I am trying to work on cutting down on the amount of spam, phishing, and malicious emails coming through via AmazonSES burners.
Has anyone devised a method or certain IOCs to block on?
Add a comment
|
1 Answer
I just send everything from SES to Quarantine. However there is a lot of legitimate email that comes from SES also, so I allow some things through.
I use Exchange and create a Mail Flow Rule like this:
If the 'Received-SPF' header matches amazonses.com
Set the spam confidence level (SCL) to '9'
Except if...Is received from
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
You may need to add other exceptions for legitimate messages that come through SES, I have several additional exceptions too.
You could also choose to Reject the message, instead of changing the spam score, which will bounce it back to the sender and you'll never see it.
