Skip to main content
日本語 简体中文 繁體中文

[Email DLP] Setting Up Rule Conditions Using Regular Expressions

Overview

This article provides writing conventions and examples for specifying regular expressions in Rule Groups for Administrators who perform the initial Setup and operational management of Email DLP.

Notes

  1. The content of this article is based on the product specifications as of September 2026, and is subject to change without notice.
  2. The Email DLP Administrator Role is required to view the actual screen or change the settings.

  3. The URL of the Email DLP Users screen differs depending on your tenant.

    ・PC: https://console.mo.hdems.com/#/[ メイン ドメイン ]
    ・Mobile: https://console.mo.hdems.com/#/m/[ メイン ドメイン ]
    ※ Replace ［ メイン ドメイン ］ with your contracted Domain.

  4. Email DLP uses re2 as its regular expression library.
  5. Email DLP regular expressions are not case-sensitive.
  6. For filtering based on Bcc, please refer to the following article.
    [Email DLP] Filtering Based on Bcc Is Not Processed as Expected

Procedure

The expressions described in this article are used when configuring the following items.

  1. [Email DLP] Filter Settings - Creating/Editing Rule Groups

    ルールグループの設定画面

Regular Expression Basics

When writing a regular expression, if the specified string contains any of the following characters, they must be escaped.

Characters that require escaping

.[](){}*^\|+?$

To escape a character, place a backslash \ before it.

Example:

\.zip

Regular Expression Examples

By writing the following in an Email DLP Rule Group, you can configure the conditions required for mail operations.

When a ZIP File is attached+

［Target］：［Attachments］
［Predicate］：［with filename that matches regular expression］
［Pattern］：\.zip$

When a specific string is in the subject+

［Target］：［Subject］
［Predicate］：［matches regular expression］
［Pattern］：A specific string such as 「confidential」

"Match beginning of subject (regular expression ^)" and "Match end of subject (regular expression $)" are available.
If you do not specify the beginning or end, the location is not restricted, and the string will be detected if it appears at the beginning, middle, or end.

Example: When it ends with .zip
\.zip$

Example: When it starts with the specific keyword 「confidential」
^confidential

When there is no subject+

［Target］：［Subject］
［Predicate］：［does not match regular expression］
［Pattern］：.(half-width period)

When the Domain is an Exact Match+

［Target］：［Header To/Header Cc（Domain Part）］
［Predicate］：［matches regular expression］
［Pattern］：^hennge\.com$

When the Domain is an Exact Match including subdomains+

［Target］：［Header To/Header Cc（Domain Part）］
［Predicate］：［matches regular expression］
［Pattern］：^example\.hennge\.com$

When Header Cc does not contain [random string]_CC@hennge.com+

［Target］：［Optional Header］CC
［Predicate］：［does not match regular expression］
［Pattern］（※）：.+_CC@hennge\.com

Notes 1When using an Optional Header, an Exact Match format such as .+_CC@hennge\.com$ cannot be used.
Notes 2If a specific address is not present in Header Cc, ［Header To/Header Cc（Domain Part）］ and ［Header To/Header Cc（email address）］ cannot be used; you must always use "Optional Header".

When Header Cc does not contain any of example@hennge1.com, example@hennge2.com, or example@hennge3.com+

［Target］：［Optional Header］Cc
［Predicate］：［does not match regular expression］
［Pattern］（※）：example@hennge1\.com|example@hennge2\.com|example@hennge3\.com

NotesWhen using an Optional Header, an Exact Match format such as .+_CC@hennge\.com$ cannot be used.

When Header To/Header Cc contains At least one External Domain+

［Target］：［Header To/Header Cc（Domain Part）］
［Predicate］：［does not match regular expression］
［Pattern］（※）：(\.)?hennge\.com$
［Count］：1
※ .hennge.com or @hennge.com are treated as internal domains.
When specifying only the main Domain (in the case of a fully qualified Domain): ^hennge\.com$

When Header To/Header Cc contains 2 or more types of External Domains+

［Target］：［Header To/Header Cc（Domain Part）］
［Predicate］：［does not match regular expression］
［Pattern］（※）：(\.)?hennge\.com$
［Count］：2
※ .hennge.com or @hennge.com are treated as internal domains.

NotesThis item determines the string after @ in the Domain.

In the example above, you must specify it as hennge.com.

When Header To/Header Cc contains 3 or more External addresses+

［Target］：［Header To/Header Cc（email address）］
［Predicate］：［does not match regular expression］
［Pattern］（※）：「@hennge\.com$」
［Count］：3
※「@hennge.com」が社内扱いのドメインです。

Notes The string is matched as a partial match across the entire email address.

When Detecting Specific Auto-Forwarded Emails in Google Workspace+

Detecting auto-forwarding of example@hennge.com
Rule Conditions：［Match All of the Following Rule Conditions (AND)］

［Predicate］ 1
［Target］：［Optional Header］「X-Forwarded-For」
［Predicate］：［exists］

［Predicate］ 2
［Target］：［Envelope From］
［Predicate］：［matches regular expression］
［Pattern］：「example\+.+@hennge\.com」

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.