Content Filtering

Content filtering is a great way for system administrators, domain administrators and/or users to perform actions on incoming emails that meet specific criteria. For example, it's possible to use content filters to delete messages with certain attachments (e.g., attachments with a .exe extension), forward messages from a specific email address to another account, move messages to a certain folder or even alter the subject of a message by appending something to it prior to delivery. While content filters are most commonly used to organize email by moving messages to specific folders, they're extremely flexible and allow you to filter messages the way you want to.

This particular topic documents the user-level Content Filtering screen — the filters an individual mailbox owner builds for their own inbox. As a system administrator you won't normally build filters here yourself, but understanding this screen matters for two reasons: you'll frequently need to explain it to users who submit support tickets about "missing" mail, and you need to understand exactly how these user-level filters interact with the domain-level filters you (or a domain administrator) manage, since the two levels share one execution pipeline and can silently override each other.

Content Filtering is available to users and domain administrators in the Settings and/or Domain Settings areas. System administrators have a Content Filtering tab available to them for each domain that's managed on the SmarterMail server. In both the Settings and Domain Settings areas, there is a Content Filtering option in the navigation menu that's used to see any existing filters as well as to manage filters. That being said, the filters created are only viewable/editable by the role that created them. That means the domain content filters are only available to domain administrators and users see their own filters. However, any filter created for a domain by a system administrator is available to both the system administrator and the domain administrator.

How Content Filters Are Evaluated (Execution Order)

Once the Content Filtering section is accessed, any existing filters will be listed. Content filters run in order, from top to bottom, and domain-level filters (which is what a system administrator is actually editing when they manage content filtering "for a domain") always run before a domain's individual user-level filters. Within each of those two levels, the FIRST filter whose conditions match is the one that's applied — so if a user has several of their own filters that could all apply to the same message, only the first matching one of theirs will act on it. However, this "first match wins" behavior only applies within a level: a domain-level filter can match and act on a message, and then one of the user's own user-level filters can still match and act on that same message afterward. The one exception is if the domain-level filter's action was Delete message or Bounce message, in which case the message never reaches that user's content filters at all — the delivery engine considers the message's fate already decided and never even evaluates the user-level filter set.

So, if you're seeing weird or unexpected behavior for messages, you may want to re-organize the order of your filters. You do this by moving them by clicking the Up and Down arrows next to the content filter names, moving them up and down in the "order of operations." You may also want to contact your domain administrator to see if they have any content filters created that could be impacting message delivery.

Troubleshooting Example: A Domain-Level Filter Silently Blocking a User's Filter

Here's a scenario that plays out often enough to be worth walking through directly, since it's the kind of issue only a system administrator (or domain administrator) is positioned to diagnose. A user reports that messages from a specific vendor, say billing@example.com, are never showing up anywhere — not in their Inbox, not in the folder their own content filter is supposed to move them to, and not even in Deleted Items. The user swears their content filter (From Address is billing@example.com, action: Move to a "Vendors" folder) is configured correctly, and when you check it, it is.

The likely cause: the domain administrator (or the system administrator managing that domain) has their own content filter matching messages from that same sender — perhaps a broader rule targeting the sender's domain, or a spam-related rule that happens to catch these messages — with a Delete message or Bounce message action. Because domain-level filters always run first and "first match wins" per level, that domain-level filter deletes or bounces the message before the user's own "Vendors" filter is ever evaluated. From the user's perspective the mail simply vanishes, with no folder move, because their filter never got a chance to run at all.

• As the system administrator, open Content Filtering for that domain (the same screen documented on this page, but scoped to the domain) and look for any filter whose conditions could match that sender, paying particular attention to filters with a Delete or Bounce action.
• Check filter order within the domain's list — a broad "From specific domains" or spam-related filter positioned above a narrower one will win first, regardless of which one seems more specific.
• If you have Detailed-level Delivery logging enabled, search the delivery log for the message (by spool ID or recipient) and look for a line resembling "Delivery for ... has completed (...) Filter: <filter name>". The Filter value names whichever content filter (or spam action) actually fired for that recipient, which tells you immediately whether the domain-level filter or the user's own filter was responsible.
• If a domain-level Delete/Bounce filter is confirmed as the cause, work with the domain administrator to either narrow its conditions, change its action to something less absolute (such as Move to Folder), or reorder it below more specific rules, so it stops pre-empting every user-level filter for that domain.

To delete a content filter, simply select it from the list and click the Delete button.

Create/Edit Content Filters

When adding a content filter, the following tabs will be available: Options, Conditions, and Actions. The Options tab is where you name the Content Filter and set its match type; Conditions are where you set the initial parameters for the filter; Actions are those things that occur when the Conditions are met.

Options

The Options tab consists of the General card where you set the following:

• Name - The friendly name chosen to describe the rule.
• Match Type - Because multiple conditions can be configured per content filter, SmarterMail provides the option to require ALL conditions to be met or ANY of the conditions to be met in order for the rule's action to be triggered. Internally this is a straightforward logical AND versus OR across every condition configured on the filter — there's no weighting or partial-match scoring involved. Select the appropriate option from this list. For example, a filter meant to isolate "urgent invoices from Accounting" might use ALL with two conditions (From specific domain accounting.example.com AND Subject contains "invoice"), while a filter meant to catch several unrelated known-bad senders would use ANY with a list of From Address conditions.
• Enable wildcards in search strings (* and ?) - Wildcards can be used to replace a specific word, phrase or character, where a question mark (?) represents exactly one character and an asterisk (*) represents any run of text (including no text at all). Matching is glob-style, not regular-expression style, and it's not case-sensitive. For example, if you wanted to block sales01@domain.com, sales02@domain.com and sales03@domain.com, you could enter sales??@domain.com. If you wanted to block all sales addresses regardless of how many digits or characters follow, you could enter sales*@domain.com instead (or just sales* to match the local part alone). Leaving this option off makes the filter look for the text as an exact substring, so * and ? would just be treated as literal characters rather than wildcards.
• Include System Messages and Mailing Lists when evaluating conditions - This is enabled by default, meaning your content filters do evaluate incoming system messages and mailing list messages along with regular mail. If you'd rather your content filters ignore those message types, disable this setting.

Conditions

Click on New Condition to specify the criteria that triggers the rule's action(s). For each condition selected, you will be able to add specifications and enter any necessary details, as required. For example, if you choose to filter on 'From Address', you can enter one or multiple email addresses. If you choose to filter on 'Contains specific words or phrases', you can enter the specific text and choose to look for that text in an email's subject, message body, header, etc.

On many conditions, you also have the ability to reverse the logic of the criteria item by changing the Comparison selection. For example, imagine you only want to accept email from specific domains. You would choose the 'From specific domains' condition and set the Comparison field to 'Does Not Match". Any messages sent from domains that do not match what you've entered in the text box can be deleted.

The following conditions are available, separated by Condition Type:

From Address

This condition allows you to select whether you want to run the filter against specific addresses or domains, or trusted senders. Then, you set the comparison type: whether the field matches or doesn't match the condition type. Then, you enter in the addresses or domains you want to use for the filter. The fields to use include:

• From specific addresses
• From specific domains
• From trusted senders

Contains Specific Words or Phrases

This condition allows you to look in various areas for words or phrases, then take action when those words or phrases are found. You can set the comparison type, whether the words/phrases are found or not, and then the words or phrases you want to use for the filter. You can further refine a phrase search by enclosing the phrase in quotation marks. (The same can be done to individual words.) The fields to use include:

• Subject
• Body
• Subject or Body
• From Address
• To Address
• Email header
• Anywhere in message

To Address

This condition allows you to look in the To: or Cc: fields for specific addresses or domains. You can set the comparison type, whether the address or domain are included in the selected field, then the addresses or domains you want to use for the filter. The fields to use include:

• To specific addresses
• To specific domains
• Only to me
• My address in to field
• My address not in to field
• My address in to or cc field

Attachments

This condition allows you to filter emails based on whether or not messages have attachments, or even by specific filename, extension type, or file size. The fields to use include:

• Has any attachment
• Specific filenames
• Specific extensions
• Over specific size

Message Properties

This condition allows you to filter based on a number of different criteria, including flag type, message size, spam probability, etc. The fields to use include:

• Flagged as high priority
• Flagged as normal priority
• Flagged as low priority
• Message automated (no return address)
• Sender authenticated
• Message over size
• Message under size
• Received in date range
• Sent through a specific server (by IP address)
• Spam probability

Sender authenticated looks at whether the message arrived over an authenticated SMTP session (i.e., the sending client logged in with valid credentials rather than relaying anonymously). This is most useful for distinguishing internal, logged-in senders from anything arriving anonymously from the outside — for example, a filter that flags high priority for any message that's both from a specific address AND sender authenticated, to make sure a message really did come from a coworker's authenticated session rather than a spoofed From address. Keep in mind this condition (like Sent through a specific server) depends on connection-time information that's only available while the message is actively being delivered; see the note under Manually Running Filters below for how that affects on-demand filter runs.

Actions

Click on New Action to specify what should occur when an email triggers the content filter condition(s).

The following actions are available:

• Delete message - Deletes the message so that it will never arrive at your Inbox.
Note: Messages deleted through content filtering cannot be recovered.
• Bounce message - Sends a message back to the sender of the email saying that the message was bounced, and not delivered.
Note: If the system administrator has disabled bouncing (or the message doesn't meet the SPF-based bounce restriction the system administrator has configured under Antispam Administration/Options), the sender is never notified and the message is simply deleted instead of bounced.
• Move message - Delivers the incoming message to the folder you choose from the dropdown list.
Note: If you later delete that folder and leave the content filter active, the filter will automatically create the folder when the action is triggered.
• Add Header - Adds an email header within the incoming message, which can be useful when performing additional filtering through Outlook or other email clients. Headers should be formatted like "X-someheadername: value"
• Add Text to Subject - Appends a prefix to the subject line of the email. This is useful for categorizing emails as the subject line will be altered to include the text you specify in the text box.
• Forward message - Forwards a copy of the message to another email address and leaves you a copy of the message as well. As noted earlier, this action is automatically skipped for DSNs and for messages already marked as an automated reply, so autoresponders and bounce notifications won't trigger endless forwarding loops between mailboxes.
• Mark as read - Automatically marks the messages as read, which means it will not show up in your inbox, or any other folder, as unread.
• Set Priority - Automatically elevates the priority of a message. For example, if you create a content filter that flags a message from a VIP, you may want to set the priority of the message to High as well to denote its importance.
• Flag message - Automatically flags the message for follow-up. This makes it easy to find messages that have been acted upon by your content filter.

Manually Running Filters

Users can manually trigger one or more of their content filters to run against a specified email folder. The ability to run content filters on-demand is a convenient way to clean up the mailbox, as actions can be performed on EXISTING emails rather than incoming email only.

It's possible to run a content filter on a specific folder simply by selecting the folder name and the selecting Run Content Filter from the Actions menu icon that appears at the bottom of the SmarterMail interface. (It's to the right of the folders icon.) Once selected, a modal opens and you are able to select the content filter to run from the dropdown, then clicking OK. The filtering process may take some time to complete, but you may continue to work while the process runs in the background. When the filtering process has completed, an Action Succeeded toast notification will appear within the Email section.