Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=email-exception-add-POP-IMAP-scan-policy

Add a POP-IMAP scan policy

With POP-IMAP scan policies, you can specify filter criteria for senders' and recipients' emails. You can warn recipients based on a criteria match in emails.

To add a POP-IMAP scan policy, do as follows:

  1. Go to Email > Policies and exceptions.
  2. Click Add a policy, and then click POP-IMAP scan.
  3. Enter a name.

  4. Specify the senders' and recipients' email address groups or domain groups.

    Specify an exact match or keyword match.

  5. Specify the filter criteria based on which policy applies the specified action.

    Option Description
    Inbound email is Criteria for spam, probable spam, virus outbreak, or probable virus outbreak.
    Source IP/network address Sender's IP address or network address.
    Message size Upper or lower limit of email size for scanning.
    Message header Header criteria.
    For Other, enter the details.
    Specify an exact match or keyword match.
    Specify the keyword.
    None Sophos Firewall applies the action that you specify to all emails sent between the specified senders and recipients.

  6. Select the action.

    Option Description
    Accept Delivers the email.
    Prefix subject Adds a prefix to the subject and delivers the email.
    Note: You can specify a prefix that indicates the filter criteria. For example, if you specify the prefix Probable spam to the subject Test email, recipients receive an email with the subject Probable spam: Test email.

  7. Click Save.

Update the automatically created firewall rule for MTA with the POP-IMAP scan settings under Scan email content. Alternatively, create a new firewall rule.

  1. Go to Email > Policies, click Add a policy, and click POP-IMAP scan.
  2. Enter a name.
  3. Specify the senders' and recipients' email address groups or domain groups. Specify an exact match or keyword match.

  4. Specify the filter criteria based on which policy applies the specified action.

    Option Description
    Inbound email is Criteria for spam, probable spam, virus outbreak, or probable virus outbreak.
    Source IP/network address Sender's IP address or network address.
    Message size Upper or lower limit of email size for scanning.
    Message header Header criteria.
    For Other, enter the details.
    Specify an exact match or keyword match.
    Specify the keyword.
    None Sophos Firewall applies the action that you specify to all emails sent between the specified senders and recipients.

  5. Select the action.

    Option Description
    Accept Delivers the email.
    Prefix subject Adds a prefix to the subject and delivers the email.
    Note: You can specify a prefix that indicates the filter criteria. For example, if you specify the prefix Probable spam to the subject Test email, recipients receive an email with the subject Probable spam: Test email.

  6. Click Save.

Add a firewall rule and select the settings under Scan email content.

More resources