Help Center

Knowledge Base

[Netmail Support]

Skip to end of metadata
Go to start of metadata

The content filter is designed to look at the content of a message, such as the subject, who the mail is from, or anything in the body of the message, and apply a certain outcome to the message.

This training will review the content filter policy, what it is, how it works, and some troubleshooting steps to take.

Contents and Rules that can be found in the policy

Content filter can be found by going into the WebAdmin, under the administration tab, Policies, Content Filter.

In the Content filter there are:

  • Ignore SPAM
  • Ignore Virus
  • Ignore Blocked Attachment

With these off, it will tell the content filter not to act on any message that has already been flagged as any of the above. These “flags” are applied DURING the processing of the message, before it is sent to it's final destination (mailbox, QT, etc.)

For example, if you have a message which is marked as spam, and while it is still processing you have the content filter with ignore spam turned on, you can have the content filter apply a tag to that message and send it to it's destination.

Filter values are what the content filter will search for in the message.


The following are in the rules to setup the content filter:

  • Spaces are ignored.
  • Upper and lower case is checked
  • Languages is just to select what language the content filter is going to search in.
  • Filter Type you are able to select where in the message to search.
  • Keywords will search the body of the message for whatever has been entered in the filter value.
  • Header Keywords will search for certain values in the header such as subject, from, to...
  • Regular Expressions are a concise and flexible means for matching strings of text. The search will depend on how you entered in the expression.
Explanation of REGEX

After reviewing the above, you'll have an idea of what a regular expression is. We will be using the shortened term “REGEX” to refer to a regular expression from here on. There are examples of regex below for setting up a rule for the content filter.

Special characters:

  • '*' is limited to the beginning and ending of the pattern (i.e. it cannot be embedded)
    • A pattern consisting only of ‘*’ is not allowed
  • '%' means that any one digit can occupy the corresponding position in the matched word
  • '?' is more general and indicates any one character
  • No spaces are allowed between the wild card/stemming indicators and the word
  • Also, there is no space between '~' and <lang>


  • %% matches any 2 digits number
  • %* matches a single digit or any token starting by a digit
  • ?aa%* matches any token having ‘aa’ in the second and third position and a digit in fourth
  • *aa* matches any token containing the substring ‘aa’

The use of the AND function:

  • The AND function requires the use of parenthesis () around each word
  • The words need to be in the order specified for the AND function work properly

The following 3 examples will give the same results:


(The) (big) (dog)

(The) ( big) ( dog)

  • The following  will quarantine since it has the three words together:
    • The big dog
    • Then the Big dog Laughed
  • The following will not quarantine since it has the word 'red' in the middle:
    • The big red dog

The use of the OR function:

  • The words are used within one set of parenthesis ().
  • Only one of the words with the parenthesis needs to be found. 
    Example: (The big dog)
  • The above example will quarantine the following because at least one of the words is found (note: the order of the words does not matter):
    • A big cat
    • The big rat
    • A Dog chased a big car

AND/OR function:

  • The AND and OR can be used together for more complex filtering:

(The)(cat dog)

  • This will quarantine since 'cat' or 'dog' is after the:
    • The cat sang
    • And the dog ran
  • This will not quarantine because the word 'big' is in between:
    • The big dog

NOT function:

  • Uses the ! Symbol.
  • In this example if 'dog' follows the then it will not catch it.


  • This will not quarantine because 'dog' immediately follows the:
    • The dog
  • This will quarantine because the word big separates out 'the' and 'dog':
    • The big dog

Exception function:

  • Uses the {} symbols.
  • This gives any exceptions to the rule.

(dog* {doggy})

  • This will quarantine because 'dog' is in their but 'doggy' is not:
    • The dogs ran
  • This will not quarantine because 'doggy' is an exception to the rule:
    • The boy held the doggy

Within x words function:

  • Uses the [] symbols.
  • This will quarantine if the first word is within x words of the second word.
  • Order matters.


  • This will quarantine because 'dog' is within 2 words after 'the':
    • The big dog ran
    • This will not quarantine because 'dog' is more than 2 words from 'the':
      • The big cat and dog ran


(!Gift) [4] (certificate)

  • This will not quarantine 'Gift' unless it is within four words of 'certificate'.

(cat dog)[2](ran)

  • This will quarantine if 'ran' is found within two words, after 'cat' or 'dog'.


  • This will quarantine if 'dog' is found and is not within five words, before or after of 'cat'.

* In order to use the special characters as the special characters the content filter needs to be type Regular Expression. This type is only good for single words. To use a special character do the following:


  • H*p
  • Help?
  • (H/*p)
  • (Help/?)
Troubleshooting issues with the Content Filter

If you have issues with the content filter not working properly there are a few things that you will want to do.

1. Load up Hulamanager to see if the policy gets loaded

*Note: the policies will not load until a message comes into guardian.

2. Try to toggle the content filter agent under servers > cluster > M+ Content Filter Agent.

3. Check the order of the agents under servers > cluster in the Agent Ordering tab.

4. Policy can be set on both domain and user level. Try testing on the user level.

5. Delete and recreate the policy.

If none of these work then contact Messaging Architects to get some help to resolve the issue.

  • No labels