0

This question pertains to the Exchange 2013 environment.

We have a user internal to the organization that has sent an unsolicited e-mail to hundreds of individual addresses within (and outside) our organization. He put all addresses in the To field. We would like to moderate such future messages in a way that when any of the To, Cc or Bcc fields contain more than 50 (or 100, 200...) recipients, that the message be sent for moderation.

Is it possible to create such mail flow rule in Exchange and how?

I already know that I can limit the number of max recipients per message, but that does not fix the issue, since the user can split his message into multiple bulk emails.

Goran
  • 73
  • 1
  • 9
  • `I already know that I can limit the number of max recipients per message, but that does not fix the issue, since the user can split his message into multiple bulk emails.` - Ummm so how would your proposed solution work if the user split it into multiple bulk messages? The max recipients per message is exactly what you need to configure. How would any other solution work if the users splits the message? – joeqwerty Sep 09 '17 at 20:24
  • Well, it's not the same thing. I don't want to limit the number of max recipients (not beyond a certain big number), just to moderate such emails. The proposed solution certainly wouldn't work if user splits the message below the detection threshold, but I'm willing to live with that. – Goran Sep 10 '17 at 12:44

1 Answers1

2

Goran,

This is not possible. There is no transport rule predicate that can check for the number of recipients in those fields and then act on that information. Moreover, I do agree with joeqwerty in that the user would still be able to simply chunk the mails to bypass the moderation. Whether the offending EMails are moderated or blocked, the circumvention remains open to the user.

Hope this helps.

LeMoore
  • 21
  • 2