Trying to whitelist an incoming address in Trend IMSS v5 - in practice, emails from this address will have an attachment & we want the message / attachment to bypass the existing 'executable attachments' rule. Have copied from an existing (working) whitelist rule, but for reasons I can't see the new rule is failing to match & emails from sender are then triggering the subsequent 'executable attachments' rule.
Rule created as follows, and ordered ahead of the the 'executable attachments' rule: Global Policy -> Create New Filter -> Advanced Content Filter
Set to match on Mail Header -> From, with a single expression to check. Have tested this expression both with the full email address of the required sender & wildcard for the domain, eg:
...but neither form is matching the sender. I'm probably missing something obvious here, but currently drawing a blank. Would appreciate any suggestions on what I haven't considered...