How to block and allow domain in spam filter

[Tien Ngo Thanh]

Hello

    I had add tow policy in spam filter 

     1 . Allow domain and some sender

             this policy add some sender and domain in allow list .block list empty

     2. Block domain and some sender

            this policy add some sender and domain in block list .allow list empty . in this policy i try add block email test@gmail.com 

     --> But when I try login to gmail with user test@gmail.com and send to email in my domain then it still can received email .I think it must block all email from this email address (test@gmail.com)

           so can order policy process it only process top policy ?

           please any one help me

     

[#2]

Hi @Tien Ngo Thanh,

See article

https://docs.microsoft.com/en-gb/office365/SecurityCompliance/configure-your-spam-filter-policies

In your block policy make sure that the spam and bulk email actions are set to delete as opposed to move messages to junk email folder.

Alternatively, you can set up a transport rule to block the message if you have issues.

Hope that answers your question

Best, Chris

[#3]

Hello

     Because Policy allow i want move to junk , policy block move quarantine should i must create two policy

     issue here i seem it not process as order , i thing it must process allow policy ->block policy -> default policy 

     I want configure block some sender and domain and move it to quarantine , please guide help me

[#4]

I would try by promoting the block rule to the highest priority. As per the article above you can also set the severity of the rule.

Hope that answers your question.

Best, Chris

[#5]

I try change order policy as below but seem it not process allow policy .Because had add some sender allow not spam as i check tracer mail then see it block to quarantine (because policy block check if spam then move to quarantine ). this seem it only process one top policy and not all order policy ?

[#6]

Hi @Tien Ngo Thanh,

Ok, in this case I would recommend merging them into the default policy and do as follows

1.) Take domains/addresses in 'Allow Sender or Domain Spam' and add them to the Allow List
2.) Take domains/addresses in 'Block Sender or Domain Spam' and add them the Block List
3.) Set Default spam and bulk actions as Quarantine

Then you have a single policy with single set of actions as opposed to three policies which may conflict with each other.

Can you confirm whether this has worked?

Best, Chris

[#7]

Hello

   But if do that so then all email that mark spam will to quarantine , but this i only want some sender to quarantine not all

Best regards,

Thanks

[#8]

Hmm, ok - In that case, should you not have two policies?

1.) Block Sender or Domain Spam (Primary)
2.) Default, Take domains/addresses in 'Allow Sender or Domain Spam' and Set spam and bulk actions as Send to Junk (Secondary)

Best, Chris

[#9]

Hello

     I just tracer after create two policy as your recommend but seem all spam to quarantine , this seem it only process one policy (primary). I think policy about  block sender to quarantine should create rule mail in exchange

   

[#10 · Accepted solution]

Yes, this is the final recommendation if multiple spam policies are not working.

Keep the default spam policy to send to junk and add a rule to quarantine mail from the explicit domains/users.

Can you test this?

Best, Chris

[#11]

I will try test and let you know result .Thanks

[#12]

Final , I move all allow list sender and domain to block policy .Default policy sẽ not change any thing and see it work as required

 Thanks all support

[#13]

Not a problem. Hope to help you soon @Tien Ngo Thanh