Quarantine or blocking email based on sender

Not sure why this is not working.  Please open a support case, because it might be a "feature" added in a recent release, and if so we will all want the problem found and fixed.

In the interim, I guess you will have to block based on IP using DNAT rules.   These are the mailchimp IPs that I have seen recently

148.105.12.0/24
198.2.129.0/24
198.2.130.0/24
198.2.138.0/24
198.2.142.0/24
198.2.183.0/24
198.2.184.0/24
198.2.185.0/24
198.2.190.0/24
205.201.129.0/24
205.201.130.0/24
205.201.134.0/24

Are you referring to my blacklist filter not working?

I am not sure the DNAT will help. Mail comes though a filtering service before getting to the UTM. Any connection directly from a Mailchimp server currently would get rejected by default.

Unless it goes looking through the email header in some way.

Are you referring to my blacklist filter not working?

I am not sure the DNAT will help. Mail comes though a filtering service before getting to the UTM. Any connection directly from a Mailchimp server currently would get rejected by default.

Unless it goes looking through the email header in some way.

I'm certain that there's a suggestion in Ideas for *@*domain.com, but that's not supported at present.  All MailChimp emails include an unsubscribe link, so my tendency is to say that you should let folks take care of any problem themselves.  MailChimp has a strict policy against spam, so if you feel like a particular MailChimp customer is spamming, you might want to bring that to their attention.

Cheers - Bob

Your previous reply left me confused.   

Yes, I was suggesting blocking on IP instead of blocking on sender address.   Yes, that approach will not work because you have a mail filtering service in front of UTM.   However, the mail service should be able to implement a block on IP, Host name / Reverse DNS, or sender name.   Why are you worried about a UTM block if you have a more sophisticated product in front of it?   Or are you just using the UTM block rule for experimentation?   

I do not have control over the filter before the UTM. As I was having problems getting it to block on the blacklist to work, I though I would ask to see if there was something I am missing.

It is not supported because of me using the * twice? 

The emails contain links to attachments that are malicious. As I have got multiple emails from a range of random companies now all coming from Mailchimp. These have been report to Mailchimp but are still getting sent out. 

So I was hoping to reject them all for the next few weeks until they have hopefully fixed the problem.

On UTM, Bob Alfson knows his stuff.   I found this disclaimer when I carefully read the help page for Blacklisted senders:

       "A wildcard does not work in the domain or TLD part of an address."

This is pretty devastating, since you cannot block on host name at all (whether from Reverse DNS or HELO/EHLO), and since it is now clear that you can only block senders based on domain name exact match.  Blocking based on IP address requires DNAT-to-DeadEnd, which is pretty obscure even if you know the IP addresses.   Determining IP addresses is tricky, but their SPF record might help, if an SPF entry exists.

On MailChimp, I am with you.   I blocked them unconditionally at some point in the past, using an email filter that is in front of my UTM.  So far have had no reason to roll back that block.   I use UTM behind the other device and it catches some spam that slips through the other one.   All of my static rules are enforced before UTM, so I have not had to fight your issue.

That is fine then as I can't filter on IP. I will look at getting a list of email domains that are sending from logs and block those.

I will add each one in to blacklist after that with *@domain.com

Thanks for pointing that out.

Here is a list of the 548 MCDLV.NET sender domains that I have seen in a recent 90-day period.   The size of the list is discouraging, given your constraints.

mail1.suw91.mcdlv.net
mail103.atl71.mcdlv.net
mail104.atl71.mcdlv.net
mail11.suw111.mcdlv.net
mail110.suw111.mcdlv.net
mail114.atl261.mcdlv.net
mail116.atl31.mcdlv.net
mail117.atl31.mcdlv.net
mail120.wdc01.mcdlv.net
mail125.wdc01.mcdlv.net
mail130.suw121.mcdlv.net
mail135.wdc02.mcdlv.net
mail138.sea22.mcdlv.net
mail138.suw121.mcdlv.net
mail141.sea22.mcdlv.net
mail142.wdc02.mcdlv.net
mail143.suw121.mcdlv.net
mail146.suw121.mcdlv.net
mail152.atl101.mcdlv.net
mail153.atl101.mcdlv.net
mail154.atl171.mcdlv.net
mail155.suw121.mcdlv.net
mail158.suw14.mcdlv.net
mail159.suw121.mcdlv.net
mail160.atl171.mcdlv.net
mail161.suw14.mcdlv.net
mail163.suw101.mcdlv.net
mail168.suw121.mcdlv.net
mail169.suw101.mcdlv.net
mail170.atl101.mcdlv.net
mail172.suw101.mcdlv.net
mail174.sea22.mcdlv.net
mail176.wdc02.mcdlv.net
mail178.atl271.mcdlv.net
mail180.sea22.mcdlv.net
mail181.atl171.mcdlv.net
mail188.suw14.mcdlv.net
mail19.atl31.mcdlv.net
mail190.suw14.mcdlv.net
mail190.wdc02.mcdlv.net
mail192.atl171.mcdlv.net
mail195.atl171.mcdlv.net
mail198.suw121.mcdlv.net
mail20.wdc01.mcdlv.net
mail200.suw14.mcdlv.net
mail208.suw14.mcdlv.net
mail208.wdc02.mcdlv.net
mail212.atl171.mcdlv.net
mail213.atl101.mcdlv.net
mail213.suw14.mcdlv.net
mail214.atl171.mcdlv.net
mail218.suw14.mcdlv.net
mail223.suw101.mcdlv.net
mail224.suw121.mcdlv.net
mail227.wdc02.mcdlv.net
mail23.wdc01.mcdlv.net
mail230.atl101.mcdlv.net
mail247.atl271.mcdlv.net
mail249.suw121.mcdlv.net
mail252.suw14.mcdlv.net
mail253.suw14.mcdlv.net
mail26.suw111.mcdlv.net
mail27.atl71.mcdlv.net
mail28.suw111.mcdlv.net
mail29.atl31.mcdlv.net
mail3.suw91.mcdlv.net
mail39.atl31.mcdlv.net
mail39.wdc01.mcdlv.net
mail47.atl31.mcdlv.net
mail49.suw91.mcdlv.net
mail53.atl71.mcdlv.net
mail56.atl71.mcdlv.net
mail60.suw11.mcdlv.net
mail63.wdc01.mcdlv.net
mail66.suw91.mcdlv.net
mail67.wdc01.mcdlv.net
mail68.atl261.mcdlv.net
mail69.suw11.mcdlv.net
mail69.suw111.mcdlv.net
mail69.suw91.mcdlv.net
mail72.atl71.mcdlv.net
mail73.atl71.mcdlv.net
mail74.suw91.mcdlv.net
mail76.atl71.mcdlv.net
mail76.wdc01.mcdlv.net
mail8.suw111.mcdlv.net
mail82.suw111.mcdlv.net
mail85.suw11.mcdlv.net
mail89.atl261.mcdlv.net
mail92.suw111.mcdlv.net
mail92.suw91.mcdlv.net
mail95.suw111.mcdlv.net
mail101.atl71.mcdlv.net
mail107.atl31.mcdlv.net
mail115.wdc01.mcdlv.net
mail118.wdc01.mcdlv.net
mail125.atl261.mcdlv.net
mail138.suw101.mcdlv.net
mail139.suw14.mcdlv.net
mail140.atl271.mcdlv.net
mail144.suw121.mcdlv.net
mail145.suw101.mcdlv.net
mail147.suw101.mcdlv.net
mail151.sea22.mcdlv.net
mail151.suw121.mcdlv.net
mail154.sea22.mcdlv.net
mail154.suw14.mcdlv.net
mail155.sea22.mcdlv.net
mail158.wdc02.mcdlv.net
mail16.atl71.mcdlv.net
mail161.atl171.mcdlv.net
mail162.atl101.mcdlv.net
mail162.sea22.mcdlv.net
mail163.suw14.mcdlv.net
mail170.suw101.mcdlv.net
mail171.atl171.mcdlv.net
mail172.suw14.mcdlv.net
mail173.atl271.mcdlv.net
mail173.suw14.mcdlv.net
mail174.suw101.mcdlv.net
mail175.atl101.mcdlv.net
mail175.sea22.mcdlv.net
mail175.wdc02.mcdlv.net
mail176.suw14.mcdlv.net
mail177.atl101.mcdlv.net
mail177.sea22.mcdlv.net
mail178.atl101.mcdlv.net
mail180.atl171.mcdlv.net
mail182.atl171.mcdlv.net
mail183.suw121.mcdlv.net
mail185.atl101.mcdlv.net
mail187.suw101.mcdlv.net
mail187.suw14.mcdlv.net
mail196.wdc02.mcdlv.net
mail197.atl101.mcdlv.net
mail197.suw121.mcdlv.net
mail199.sea22.mcdlv.net
mail199.suw101.mcdlv.net
mail200.suw101.mcdlv.net
mail201.atl171.mcdlv.net
mail201.wdc02.mcdlv.net
mail202.suw121.mcdlv.net
mail205.atl171.mcdlv.net
mail206.suw14.mcdlv.net
mail207.atl171.mcdlv.net
mail209.wdc02.mcdlv.net
mail219.suw121.mcdlv.net
mail220.wdc02.mcdlv.net
mail224.suw101.mcdlv.net
mail226.suw121.mcdlv.net
mail234.atl171.mcdlv.net
mail235.suw121.mcdlv.net
mail236.suw121.mcdlv.net
mail238.wdc02.mcdlv.net
mail239.suw14.mcdlv.net
mail24.wdc01.mcdlv.net
mail240.atl171.mcdlv.net
mail242.atl271.mcdlv.net
mail244.atl171.mcdlv.net
mail245.atl171.mcdlv.net
mail246.atl171.mcdlv.net
mail246.suw121.mcdlv.net
mail246.wdc02.mcdlv.net
mail248.atl171.mcdlv.net
mail252.atl171.mcdlv.net
mail26.atl261.mcdlv.net
mail31.suw91.mcdlv.net
mail32.atl71.mcdlv.net
mail40.atl71.mcdlv.net
mail44.wdc01.mcdlv.net
mail5.atl31.mcdlv.net
mail51.wdc01.mcdlv.net
mail54.atl31.mcdlv.net
mail55.atl31.mcdlv.net
mail56.suw111.mcdlv.net
mail58.suw111.mcdlv.net
mail58.wdc01.mcdlv.net
mail62.atl71.mcdlv.net
mail64.atl71.mcdlv.net
mail65.wdc01.mcdlv.net
mail68.wdc01.mcdlv.net
mail75.atl71.mcdlv.net
mail78.atl71.mcdlv.net
mail79.wdc01.mcdlv.net
mail86.atl261.mcdlv.net
mail89.wdc01.mcdlv.net
mail98.atl71.mcdlv.net
mail98.wdc01.mcdlv.net
mail99.suw111.mcdlv.net
mail100.atl71.mcdlv.net
mail100.suw91.mcdlv.net
mail108.wdc01.mcdlv.net
mail113.wdc01.mcdlv.net
mail123.suw111.mcdlv.net
mail123.wdc01.mcdlv.net
mail125.suw111.mcdlv.net
mail126.wdc01.mcdlv.net
mail131.suw101.mcdlv.net
mail132.suw121.mcdlv.net
mail136.atl101.mcdlv.net
mail138.suw14.mcdlv.net
mail140.suw101.mcdlv.net
mail143.atl101.mcdlv.net
mail147.suw14.mcdlv.net
mail150.sea22.mcdlv.net
mail152.atl171.mcdlv.net
mail154.suw101.mcdlv.net
mail157.suw14.mcdlv.net
mail158.suw121.mcdlv.net
mail159.suw101.mcdlv.net
mail160.suw121.mcdlv.net
mail166.atl171.mcdlv.net
mail168.wdc02.mcdlv.net
mail170.sea22.mcdlv.net
mail174.atl171.mcdlv.net
mail176.atl171.mcdlv.net
mail177.suw121.mcdlv.net
mail177.suw14.mcdlv.net
mail177.wdc02.mcdlv.net
mail180.atl101.mcdlv.net
mail184.suw121.mcdlv.net
mail184.wdc02.mcdlv.net
mail189.suw14.mcdlv.net
mail191.suw121.mcdlv.net
mail191.suw14.mcdlv.net
mail197.atl171.mcdlv.net
mail200.atl171.mcdlv.net
mail206.atl271.mcdlv.net
mail207.suw14.mcdlv.net
mail211.atl171.mcdlv.net
mail213.suw121.mcdlv.net
mail216.atl101.mcdlv.net
mail216.atl171.mcdlv.net
mail220.suw101.mcdlv.net
mail224.suw14.mcdlv.net
mail225.suw121.mcdlv.net
mail225.wdc02.mcdlv.net
mail227.suw14.mcdlv.net
mail228.suw121.mcdlv.net
mail230.suw14.mcdlv.net
mail237.suw14.mcdlv.net
mail242.suw101.mcdlv.net
mail247.suw14.mcdlv.net
mail247.wdc02.mcdlv.net
mail251.suw14.mcdlv.net
mail252.suw121.mcdlv.net
mail27.suw111.mcdlv.net
mail27.suw91.mcdlv.net
mail35.atl261.mcdlv.net
mail36.atl31.mcdlv.net
mail37.wdc01.mcdlv.net
mail41.atl71.mcdlv.net
mail48.suw111.mcdlv.net
mail56.atl31.mcdlv.net
mail57.atl71.mcdlv.net
mail59.suw91.mcdlv.net
mail62.suw111.mcdlv.net
mail64.suw91.mcdlv.net
mail81.atl71.mcdlv.net
mail81.suw111.mcdlv.net
mail83.atl71.mcdlv.net
mail84.suw111.mcdlv.net
mail85.atl31.mcdlv.net
mail9.atl31.mcdlv.net
mail90.atl31.mcdlv.net
mail93.atl31.mcdlv.net
mail93.suw91.mcdlv.net
mail99.atl71.mcdlv.net
mail108.suw111.mcdlv.net
mail129.atl171.mcdlv.net
mail130.suw101.mcdlv.net
mail134.atl101.mcdlv.net
mail134.sea22.mcdlv.net
mail135.suw101.mcdlv.net
mail136.atl271.mcdlv.net
mail138.atl271.mcdlv.net
mail139.wdc02.mcdlv.net
mail144.wdc02.mcdlv.net
mail148.suw14.mcdlv.net
mail149.atl101.mcdlv.net
mail151.suw101.mcdlv.net
mail151.suw14.mcdlv.net
mail152.sea22.mcdlv.net
mail157.suw101.mcdlv.net
mail158.sea22.mcdlv.net
mail164.suw14.mcdlv.net
mail165.sea22.mcdlv.net
mail165.suw101.mcdlv.net
mail167.atl101.mcdlv.net
mail167.sea22.mcdlv.net
mail167.suw14.mcdlv.net
mail17.atl71.mcdlv.net
mail170.atl171.mcdlv.net
mail171.suw101.mcdlv.net
mail172.wdc02.mcdlv.net
mail177.atl171.mcdlv.net
mail18.atl71.mcdlv.net
mail180.suw14.mcdlv.net
mail181.atl101.mcdlv.net
mail181.sea22.mcdlv.net
mail181.wdc02.mcdlv.net
mail182.wdc02.mcdlv.net
mail183.sea22.mcdlv.net
mail185.suw101.mcdlv.net
mail188.wdc02.mcdlv.net
mail192.suw101.mcdlv.net
mail194.suw101.mcdlv.net
mail195.suw121.mcdlv.net
mail195.suw14.mcdlv.net
mail196.suw121.mcdlv.net
mail20.suw91.mcdlv.net
mail200.wdc02.mcdlv.net
mail202.atl101.mcdlv.net
mail203.atl101.mcdlv.net
mail204.suw101.mcdlv.net
mail205.wdc02.mcdlv.net
mail206.wdc02.mcdlv.net
mail210.suw121.mcdlv.net
mail212.suw121.mcdlv.net
mail217.atl101.mcdlv.net
mail217.suw14.mcdlv.net
mail218.atl101.mcdlv.net
mail22.wdc01.mcdlv.net
mail229.atl171.mcdlv.net
mail23.suw111.mcdlv.net
mail230.wdc02.mcdlv.net
mail231.suw14.mcdlv.net
mail232.suw101.mcdlv.net
mail233.suw101.mcdlv.net
mail235.atl171.mcdlv.net
mail236.wdc02.mcdlv.net
mail238.atl101.mcdlv.net
mail238.atl171.mcdlv.net
mail240.suw14.mcdlv.net
mail249.atl171.mcdlv.net
mail249.suw101.mcdlv.net
mail25.suw91.mcdlv.net
mail254.atl101.mcdlv.net
mail33.suw111.mcdlv.net
mail37.atl261.mcdlv.net
mail37.atl31.mcdlv.net
mail38.suw111.mcdlv.net
mail45.atl31.mcdlv.net
mail45.atl71.mcdlv.net
mail46.suw91.mcdlv.net
mail49.atl31.mcdlv.net
mail5.wdc01.mcdlv.net
mail55.suw111.mcdlv.net
mail59.atl31.mcdlv.net
mail59.atl71.mcdlv.net
mail6.suw91.mcdlv.net
mail60.atl71.mcdlv.net
mail60.suw111.mcdlv.net
mail61.atl71.mcdlv.net
mail66.suw111.mcdlv.net
mail67.suw111.mcdlv.net
mail7.wdc01.mcdlv.net
mail70.suw91.mcdlv.net
mail72.atl31.mcdlv.net
mail73.suw111.mcdlv.net
mail74.suw111.mcdlv.net
mail75.atl31.mcdlv.net
mail76.atl31.mcdlv.net
mail80.wdc01.mcdlv.net
mail81.wdc01.mcdlv.net
mail86.suw91.mcdlv.net
mail89.suw111.mcdlv.net
mail94.suw91.mcdlv.net
mail95.wdc01.mcdlv.net
mail97.atl71.mcdlv.net
mail98.suw111.mcdlv.net
mail98.suw91.mcdlv.net
mail99.suw91.mcdlv.net
mail104.suw91.mcdlv.net
mail105.atl71.mcdlv.net
mail109.atl31.mcdlv.net
mail112.atl31.mcdlv.net
mail114.atl31.mcdlv.net
mail116.atl71.mcdlv.net
mail12.suw111.mcdlv.net
mail131.suw121.mcdlv.net
mail134.suw14.mcdlv.net
mail136.wdc02.mcdlv.net
mail141.suw101.mcdlv.net
mail15.wdc01.mcdlv.net
mail150.wdc02.mcdlv.net
mail151.atl101.mcdlv.net
mail153.sea22.mcdlv.net
mail156.atl171.mcdlv.net
mail156.suw121.mcdlv.net
mail157.sea22.mcdlv.net
mail157.wdc02.mcdlv.net
mail158.suw101.mcdlv.net
mail164.suw101.mcdlv.net
mail169.wdc02.mcdlv.net
mail17.wdc01.mcdlv.net
mail173.suw101.mcdlv.net
mail175.suw14.mcdlv.net
mail178.sea22.mcdlv.net
mail179.atl271.mcdlv.net
mail179.suw14.mcdlv.net
mail180.suw121.mcdlv.net
mail181.suw14.mcdlv.net
mail182.atl271.mcdlv.net
mail183.atl171.mcdlv.net
mail183.wdc02.mcdlv.net
mail185.wdc02.mcdlv.net
mail188.suw101.mcdlv.net
mail189.wdc02.mcdlv.net
mail190.suw101.mcdlv.net
mail193.atl171.mcdlv.net
mail198.suw101.mcdlv.net
mail2.wdc01.mcdlv.net
mail203.atl171.mcdlv.net
mail209.atl101.mcdlv.net
mail211.suw121.mcdlv.net
mail214.suw101.mcdlv.net
mail215.suw14.mcdlv.net
mail216.suw101.mcdlv.net
mail218.suw121.mcdlv.net
mail221.suw101.mcdlv.net
mail222.suw101.mcdlv.net
mail222.suw14.mcdlv.net
mail223.suw121.mcdlv.net
mail225.atl171.mcdlv.net
mail227.atl101.mcdlv.net
mail228.suw101.mcdlv.net
mail228.wdc02.mcdlv.net
mail229.suw14.mcdlv.net
mail233.atl171.mcdlv.net
mail236.atl101.mcdlv.net
mail248.suw121.mcdlv.net
mail250.atl171.mcdlv.net
mail251.atl101.mcdlv.net
mail253.suw121.mcdlv.net
mail3.atl71.mcdlv.net
mail3.wdc01.mcdlv.net
mail30.wdc01.mcdlv.net
mail32.atl31.mcdlv.net
mail41.suw111.mcdlv.net
mail41.suw91.mcdlv.net
mail43.atl31.mcdlv.net
mail51.suw111.mcdlv.net
mail65.suw91.mcdlv.net
mail68.suw111.mcdlv.net
mail70.atl31.mcdlv.net
mail73.atl31.mcdlv.net
mail74.atl71.mcdlv.net
mail77.suw111.mcdlv.net
mail78.atl261.mcdlv.net
mail78.suw111.mcdlv.net
mail80.suw111.mcdlv.net
mail86.atl31.mcdlv.net
mail87.atl31.mcdlv.net
mail87.suw91.mcdlv.net
mail91.wdc01.mcdlv.net
mail92.atl71.mcdlv.net
mail95.atl71.mcdlv.net
mail10.suw111.mcdlv.net
mail104.wdc01.mcdlv.net
mail105.atl31.mcdlv.net
mail107.suw91.mcdlv.net
mail109.suw91.mcdlv.net
mail112.atl261.mcdlv.net
mail12.atl31.mcdlv.net
mail12.wdc01.mcdlv.net
mail128.atl101.mcdlv.net
mail128.suw121.mcdlv.net
mail129.suw101.mcdlv.net
mail132.suw101.mcdlv.net
mail137.suw121.mcdlv.net
mail142.sea22.mcdlv.net
mail142.suw14.mcdlv.net
mail143.suw14.mcdlv.net
mail144.suw14.mcdlv.net
mail145.sea22.mcdlv.net
mail149.suw14.mcdlv.net
mail153.suw101.mcdlv.net
mail155.atl101.mcdlv.net
mail16.atl31.mcdlv.net
mail162.atl171.mcdlv.net
mail167.suw121.mcdlv.net
mail168.atl171.mcdlv.net
mail168.suw101.mcdlv.net
mail169.suw121.mcdlv.net
mail169.suw14.mcdlv.net
mail174.suw121.mcdlv.net
mail176.sea22.mcdlv.net
mail178.suw121.mcdlv.net
mail179.atl101.mcdlv.net
mail179.wdc02.mcdlv.net
mail180.suw101.mcdlv.net
mail181.suw121.mcdlv.net
mail184.atl101.mcdlv.net
mail185.sea22.mcdlv.net
mail185.suw121.mcdlv.net
mail188.atl101.mcdlv.net
mail189.atl101.mcdlv.net
mail189.atl171.mcdlv.net
mail189.sea22.mcdlv.net
mail190.atl101.mcdlv.net
mail194.suw14.mcdlv.net
mail195.atl101.mcdlv.net
mail197.suw14.mcdlv.net
mail199.atl101.mcdlv.net
mail201.suw101.mcdlv.net
mail203.wdc02.mcdlv.net
mail205.suw121.mcdlv.net
mail205.suw14.mcdlv.net
mail207.suw101.mcdlv.net
mail208.suw101.mcdlv.net
mail21.suw111.mcdlv.net
mail213.wdc02.mcdlv.net
mail215.atl101.mcdlv.net
mail216.suw121.mcdlv.net
mail217.wdc02.mcdlv.net
mail221.atl171.mcdlv.net
mail226.suw101.mcdlv.net
mail232.atl171.mcdlv.net
mail237.atl171.mcdlv.net
mail24.atl71.mcdlv.net
mail24.suw111.mcdlv.net
mail248.suw101.mcdlv.net
mail250.wdc02.mcdlv.net
mail28.atl31.mcdlv.net
mail32.suw111.mcdlv.net
mail33.wdc01.mcdlv.net
mail35.wdc01.mcdlv.net
mail37.atl71.mcdlv.net
mail40.atl31.mcdlv.net
mail46.atl31.mcdlv.net
mail50.wdc01.mcdlv.net
mail53.suw91.mcdlv.net
mail58.suw91.mcdlv.net
mail6.atl31.mcdlv.net
mail6.suw111.mcdlv.net
mail60.wdc01.mcdlv.net
mail69.atl261.mcdlv.net
mail71.atl31.mcdlv.net
mail72.wdc01.mcdlv.net
mail76.suw111.mcdlv.net
mail79.suw111.mcdlv.net
mail79.suw91.mcdlv.net
mail87.atl71.mcdlv.net
mail9.atl71.mcdlv.net
mail91.atl31.mcdlv.net
mail92.atl31.mcdlv.net
mail95.atl31.mcdlv.net