SPF question

Your SPF record uses softfail. Many products do not track softfails as a actual fail.

You should move to fail. en.wikipedia.org/.../Sender_Policy_Framework

Thanks I changed SPF to "-all" we'll see if that helps.

I was wondering if I could create an email policy that would drop any incoming email sent by an email @mydomain.org from any external IP.

Would that be possible to filter like that if SPF record isn't enough ?

Hello Mathieu,

In the XG you can go to Protect >> Email >> General Settings >> Blocked Senders and add the domain you want to block there.

You can potentially add your own domain in there, to avoid spoof emails, however, if you receive or expect to receive Mail from bulk organizations that use your email domain, they would get block too, or any other type of email that spoofs your domain email address.

Regards,

Hello Mathieu,

In the XG you can go to Protect >> Email >> General Settings >> Blocked Senders and add the domain you want to block there.

You can potentially add your own domain in there, to avoid spoof emails, however, if you receive or expect to receive Mail from bulk organizations that use your email domain, they would get block too, or any other type of email that spoofs your domain email address.

Regards,

Thank you for your answer.

I don't seem to have that "Blocked Senders" option though (maybe because Sophos is in transparent proxy mode ?)

I may try to add a "SMTP scanning policy" with filters on "sender" domain and on "Source IP/network address."

Regards.

Hello there,

In Legacy Mode, you can follow this KB which is basically what you mention you’ll be doing, the KB is the opposite how to allow email, but you can do the same for rejecting. 

Regards,