Feature Request - Whitelist Only, Quarantine All Others

Question

Hi Sophos community and team, 
 In speaking with a representative, I was directed to ask for this feature here, as it doesn't seem possible with the current setup. 
 We have a customer who would like any email hitting their domain to be automatically quarantined if not contained in the Allow list. 
 We could not find a way to make such a custom rule within the portal. 
 We understand that emails can be submitted and the system can be trained, but this customer does not want to wait for this or have to manually report sales emails to us or Sophos. 
 Please reply with any thoughts. Hoping this can be implemented before the Customer asks us to remove them from Sophos, which they have already hinted at.

Tom Foucha · Accepted Answer

I generally do a regex rule of *. before the Allowlist rule. You could do either Size over 1KB or regex, either would accomplish the same results. Be advised though this only puts message in the Admin Quarantine at this time. End User Quarantine options are coming later in the year.

Feature Request - Whitelist Only, Quarantine All Others

Top Replies