Skip to content

Data loss prevention (DLP)

Block outgoing mail, quarantine it or notify an administrator based on rules such as Turkish ID numbers, IBANs, credit card numbers, classification markings or external recipients.

Global administrator, security officerAdmin console › Tools and Migration › Data Loss Prevention

The DLP decision is made in the mail delivery path by a separate milter process attached to Postfix. Real blocking requires the Postfix connection to have been selected during installation; see DLP milter connection. There is one policy for the whole server.

Turning a filter on and choosing its action

  1. Click Tools and Migration › Data Loss Prevention. The Content filters table appears.
  2. Tick On (1) in the filter's row (for example IBAN account number).
  3. Pick the action in Action on match (2), for example Block message. The page shows "Unsaved changes - press Save to apply."
  4. Save (3). The policy is validated on the server and is not saved if it contains errors.
  5. Test: send a message that contains a valid IBAN. The sender gets a 554 5.7.1 DLP rejection; the event appears under Recent incidents with the value masked.

Data Loss Prevention: content filters

Data Loss Prevention: content filters

Filters: Turkish national ID (TCKN), IBAN account number, Credit/debit card number, Classification marking, Attachment type/size policy, External recipient, Restricted sender group.

The Advanced: raw policy file box shows the policy text the table edits; detailed settings (for example failOpen) can be edited there directly.

Actions

Action Result
Block message The message is rejected and the sender gets an error.
Quarantine The message is not delivered; it is held in quarantine and an administrator is notified.
Notify admin The message is delivered and an administrator is notified.
Allow (log only) The message passes and the event is logged.
Force encryption, Add label, Append disclaimer Not applied in this release: the message passes unchanged and the event is logged as FAILED. For a footer, use the Domain disclaimer.

Incidents, quarantine and report

The lower part of the page has three sections:

  1. Recent incidents (masked evidence only): matching messages, with values masked; update with Refresh (1).
  2. Quarantine: filter by From and To / Cc / Bcc and click Search (2). Send selected (3) delivers the selected messages and removes them from quarantine; Delete selected (4) destroys them without delivery. Send all and Delete all apply to the whole quarantine.
  3. Download report: lists an event summary (date, from, action, filter); download it with Download report (5).

Recent incidents, quarantine and report

Recent incidents, quarantine and report

Messages that cannot be scanned (fail-open)

If scanning times out or the message cannot be written to quarantine, it may pass depending on the failOpen setting in your policy. Such cases appear under Recent incidents as failOpenTriggered=true rows with the reason (timeout, write error); monitor them regularly.

False positives

Start with narrow rules, watch the incidents, then widen them.

Scope

Attachment contents are not scanned locally; that requires an ICAP integration.