Quarantine or blocking email based on sender

Question

Hi 
 
 I would like to block emails coming from some Mailchimp servers or email addresses. 
 
 Tried putting in IP blocks under the relay tab for Mailchimp but that did not work. Mail comes through a relay first so I think this causes some issues when trying to do that. 
 
 While looking at all the spam coming in from these servers in mail manager I noticed all sending emails end in mcdlv.net 
 
 I put *@*mcdlv.net on the blacklist but it does not block them either.... So I am not sure what or how it is filtering with the blacklist now. Normally the blacklist has caused emails to get rejected when doing this. 
 
 Ideally I would like to send anything coming from mcdlv.net to the quarantine. Is there anyway to redirect stuff to the quarantine manually?

BAlfson · Accepted Answer

I'm certain that there's a suggestion in Ideas for *@*domain.com , but that's not supported at present. All MailChimp emails include an unsubscribe link, so my tendency is to say that you should let folks take care of any problem themselves. MailChimp has a strict policy against spam, so if you feel like a particular MailChimp customer is spamming, you might want to bring that to their attention. 
 Cheers - Bob

DouglasFoster · Answer

On UTM, Bob Alfson knows his stuff. I found this disclaimer when I carefully read the help page for Blacklisted senders: 
 "A wildcard does not work in the domain or TLD part of an address." 
 This is pretty devastating, since you cannot block on host name at all (whether from Reverse DNS or HELO/EHLO), and since it is now clear that you can only block senders based on domain name exact match. Blocking based on IP address requires DNAT-to-DeadEnd, which is pretty obscure even if you know the IP addresses. Determining IP addresses is tricky, but their SPF record might help, if an SPF entry exists. 
 On MailChimp, I am with you. I blocked them unconditionally at some point in the past, using an email filter that is in front of my UTM. So far have had no reason to roll back that block. I use UTM behind the other device and it catches some spam that slips through the other one. All of my static rules are enforced before UTM, so I have not had to fight your issue.