Does geo block work for email as well?
![[Deleted User]](https://us.v-cdn.net/6031761/uploads/defaultavatar/n29VP08P5C5ND.jpg)
[Deleted User]
Cybersecurity Overlord ✭✭✭
This question came from a SonicWall user.
They had a situation where someone was able to spoof a users email address with the IP address coming from Brazil. They blocked in on the mail host. They wanted to know if they used the SonicWall Geo IP filter and check off Brazil would that email still have come into the mailbox?
Best Answer
-
CORRECT ANSWER
KaranM
Administrator
The short answer is, it does not block IPs. It blocks emails with that language in the email. For instance, we see a lot of spam come over that’s written in Chinese. If the box for Chinese is checked, it would block those messages.
To learn more see: https://www.sonicwall.com/support/knowledge-base/how-can-i-configure-sonicwall-geo-ip-filter-using-firewall-access-rules/170505480197552/
Knowledge Management Senior Analyst at SonicWall.
6
Answers
@Chris There is a way to block all mail from a given country. It requires a filter and a dictionary and works of the information obtained during the connection phase.
Create a dictionary with the two letter county abbreviations in it. You can only do 200 so be choosy.
Reject Country Codes
ANY
Single Header
X-Mlf-Country-Code
contains
Country Code dictionary
Action:
Reject message with 550 code or send to junk box.
That will let you simulate a geoip filter and it does a fairly good job This one wasn't mine, I shamelessly copied it from one of my customers and it works quite well.
Thank you @Gailand !