Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to whitelist an incoming address in Trend IMSS v5 - in practice, emails from this address will have an attachment & we want the message / attachment to bypass the existing 'executable attachments' rule. Have copied from an existing (working) whitelist rule, but for reasons I can't see the new rule is failing to match & emails from sender are then triggering the subsequent 'executable attachments' rule.

Rule created as follows, and ordered ahead of the the 'executable attachments' rule: Global Policy -> Create New Filter -> Advanced Content Filter

Set to match on Mail Header -> From, with a single expression to check. Have tested this expression both with the full email address of the required sender & wildcard for the domain, eg:

...but neither form is matching the sender. I'm probably missing something obvious here, but currently drawing a blank. Would appreciate any suggestions on what I haven't considered...

share|improve this question
up vote 0 down vote accepted

Got it sorted after some further digging around. Seemed I was coming at the problem from the wrong angle. Solution was:
- create Address Group for the addresses to be 'whitelisted'
- add a Sub-policy & routing for the Address Group & required recipients
- disable the attachments policy for that sub-policy only.
Tested and working.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.