Sender address excluded from Email Impersonation Control still triggered the service

Products

• Email Security.cloud

Issue/Introduction

A Sender is not exempted from Email Impersonation Control scan despite adding the sender address to the Approved Sender list in Email Impersonation Control configuration.

Cause

The Email Impersonation Control service looks at the Envelope "Mail From" address at the time of scan and not the "Body From" address.

The "Body From" address is the sender address visible to the end user while opening a message in an email client. The actual sender or the "Mail From" address is not always same as the  "Body From" address.

Resolution

• Find the sender's email on Track and Trace using Subject or recipient address. The sender address seen on Track and Trace result must be added to the Email Impersonation control whitelist to exclude this sender from Impersonation control scan.
• Alternatively, you can look at the X-Env-Sender field in the message header to find the true sender of the email.

Click here for more information about Email Impersonation control Configuration.

Note: Any changes made to the Email impersonation control configuration takes an hour for propagation.