Here's one for you. How do you block a sender that keeps changing the email address they use? For example, I want to block "Tom Night". I don't care what email address "Tom Night" uses, I want his emails gone. Poof.
- -open ecp
- -mail-flow > rules
- -click CREATE NEW RULE
- -click MORE OPTIONS (at the bottom)
- -click APPLY THIS RULE IF... > A MESSAGE HEADER > INCLUDES ANY OF THESE WORDS
- -click ENTER TEXT (for header)
- -type FROM
- -click OK
- -click ENTER WORDS
- -type "Tom Night"
- -click the + (plus symbol)
- -click OK
- -click DO THE FOLLOWING > BLOCK THE MESSAGE > DELETE THE MESSAGE WITHOUT NOTIFYING ANYONE
- -click SAVE
That should do it. What's happening here is that we are blocking the NAME in the HEADER rather than using the FROM-parameter as the FROM-parameter uses email-addresses (externally) and mailboxes (internally).
Something like:
Set-TransportRule "Block Tom Night" -HeaderContainsMessageHeader "From" -HeaderContainsWords "FirstName LastName" -Actions {DeleteMessage} -DeleteMessage True
If you want to see all the TRANSPORTRULE options, type:
Get-TransportRulePredicate