Caution
Be sure to test any rules that you create before employing them throughout the enterprise.
We strongly encourage you to quarantine or archive messages for the first few weeks after introducing a new rule, and to monitor the logs closely to assess the efficacy of your rule(s). In this way, you'll be in the best possible position to take quick action in case of unanticipated consequences.
For example, if you inadvertently create a rule that blocks all email routed through one of the Internet backbones, (e.g., enter mci.net, in the routing domain) all would not be lost. You will be able to quickly catch and recover from the error.
One way to test is by limiting the scope of the rule you plan to introduce by specifying an additional field, for example your own email address, in the To: field. After the testing confirms that your rule is solid, remove your email address to broaden the scope of the rule to protect all your users.
See also:
AND Operator
Boolean Expressions
Content Filter: Blocking Spam
Creating a Content Filter Policy
Creating A Keyword List: Example
Exact Match and Case Sensitive Comparison Examples
Keyword Lists
OR Operator
Synonyms Example
Testing Spam Rules