Policies - External Recipient Limiting Configuration

This guide describes how an External Recipient Limiting policy can be used to protect you from email-borne threats, both malicious and unintentional. This allows you to set recipient limits on the number of addresses included in the To: and Cc: fields of messages leaving your organization.

Blind carbon copy (BCC) recipients are not checked, as they work differently and cannot be counted.

Usage Considerations

Consider the following when configuring an External Recipient Limiting policy:

• Limit Count: This policy only checks for external recipients on outbound messages. If a domain is not registered as internal on your account, it will be classed as external.
• Specificity and precedence:
  • In terms of specificity, read the Policy Specificity page. 
  • In terms of actions, if two policies have the same specificity, the Hold action takes precedence over the Reject and Allow actions.
• Rejections and Policy Processing: Messages are processed in the envelope first, and then the header. If a policy violation is found at the envelope stage, action is taken prior to reading the header information. This is the only case where a Reject action may apply over an Allow action.

Configuring an External Recipient Limiting Definition

To configure an External Recipient Limiting definition:

1. Log in to the Mimecast Administration Console.
2. Navigate to Policies | Gateway Policies.
3. Click on the Definitions button.
4. Select External Recipient Limiting from the drop-down menu to display your definitions.
5. Either click the:

• • New External Recipient Limiting button to create a definition.
  • Definition to be changed.

6. Complete the section as per below:

Field / Option	Description
Description	Specify a description for the definition. This is kept in the archive for messages that have this definition applied.
Recipient Limit	Specify the maximum number of recipients allowed for a single message.
Action	Specify one of the following actions: Hold for Review: The message is held for review by an administrator. Reject: A rejection error is issued to the sending server. Allow: The message passes through to the next stage in policy processing. Use this option to monitor recipient limits by specifying a group in the Notify Group options.
Notify Group	If required, select a group of users who'll be notified when the policy is triggered.
Notify Internal Sender	If selected, the internal sender of the message is notified when the policy is triggered.

7. Click on the Save and Exit button.

Configuring an External Recipient Limiting Policy

To configure an External Recipient Limiting Policy:

1. Log in to the Mimecast Administration Console.
2. Navigate to Policies | Gateway Policies.
3. Click on External Recipient Limiting. A list of existing policies is displayed.
4. Either click on the:

• • New Policy button to create a policy.
  • Policy to be amended.

5. Complete the Options section as follows:

Field / Option	Description
Policy Narrative	Enter a description for the policy. This is kept with the message in the archive.
Select Option	Select an External Recipient Limiting definition from the dropdown list.

6. Complete the Emails From section as follows:

Field / Option	Description
Addresses Based On	Specify the email address characteristics the policy is based on.
Applies From	Specify the sender characteristics the policy is based on. For multiple policies, you should apply them from the most to least specific.
Specifically	Enables you to specify an SMTP address if "Individual Email Addresses" is specified in the Applies From field.

7. Complete the Emails To section as follows:

Field / Option	Description
Applies To	Specify the recipient characteristics the policy is based on. For multiple policies, you should apply them from the most to the least specific. If there are multiple applicable policies, or if only some recipients are covered by a limiting policy, the most restrictive evaluation is applied. For example, if there are 11 recipients and only one of them is covered by a limiting policy of 10, the policy is still triggered.
Specifically	Enables a specific SMTP address if "Individual Email Addresses" is specified in the Applies To field.

8. Complete the Validity section as required:

Field / Option	Description
Enable / Disable	Use this option to enable or disable a policy. Disabling the policy allows you to prevent it from being applied without having to delete or backdate it. Should the policy's configured date range be reached, it's automatically disabled.
Set Policy as Perpetual	Specifies that the policy's start and end dates are set to Eternal, meaning the policy never expires.
Date Range	Specify a start and end date for the policy. This automatically deselects the Eternal option.
Policy Override	Select this option to override the default order that policies are applied. If there are multiple applicable policies, this policy is applied first unless more specific policies of the same type have also been configured with an override.
Source IP Ranges (n.n.n.n/x)	Enter any required Source IP Ranges for the policy. These only apply if the source IP address used to transmit the message data falls inside or matches the range(s) configured. IP ranges should be entered in CIDR notation.

9. Click on the Save and Exit button.

See Also...

• • • Policy Specificity