Enterprise DLP
Email Transport
Table of Contents
Email Transport
Create a Microsoft Exchange email transport rule to forward traffic to the
Enterprise Data Loss Prevention (E-DLP)
cloud service for inline email inspection.- Create the outbound and inbound connectors.Skip this step if you have already created both the outbound and inbound connectors.
- Selectto create a new email transport rule.Mail flowRulesAdd a ruleCreate a new rule
- Configure the email transport rule conditions.
- Enter aNamefor the email transport rule.
- Specify the email recipient.This instructs Microsoft Exchange to forward the email toEnterprise DLPbefore it leaves your network when the email recipient is outside your organization.
- ForApply this rule if, selectThe recipient.
- For the recipient, selectis external/internal. When prompted to select the recipient location, selectOutside the organizationClickSaveto continue.
- Specify Microsoft Exchange Connector you created as the transport target for email inspection.
- ForDo the following, selectredirect the message to.
- For the transport target, selectthe following connector. When prompted, select the outbound connector.ClickSaveto continue.
- Add an exception for emails that exceed the maximum message size supported byEnterprise DLP.Enterprise DLPsupports inspection of email messages up to 20 MB in size. Larger email messages are not supported and should not be forwarded toEnterprise DLP.
- In the sExcept Iffield, selectThe message.
- Selectsize is greater than or equal to. When prompted, enter the following maximum-supported message size KB:20480
Add an exception for emails that were already inspected byEnterprise DLP.- In theExcept ifcondition, click the add symbol (Orcondition.
- Select theThe message headerscondition.
- For theOrcondition action, selectmatches any of these words.
- ClickEnter textto set the message header tox-panw-inspected.
- ClickEnter wordsand entertrue.ClickAddand select the word you added. ClickSaveto continue.
ClickNextto continue. - Configure the email transport rule settings.
- For theRule mode, ensureEnforceis selected.This setting is enabled by default when a new transport rule is created.
- (Optional) Configure the rest of the email transport rule settings as needed.
- ClickNextto continue.
- Save.
- Review the email transport rule configuration and clickFinish.ClickDonewhen prompted that the email transport rule was successfully created. You are redirected back to the Microsoft Exchange Rules page.
- Modify the email transport rule priority as needed.To change the priority of a transport rule, select the transport rule andMove UporMove Downas needed.A proper rule hierarchy is recommended to ensure emails successfully forward toEnterprise DLP.
- The email transport rule should always be the highest priority rule relative to the other transport rules required for Email DLP.
- Any email encryption rules not created as part of the email DLP configuration must be ordered below the transport rules created for Email DLP.Enterprise DLPcannot inspect encrypted emails.
- There is no impact in regards to priority between the quarantine transport rules, block transport rule, encrypt transport rule, or any other transport rules that exist.AfterEnterprise DLPinspects and returns the email back to Microsoft Exchange, the appropriate transport rule action will occur based on the email header.