I'd like to forward all mail from a particular domain to a mailbox for analysis, rather than block outright in Mail Security. Is there a method to accomplish this?
If you simply allow the emails to be captured in the quarantine, you can look at them in Mail Manager, and in MM, you can enter microsoft.com to just see emails from microsoft.com. Is there some other analysis you want to do that you can't do by selecting 'view' to look at the emails in Mail Manager?
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
Hey Bob,
What I've done is added the domain to my blacklist under SMTP settings. I checked MM and there was no quarantined blacklist email, but I know that this domain continues to send mail our way. I know I'm missing something here...
I'm sorry, I should have been more precise. If you put the domain in the blacklist, the emails will be rejected. If you want to capture them in the quarantine, put the domain name into the next box down: 'Expression filter'.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
Thanks Bob, did as you suggested and will be monitoring the MM over the next few weeks. Any other quarantine settings I need to modify or is this pretty much a default behavior of the ASG?