2021
We are able to insert a dislaimer in the subject using inbound filter rules. However, modifying the body of an email is not possible.

https://support.kerioconnect.gfi.com/hc/en-us/articles/36001 5189560-Creating-Incoming-Rules


Nick Geary
GFI Software
Re: External Email Warning [message #152535 is a reply to message #149578] Sat, 20 August 2022 05:56 Go to previous messageGo to next message
Rahm-o is currently offline  Rahm-o
Messages: 8
Registered: September 2013
This is a revision to the sample filter code mentioned in an earlier post.

I've added the "at sign" (yes, I spelled that out, because the forum doesn't allow the sign) before your domain name. It's necessary because spammers/scammers are adding in YOUR domain name into the return path of their emails, which then allows those emails to get past the filter code if it's written as described in the earlier post. By doing this, it filters the use of your own domain name in the Return Path.

This is an example of how they put your domain into the return path (visible in mail headers):

Return-Path: <bounces+12345678-myemail=mydomain.com<_at_>spammerdomain.com >

OK, so here's how you should write the filter:


ALL of the following conditions must be met:
FROM - DOES NOT CONTAIN - <_at_>mydomain.com
SENDER - DOES NOT CONTAIN - <_at_>mydomain.com
SUBJECT - DOES NOT CONTAIN - [EXTERNAL]

Perform the following actions:
CHANGE HEADER - SUBJECT - [EXTERNAL] ${subject}


DON'T ACTUALLY ADD "<_at_>" BEFORE YOUR DOMAIN NAME - REPLACE IT WITH THE "AT SIGN" - THE GFI FORUM PREVENTS THAT SIGN FROM BEING ENTERED. SEE THE ATTACHED SCREENSHOT FOR CLARITY.


/index.php?t=getfile&id=5361&private=0


In regards to the question as to why you need to have both FROM and SENDER in the filter: both of these fields are used in email sending. The SENDER domain is what the receiving email server sees when initiating the session. The FROM address is what your recipients will see. Including both is a way to ensure both are covered.

[Updated on: Fri, 26 August 2022 10:59] by Moderator

Report message to a moderator

Re: External Email Warning [message #152546 is a reply to message #151501] Mon, 22 August 2022 10:12 Go to previous messageGo to next message
raymondalston is currently offline  raymondalston
Messages: 2
Registered: August 2022
Nick.Geary wrote on Sat, 23 April 2022 00:08
We are able to insert a dislaimer in the subject using inbound filter rules. However, modifying the body of an email is not possible.

https://support.kerioconnect.gfi.com/hc/en-us/articles/36001 5189560-Creating-Incoming-Rulesdrift hunters
Thanks!
Re: External Email Warning [message #152547 is a reply to message #152535] Mon, 22 August 2022 10:14 Go to previous messageGo to next message
raymondalston is currently offline  raymondalston
Messages: 2
Registered: August 2022
I was curious as to the current state of this discussion. I'd want this to appear in the body of all emails coming into my inbox from other domains.
Re: External Email Warning [message #152827 is a reply to message #152547] Fri, 07 October 2022 16:15 Go to previous messageGo to next message
npaul62 is currently offline  npaul62
Messages: 3
Registered: November 2020
hello,

the Kerio team has planned an update ?? with the body of all emails coming into my inbox from other domains.

Thx.
Re: External Email Warning [message #152945 is a reply to message #152535] Wed, 19 October 2022 14:37 Go to previous messageGo to next message
robinbateman is currently offline  robinbateman
Messages: 226
Registered: April 2012
Location: Oxford(ish) UK

Would be great if it was possible to create an outgoing rule to remove the [EXTERNAL] warning but his does not seem possible

Robin Bateman
One Red Mouse
Blog: http://bit.ly/OWjcGL
Re: External Email Warning [message #152951 is a reply to message #149600] Wed, 19 October 2022 17:38 Go to previous messageGo to next message
Bud Durland is currently offline  Bud Durland
Messages: 586
Registered: December 2013
Location: Plattsburgh, NY
Quote:

I don't remember why we have both FROM and SENDER.
As I recall, FROM is the content of the "from:" line as visible in the message. "Sender" is the sender as specified in the SMTP envelope, which doesn't have to be the same. It can be seen in the message headers as the "X-ENVELOPE-FROM" line.
Re: External Email Warning [message #153717 is a reply to message #149578] Fri, 03 February 2023 14:26 Go to previous message
Tip32a is currently offline  Tip32a
Messages: 14
Registered: February 2011
Hi Everyone,
I was asked by a hosted client of mine to do the same thing. I found the resolutions all of you have posted so I contacted Kerio support and the agent replied:

From the Chat transcript
*********
ME
I want to be able to add a message to the top of the body of messages that come in from an external domain to read "CAUTION: This email is from someone outside of {XYZ company}. Please take care when clicking links or opening attachments. When in doubt, contact the IT Department."
AGENT
I have not been able to find anything related to this. I'll create a Feature Request on your behalf.
*********

I find this VERY strange that GFI doesn't watch this forum and that nobody else has put in a feature request since this thread started.

I feel this is a very important feature and since Kerio Connect is up against Microsoft Exchange and M365 and SmarterMail. And all of them support the feature.

I am asking that you contact GFI at

https://support.kerioconnect.gfi.com/hc/en-us

And submit an official feature request. Remember ..... The squeaky wheel gets the grease...

Thank you.
Tom
Previous Topic: Anti Virus stopped
Next Topic: 2 Server with 2 different domains
Goto Forum:
  


Current Time: Fri Jun 02 00:04:47 CEST 2023

Total time taken to generate the page: 0.06452 seconds