Policies - Configuring Reputation Definitions and Policies

This article contains information on configuring reputation definitions and policies in Mimecast, including options for managing block lists, reputation checks, and sender characteristics to control email delivery and security. See Rejected and Deferred Messages.

Configuring a Reputation Definition

To configure a reputation definition:

1. Log in to the Mimecast Administration Console.
2. Navigate to Policies | Gateway Policies.
3. Click on the Definitions button.
4. Click on the Reputation Definition menu item.
5. Either click on the: 

• • Add a Reputation Definition button to create a definition.
  • Definition to be changed.

6. Complete the Reputation Properties section as follows:

Field / Option	Description
Description	Specify a name for the definition to enable you to identify its purpose.
Mimecast Global Permitted List	If selected, the connecting IP address of all inbound emails is checked against a permit list maintained by our Security Team. This list comprises domains known to be of good reputation. If the connecting IP address is on the permit list, it bypasses spam checking.
Global Block Lists	If selected, all inbound email is checked for spam against six IP address-based block lists. This option is used in conjunction with the "Number of Block List Hits" option.
Number of Block List Hits	Specify a value to set the number of hits required before the sending IP address of a message is rejected.

7. Click on the Save and Exit button.

Configuring a Reputation Policy

To configure a reputation policy:

1. Log in to the Mimecast Administration Console.
2. Navigate to Policies | Gateway Policies.
3. Click on Reputation Policy.
4. Either click on the: 

• • Policy to be changed.
  • New Policy button to create a policy.

5. Complete the Options section as required:

Field / Option	Description
Policy Narrative	Provide a description of the policy to allow you to easily identify it in the future.
Select Notification Set	Select the required reputation definition for the policy.

6. Complete the Emails From and Emails To sections as required

Field / Option	Description
Addresses Based On	Specify the email address characteristics on which the policy is based. This option is only available in the "Emails From" section: The Return Address: This default setting applies the policy to the SMTP address match, based on the message's envelope or true address (i.e., the address used during SMTP transmission).
Applies From / To	Specify the sender characteristics on which the policy is based. For multiple policies, you should apply them from the most specific to the least specific. The options are: Everyone: Includes all email users (i.e., internal and external). This option is only available in the "Emails From" section. Internal Address: Includes only internal organization addresses. External Address: Includes only external organization addresses. This option is only available in the "Emails From" section. Email Domain: Enables you to specify a domain name to which this policy is applied. The domain name is entered in the Specifically field. Address Groups: This enables you to specify a directory or local group. If this option is selected, click on the Lookup button to select a group from the Profile Group field. Once a group has been selected, you can click on the Show Location field to display the group's path. Address Attributes: This enables you to specify a predefined Attribute. The attribute is selected from the Where Attribute drop-down list. Once the Attribute is specified, an attribute value must be entered in the Is Equal To field. This can only be used if attributes have been configured for user accounts. Individual Email Address: Enables you to specify an SMTP address. The email address is entered in the Specifically field.

7. Complete the Validity section as required:

Field / Option	Description
Enable / Disable	Use this to enable (default) or disable a policy. Disabling the policy allows you to prevent it from being applied without having to delete or backdate it. Should the policy's configured date range be reached, it is automatically disabled.
Set Policy as Perpetual	Specifies that the policy's start and end dates are set to "Eternal", meaning the policy never expires.
Date Range	Specify a start and end date for the policy. This automatically deselects the "Eternal" option.
Policy Override	Select this to override the default order in which policies are applied. If there are multiple applicable policies, this policy is applied first unless more specific policies of the same type have also been configured with an override.
Bi-Directional	If selected, the policy also applies when the policy's recipient is the sender and the sender is the recipient.
Source IP Ranges (n.n.n.n/x)	Enter any required Source IP Ranges for the policy. These only apply if the source IP address used to transmit the message data falls inside or matches the range(s) configured. IP ranges should be entered in CIDR notation.

8. Click on the Save and Exit button.

Usage Examples

By default, all block lists and reputation checks are applied to inbound mail. However, by configuring a reputation definition, you can adjust or exclude some of these checks or decrease their sensitivity. For example, you can:

• Deactivate one of the default block lists to ensure that certain messages are allowed through.
• Apply stronger hit rates before a message is rejected based on reputation.

If a message has been specifically permitted via an Auto Allow Policy or Permitted Senders Policy this overrides any reputation definition.

Example 1 - IP Address on Two or More Block Lists

In this example, messages are rejected when the IP address is found on a minimum of two block lists, and the policy applies to emails from "Everyone to Internal"

Example 2 - Newsletter.com on all Block Lists

In this example, we deactivate the Mimecast Global Permitted List for newsletter.com, with a requirement that the sending server of the mail for newsletter.com is found on all block lists. In this example, the policy is set to apply to messages from newsletter.com to "Internal".