for Google Workspace / Microsoft 365

Question

For email DLP service, sometimes the email address is duplicated (ex. "user@example.com" <user@example.com>). In this case, how to set the Email DLP filtering rule?

Answer

You can set by selecting "Optional Header" as the search Target and set the following conditions as the Optional Header:

◯ Optional Header:
:X-TO-ADDR …Extracts a unique email address included in TO
:X-CC-ADDR …Extracts a unique email address included in CC
:X-TO-CC-ADDR …Extracts a unique email address included in TO and CC
:X-TO-DOMAIN …Extracts a unique domain included in TO
:X-CC-DOMAIN …Extracts a unique domain included in CC
:X-TO-CC-DOMAIN …Extracts a unique domain included in TO and CC