Set up content filters

Your message security service includes Content Manager, which you can use to create custom content filters for email. These filters can block or quarantine messages with specific words or phrases or even unique patterns of letters or numbers. You can set up content filters for both inbound and outbound email. Filters always apply to all users in a user organization. Here are some examples:

  • Block inbound messages with specific content, such as profanity.
  • Quarantine outbound messages that contain company-proprietary content.
  • Quarantine outbound messages that contain credit card numbers or Social Security numbers, using pre-defined filters we've set up for you.
  • Review or monitor inbound or outbound messages that contain specific content, but let users send or receive them.

About quarantined messages

You can set up a content filter to quarantine messages that match that filter. Quarantined messages appear in the Junk quarantine in the Message Center. For example, assume you created an inbound content filter that sends matching messages to the recipient's quarantine. The recipient user can find these messages in his or her Junk quarantine, with the label "Content" in the Block Reason column. Note that you can also set up a filter to send messages to the administrator's Junk quarantine instead of the user's.

Support for regular expressions

Content Manager includes support for regular expressions, a powerful tool for matching text patterns rather than specific words or phrases. For example, a regular expression can describe the pattern of a telephone number, an email address, a URL, or your company's employee identification numbers. It can also describe parts of words or entire word lists. For details about using regular expressions in your content filters, including helpful examples, see the Administration Guide.

Filter order and priority

Content Manager applies content filters in the order you specify, and takes action on a message according to the first filter that it matches. Filter order is an important consideration, because it helps you control what happens to a message that matches multiple filters. For example, assume you created an outbound filter to quarantine any messages containing employee IDs, and another filter that allows delivery of any messages containing customer invoice numbers. To ensure that messages with employee IDs are never sent outside your company, you would place the employee ID filter above the invoice number filter.

How to...

Enable Content Manager
  1. Access your Message Security for Google Apps Administration Console and go to Orgs and Users > Orgs, and then select your users organization. For example:
  2. On the Organization Management page, under Inbound Services or Outbound Services, click Content Manager:
  3. On the Inbound or Outbound Content Manager page, click Edit Settings.
  4. Set Content Filtering to On.
  5. In the Quarantine Administrator field, enter the address of the administrator who should receive messages captured by content filters. (Content Manager sends these messages to the administrator’s quarantine in the Message Center.)
  6. Select Approved Senders (so messages from the org’s Approved Senders don’t get blocked by content filters).
  7. Leave the default text in the Bounce Message field, unless you want to change the message the senders receive if a filter returns their messages.
  8. Leave the checkbox Apply settings to existing sub-orgs cleared.
  9. Click Save.

Want more information? See the Administration Guide for details.



Create a content filter
  1. Access the Inbound or Outbound Content Manager page for your user organization, as described in "Enable Content Manager."
  2. Click Add Custom Filter.
  3. In the Filter Name field, enter descriptive name for the filter, up to 15 characters long.
  4. Set Filter Status to On.
  5. Under Rules, in the Match drop-down list, choose whether Content Manager executes this filter’s disposition if an email message contains a match for any rule or all rules you specify.
  6. Specify up to three rules for this filter. For each rule, enter the following:
    • Location: The part of the message to scan. Note that Entire Message also scans content in file attachments.
    • Filter Type: The scanning method to use. Note that matches Regex and does not match regex require a value in regular expression syntax. For details, see the Administration Guide.
    • The value (a text string or regular expression) to match.
  7. Under Routing, select an action to take on messages that match the filter:
    • Deliver: Skips all remaining Content Manager filters. For Inbound Content Manager, you can also choose Bypass Junk Filters, to ensure it's delivered, regardless of junk-like content.
    • Bounce: Rejects the message and returns an error message to the sender.
    • Delete (blackhole): Discards the message, with no notification to the sender or recipient.
  8. Under Copy to Quarantine, optionally click Add quarantine address to send a copy of the message to a quarantine. Then select a quarantine:
    • Quarantine Administrator: Sends the message to the Message Center quarantine of the administrator you specified when enabling Content Manager.
    • Recipient: Places the message in the recipient's quarantine in the Message Center. Inbound Content Manager only.
    • Sender: Places the message in the sender's quarantine in the Message Center. Outbound Content Manager only.
    • Other User: Places the message in the quarantine of the user you specify. In the box, you can enter the email address of any user account that resides in a user organization for which you have Content Manager administrator authorization.
  9. Click Save.

Want more information? See the Administration Guide for details.



Reorder filter list
  1. Access the Inbound or Outbound Content Manager page for your user organization, as described in "Enable Content Manager."
  2. In the list of filters, do either of the following:
    • In the boxes on the left, type new numbers to indicate their new positions in the list. For example:
    • To check the new filter order, click Update Priority. (You must still save the new filter order.)

    • Use the Up and Down arrows on the right to move filters to their new positions in the list:
  3. Click Save Priority List.

Content Manager ignores filters with the Status OFF, regardless of their position in the priority list.

Want more information? See the Administration Guide for details.



Monitor messages with specific content, but don't block them

You or another user can receive copies of messages with specific content, but still allow the messages to be sent or received. Users are not notified that a copy was sent to you or another user. Use this type of filter, for example, to monitor messages for policy violations without blocking them. Simply create a new inbound or outbound content filter with the following settings:

  • Routing: Deliver
  • Copy to Quarantine: Click Add quarantine address, and select Quarantine Administrator or Other User (if you want another user to monitor the messages in his or her quarantine in the Message Center).

Want more information? See the Administration Guide for details.



Use content filters in a spam outbreak

Your Message Security for Google Apps service continuously updates its spam filters with signatures for new types of spam. However, during a large-scale spam outbreak, there may be a short time period during which new spam can pass through the filters before they are updated. For most of these types of outbreaks, you don't need to take any action. But if your users are repeatedly receiving a specific type of spam message, you can create temporary content filters to block them. Learn more