Managing custom rule policies

You can define custom rules for inbound or outbound email traffic. Each custom rule consists of a trigger and an action to be taken when the rule is triggered. Rules are applied before antivirus and antispam detection and can be prioritized. You can select which rule policies will be applied to each domain. In the case of custom rule policies, you can specify the order in which they will be evaluated.

To manage which connect or custom rule policies are associated with a domain:

On the Domains page, click the name of a domain.
The Policies section shows the number of policies directly associated with a domain and inherited from the parent domain group. The policies associated at the domain level will have higher priority than policies inherited from the parent domain group.
In the Policies section, click the Manage link.
The screen displays the existing rule policies associated with this domain or inherited from the domain group in priority order.
Click Manage.
Select the policies to be associated with the domain.
Click OK to view the new assignment of policies.
Administrators can change the priority of custom rule policies by clicking the (up) or (down) arrows in the Priority column.
Click Save.

Note
Inherited policies can only be associated or disassociated at the domain group level.

To remove a policy from a domain's connect rules or custom rules:

Select the policy to be deleted by clicking its checkbox.
Click the Remove () icon. Inherited policies can only be associated or removed at the domain group level.
Click Save.

About custom rule policies

Custom rules let you perform the following functions:

A maximum of 1000 custom rules can be added to a single custom rule policy. The custom rule execution limit for a single domain is 1024 rules. If more than 1024 enabled custom rules are associated to a domain or inherited from a domain group across multiple policies, only the first 1024 rules will be executed. The remaining rules are ignored.

Note
The custom rules functionality is only available to Email Security - Cloud inline and inline with hygiene mode users.
Custom rule hits appear in the Detail View in Email Trace as "Custom rule verdict: Pass. Scope admin".

Creating custom rules

To create a custom rule:

In the Policies page, click Create Policy.
Select the traffic type: Inbound or Outbound. Only SMTP integration is available for outbound traffic.
If you chose inbound, select your integration type: SMTP, MS365 API, or Google Workspace API.
Select Custom Rules.
Under Identification, enter a policy name and description (optional).
Click Create. The configuration page for your newly created custom rule policy appears.
Under Rules, select Manage next to Custom Rules.
In the Configure Custom Rules page, click Add Rule. A maximum of 1000 rules can be added to a custom rule policy.
Enter a rule name and description (optional).
Select which conditions (Apply the rule if), exclusions (Except if), and actions apply to the rule. See the table below for more information on the configuration options for a custom rule.
You can create groups of conditions that could be evaluated together as a unit. Evaluation stops with the first group where all the conditions are matched. Further groups will not be evaluated.
Note
Within the apply the rule if group, the conditions are joined by AND. Within the except if group, the conditions are joined by OR.
Select Stop evaluating further rules on match to stop evaluation of subsequent rules after a rule match (optional).
Click Save. Custom rules are enabled by default, but can be disabled. See Enabling or disabling custom rules.

Apply if and except if

Specific email criteria can be included (Apply the rule if) or excluded (Except if) from a custom rule when the rule triggers. Users can add up to 16 conditions (Apply the rule if) or negative conditions (Except if) to a custom rule.

Note
At least one condition (negative or positive) and one action must be selected to create a custom rule.

You can create a group of conditions using the Add Group button. Conditions within an Apply the rule if group are joined by AND. All the conditions must match for the group to be evaluated as a match which in turn enforces the custom rule.

Conditions within an Except if group are joined by OR. Any one of the conditions must match for the group to be evaluated as a match which in turn enforces the custom rule.

You can also create multiple groups of conditions under Apply the rule if separated by OR (The minimum is one group of conditions). The custom rule action is applied when any one of the configured groups evaluates to a match.

Existing rules will be shown under a single group. More groups can be added using the Add Group button.

Important
The following configuration options are not available for outbound custom rule policies:
DMARC Verdict
DKIM Result
SPF Result
Accept Rule
Deployment Mode
The following configuration options are not available for MS365 API or Google Workspace API custom rule policies:
HELO/EHLO Name
DMARC Verdict
DKIM Result
SPF Result
Accept Rule
Reverse Domain
Sender IP
Country
Deployment Mode

The following options are available for configuring both conditions and exclusions:

Configuration options	Available drop-down selections	Description	Value UI element	Value example
Envelope From	Equals	Detects an email if the sender email address exactly matches a value in the list. Match is case insensitive.	Multi-value text input	admin@example.com user.name@example.com
	Contains	Detects an email if the sender email address contains a value in the list. Match is case insensitive.	Multi-line text input	first.last user.name
	Matches	Detects an email if the sender email address matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	^firstname\.[^@]+@
	Is Empty	Detects an email if the message is missing a sender email address.	N/A	Yes or No
Envelope From Domain	Has MX	Detects an email if the sender's domain has an MX record in DNS.	N/A	N/A
Envelope From Domain	Has A	Detects an email if the sender's domain has an A record in DNS.	N/A	N/A
Subject	Equals	Detects an email if the subject of the message exactly matches a value in the list. Match is case insensitive.	Multi-value text input	Test mail from server Important Info
	Contains	Detects an email if the subject of the message contains a value in the list. Match is case insensitive.	Multi-value text input	Test Important
	Matches	Detects an email if the subject matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	[Ii]mportant [Ii]nfo
	Is Empty	Detects an email if the subject is empty.	N/A	N/A
Keyword	Contains	Detects an email if the subject or body of a message has a keyword that contains a value in the list. The subject is matched first and the body is ignored if the subject matches. Match is case sensitive.	Multi-value text input	Special offers Great offers
Keyword	Matches	Detects an email if the subject or body matches the specified regular expression (regex) for the keyword. Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	Special offers?
HELO/EHLO	Equals	Detects an email if the network name of the sending server exactly matches a value in the list. Match is case insensitive.	Multi-value text input	testname.com nametest.com sample.com
	Contains	Detects an email if the network name of the sending server contains a value in the list. Match is case insensitive.	Multi-value text input	testname nametest sample
	Matches	Detects an email if the network name of the sending server matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	\.trellix\.com$
Body	Contains	Detects an email if the message body contains a value in the list. Text: The body text contains a value in the list HTML: The body HTML contains a value in the list. Text or HTML: Either the body text or HTML contains a value in the list. Match is case insensitive.	Multi-value text input	urgent message
Body	Matches	Detects an email if the body matches the specified regular expression (regex). Text: The body text matches the regex. HTML: The body HTML matches the regex. Text or HTML: Either the body text or HTML matches the regex. Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	[uU]rgent message, transfer \$[0-9]{4,}
Body Size	Text Greater than Less than	Detects an email if the text body size is greater than or less than the value specified.	Value selector (1KB - 204800KB) Negative values are not permitted.	N/A
Body Size	HTML Greater than Less than	Detects an email if the HTML body size is greater or less than the value specified.		N/A
Header Exists	Header Name	Detects an email if the specified header name is present in the email message.	Single value text input	X-Test-Message
	Header Value: Equals (Optional)	When selected, the rule will detect an email if the header value exactly matches a value in the list. Match is case insensitive.	Multi-value text input	This is a test.
	Header Value: Contains (Optional)	When selected, the rule will detect an email if the header value contains a value in the list. Match is case insensitive.	Multi-value text input	test message
	Header Value: Matches (Optional)	When selected, the rule will detect an email if the header value matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	[tT]his is a test.
Recipient	Equals	Detects an email if one or more recipients of the email message exactly match a value in the list.	Multi-value text input	example@test.com name@test.com admin@test.com
	Contains	Detects an email if one or more recipients of the email message contain a value in the list.	Multi-value text input	example.user name.user different.name
	Matches	Detects an email if one or more recipients of the email message match the specified regular expression. Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	example[._]user@test\.com$
Note The recipient configuration option is uniquely related to the executable actions of a custom rule. If the recipient option is configured, the custom rule's action is performed for all recipients of the message or for recipients that matched the condition evaluation (equals, contains, matches). If the recipient condition is only configured as a condition (Apply If), Email Security — Cloud displays the matching recipient option in the Drop or Deliver action drop-down menu. Recipients are matched accordingly. If the recipient condition is only configured as an exclusion (Except If), Email Security — Cloud does not display the matching recipient option in the Drop or Deliver action drop-down menu. The message will be dropped for all recipients and will not be delivered. If the recipient condition is configured as both a condition and exclusion, Email Security — Cloud displays the matching recipient option. The matching recipient drop action is only applicable for the condition (Apply If). If the exclusion (Except If) is matched, then the message will not be dropped for any recipients.
DMARC Verdict	Matches Policy: Pass	Detects an email if the message's DMARC evaluation is Pass. If the message passes, the action specified for the rule is executed.	Drop-down menu	N/A
	Matches Policy: Reject	Detects an email if the message's DMARC evaluation is Reject. If DMARC is enforced in MAP, the message is rejected before the rule is evaluated If DMARC is not enforced in MAP, the action specified for the rule is executed	Drop-down menu	N/A
	Matches Policy: Quarantine	Detects an email if the message's DMARC evaluation is Quarantine. If the message is quarantined, the action specified for the rule is executed.	Drop-down menu	N/A
	Matches Policy: None	Detects an email if the message's DMARC evaluation is None and then executes the specified action for the rule.	Drop-down menu	N/A
	Is Undefined	Detects an email if there is no DMARC policy defined for the message and then executes the specified action for the rule.	Drop-down menu	N/A
Note The DMARC Verdict configuration option is available only to Hygiene customers creating Inbound custom rule policies.
DKIM Result	Fail	Detects an email if none of the DKIM signatures in the message are validated. If DKIM is enforced in MAP, the message is rejected before the custom rule is evaluated If DKIM is not enforced in MAP, the specified action for the rule is executed	N/A	N/A
	Pass	Detects an email if any of the DKIM signatures in the message are validated and executes the specified action for the rule.	N/A	N/A
	None	Detects an email if no DKIM signature header is in the message and executes the specified action for the rule.	N/A	N/A
Note The DKIM Result configuration option is available only to Hygiene customers creating Inbound custom rule policies.
SPF Result	Pass	Detects an email if the sender's SPF record validation passes and then executes the specified action for the rule.	N/A	N/A
	Hard Fail	Detects an email if the SPF record validation for the message results in a hard fail. If SPF is enforced in MAP, the message is rejected before the rule is evaluated If SPF is not enforced in MAP, the specified action for the rule is executed	N/A	N/A
	Soft Fail	Detects an email if the SPF record validation for the message results in a soft fail and then executes the specified action for the rule.	N/A	N/A
	Neutral	Detects an email if the located SPF policy is neutral and then executes the specified action for the rule.	N/A	N/A
	None	Detects an email if there is no SPF information available to authenticate the sender and then executes the specified action for the rule.	N/A	N/A
Note The SPF Result option is available only to Hygiene customers creating Inbound custom rule policies.
Accept Rule	Is Matched	Detects an email if the accept rules for the message are matched and then executes the specified action for the rule. For information about accept rules, see Managing connect rule policies.	N/A	N/A
Note The Accept Rule option is available only for Inbound custom rule policies.
Reverse Domain	Equals	Detects an email if the sender domain obtained through DNS reverse look-up exactly matches a value in the list. Match is case insensitive.	Multi-value text input	fullmoon.example.com newmoon.example.com nomoon.example.com
	Contains	Detects an email if the sender domain obtained through DNS reverse look-up contains a value in the list. Match is case insensitive.	Multi-value text input	fullmoon newmoon nomoon
	Matches	Detects an email if the sender domain obtained through DNS reverse look-up matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	\.trellix\.com$
Message Size	Greater than	Detects an email if the message size is greater than the value specified.	Value selector (1KB - 204800KB). Negative values are not accepted.	N/A
Message Size	Less than	Detects an email if the message size is less than the value specified.		N/A
Sender IP	In Network	Detects an email if the sender IP exactly matches a value specified in the list. Values can be IP addresses or CIDR values Match is case insensitive.	Multi-value text input	12.34.567.89
Country	Equals	Detects an email if the 2 letter country code of the sender IP exactly matches a value specified in the list. Match case is insensitive.	Multi-value text input	US UK IN
Deployment Mode	Out of Band (OOB)	Detects an email if the message domain's deployment mode is OOB.	N/A	N/A
	Inline	Detects an email if the message domain's deployment mode is Inline.	N/A	N/A
	Inline with Hygiene	Detects an email if the message domain's deployment mode is Inline with Hygiene.	N/A	N/A
Attachment	File Extension Equals	Detects an email if any of the message attachment extensions exactly match the selected extension types (including customized types).	Extension selector	N/A
	File Name Equals Contains Matches	Equals: Detects an email if any of the message attachment file names exactly match a value specified in the list.	Multi-value text input	example.txt attachment.pdf
		Contains: Detects an email if any of the message attachment file names contain a value specified in the list.	Multi-value text input	sample\.exe
		Matches: Detects an email if any of the message attachment file names match the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	N/A
	SHA256 Equals	Detects an email if the SHA256 hash of any message attachment exactly matches the value specified in the list. A SHA256 match is case sensitive and has to exactly math the SHA256 hash.	Multi-value text input	N/A
	True File Type	Detects an email if the true file type of any of the message attachments exactly match a value specified in the list. Match is case insensitive.	Multi-value text input	The following list includes the most common formats. Please note that this list not exhaustive: text/plain text/html text/calendar application/pdf application/vnd.ms-excel application/x-rar audio/mpeg audio/x-wav image/gif image/jpeg video/mp4 video/quicktime
	Size Greater than Less than	Greater Than: Detects an email if any message attachment size is greater than the value specified.	Value selector (1KB - 204800KB). Negative values are not accepted.	N/A
	Size Greater than Less than	Less Than: Detects an email if any message attachment size is less than the value specified.		N/A
Envelope From Group Note Envelope From Group has replaced the previous condition of "Envelope From AD Group. The Envelope From AD Group condition is applicable only for domains with a valid Google Workspace Authorization or MS365 Authorization with AD Sync enabled. If no users are in Email Security's cache or AD is not yet synced, the group match is negative. This option is available only for Outbound custom rule policies.	Equals	Detects an email if the group email address of any of the groups to which the sender email address belongs exactly matches a value in the list. Match is case insensitive.	Multiple Group select menu	N/A
	Contains	Detects an email if the group email address of any of the groups to which the sender email address belongs contains a value in the list. Match is case insensitive.	Multi-line text input	example.group different.name
	Matches	Detects an email if the group email address of any of the groups to which the sender email address belongs matches the specified regular expression (regex). Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	[._]group@test\.com$
Note The Envelope From AD Group option is available only for MS365 native domains with AD sync enabled. If no users are in Email Security's cache or AD is not yet synced, the group match is negative. This option is available only for Outbound custom rule policies.
Recipient Group Note Recipient Group has replaced the previous condition of Recipient AD Group. The Recipient AD Group condition is applicable only for domains with a valid Google Workspace Authorization or MS365 Authorization with AD Sync enabled. The group data is synced every 12 hours, if no users are in Email Security's cache or AD data is not yet synced, the AD group match is negative. Please note that the group list includes distribution lists as well as mail-enabled security groups, the list of groups can be reviewed from the equals condition. This option is available only for Inbound custom rule policies.	Equals	Detects an email if the group email address of any of the groups to which one or more of the recipient email addresses belongs exactly matches a value in the list. Match is case insensitive.	Multiple group select menu	N/A
	Contains	Detects an email if the group email address of any of the groups to which one or more of the recipient email addresses belongs contains a value in the list. Match is case insensitive.	Multi-line text input	example.group different.name
	Matches	Detects an email if the group email address of any of the groups to which one or more of the recipient email addresses belongs matches the specified regular expression (regex).Match is case sensitive by default. To enable case insensitivity, select the Case insensitive checkbox.	Single value text input for entering a regex pattern	[._]group@test\.co m$
Note The Recipient Group condition is applicable only for MS365 native and SMTP domains that have AD sync enabled. The AD data is synced every 12 hours, if no users are in Email Security's cache or AD data is not yet synced, the AD group match is negative. Please note that the group list includes distribution lists as well as mail-enabled security groups, the list of groups can be reviewed from the equals condition. This option is available only for Inbound custom rule policies.

Actions

Actions executed by a custom rule policy must be configured along with a condition or exclusion. Custom actions are taken when a rule triggers.

You can configure up to 5 actions for a single rule. If you include a Drop, Deliver, Quarantine, Remediate, or Bypass Scanning action, it must be the final row configured. You cannot select subsequent actions for the rule.

There can be only one of the same action added per rule, with the exception of Insert Header. You can add multiple rows for the Insert Header action as long as the total number of actions configured for the rule does not exceed five.

If Stop evaluating further rules on match is enabled, rule evaluation stops when a rule matches. Succeeding rules are not evaluated. If Stop evaluating further rules on match is not enabled, the rule evaluation continues when a rule matches.

Available actions depend on the criteria selected in the Apply rule if section.

If the custom rule is created in inbound view, the following actions are available:

Note
MS365 API and Google Workspace API only support the following actions:
Bypass Scanning
Bypass Hygiene
Remediate As (Select Spam, Virus, or Advanced Threats)

Action	Description
BCC	Delivers the email to the recipient and sends a blind carbon copy (BCC) to additional email addresses. BCC recipients must be in the same domain as the original recipient of the email. BCC recipients in other domains will not receive their copy of the email message.
Insert Header	Inserts a custom header into the email before delivery.
Note You can add multiple rows for the Insert Header action.
Modify Subject	Modifies the subject before delivery.
Note There can only be one Modify Subject action per rule, but multiple rules associated to the policy can have a configured modify subject action. If 'Stop evaluating further rules on match' is checked, rule evaluation will stop upon first rule match. If the New Subject entry contains the %Subject% wildcard, the original subject is retained and anything entered in the New Subject field is added to the original subject. For example, if the original subject is "XX Example" and you enter "[Test] %Subject%" in the 'New Subject' field, then the final modified subject will be "[Test] XX Example". If the 'New Subject' entry does not contain the %Subject% wildcard, the original subject is replaced by the new subject. If 'Stop evaluating further rules on match' is not checked, evaluation continues regardless of rule matches. If every matching rule contains the %Subject% wildcard in its New Subject entries, anything entered in the New Subject fields is appended to the original subject. For example, if the original subject is "XX Example", and you enter "[Before 1] %Subject%" as rule 1's New Subject, and you enter "[Before 2] %Subject%" as rule 2's New Subject, then the final modified subject is "[Before 2][Before 1] XX Example". Note that the prefix order is rule 2, followed by rule 1. If any of the matching rules do not contain the %Subject% wildcard in the 'New Subject' field, the new subject that does not contain the %Subject% wildcard overrides the new subjects entered in the preceding actions. For example, if the original subject is "XX Example", and you enter "[Before 1] %Subject%" as rule 1's New Subject, and you enter "Test Example" as rule 2's New Subject, then the final modified subject will be "Test Example". For example, if the original subject is "XX Example", and you enter "[Before 1] %Subject%" as rule 1's New Subject, and you enter "Test Example" as rule 2's New Subject, and you enter "[Before 3] %Subject%" as rule 3's New Subject, then the final modified subject will be '[Before 3] XX Example". Note that rule 2 completely overrides rule 1, but rule 3 retains the new subject from rule 2 due to the wildcard in rule 3.
Bypass Scanning	Delivers the email to the recipient, bypassing scanning.
Note This must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Quarantine, Deliver, Remediate, or Drop actions.
Bypass Hygiene	Delivers the email to the recipient, bypassing antivirus and antispam scanning.
Reroute	Routes the email to another MTA for processing.
Note There can only be a one Reroute action per rule, but multiple rules associated to the policy can have a configured reroute action. If Stop evaluating further rules on match is enabled, rule evaluation will stop upon first rule match. The reroute action assigned to that rule is applied. If Stop evaluating further rules on match is not enabled, evaluation continues regardless of rule matches. The reroute action specified in the last matching rule is applied.
Deliver	Delivers the email to the intended recipient, bypassing both AV/AS and Advanced Threat scanning.
Note Deliver must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Quarantine, Drop, Remediate, or Bypass Scanning actions.
Drop	Drops the email and does not deliver it to its intended recipient.
Note Drop must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Quarantine, Deliver, Remediate, or Bypass Scanning actions.
Quarantine	Routes the email to the quarantine. If you select the checkbox, Mark as spam, the email will appear with 'S' marked in red in your quarantine notifications. Please note that marking the email as spam will not make it releasable.
Note Quarantine must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Drop, Deliver, Remediate, or Bypass Scanning actions.
Remediate As	Remediates the email based on the policies configured for spam, virus, or advanced threats. Select Spam, Virus, or Advanced Threats.

If the custom rule is created in outbound view, the following actions are available:

Action	Description
BCC	Delivers the email to the recipient and sends a blind carbon copy (BCC) to additional email addresses. BCC recipients must be in the same domain as the sender of the email. BCC recipients with other domains will not receive their copy of the email message.
Insert Header	Inserts a custom header into the email before delivery.
Note You can add multiple rows for the Insert Header action.
Modify Subject	Modifies the subject before delivery.
Note There can only be one Modify Subject action per rule, but multiple rules associated to the policy can have a configured modify subject action. If Stop evaluating further rules on match is checked, rule evaluation will stop upon first rule match. If the New Subject entry contains the %Subject% wildcard, the original subject is retained and anything entered in the 'New Subject' field is added to the original subject. For example, if the original subject is "XX Example" and you enter "[Test] %Subject%" in the New Subject field, then the final modified subject will be "[Test] XX Example". If the 'New Subject' entry does not contain the %Subject% wildcard, the original subject is replaced by the new subject. If Stop evaluating further rules on match is not checked, evaluation continues regardless of rule matches. If every matching rule contains the %Subject% wildcard in its New Subject entries, anything entered in the New Subject fields is appended to the original subject. For example, if the original subject is "XX Example" and you enter "[Before 1] %Subject%" as rule 1's New Subject, and you enter "[Before 2] %Subject%" as rule 2's New Subject, then the final modified subject is "[Before 2][Before 1] XX Example". Note that the prefix order is rule 2, followed by rule 1. If any of the matching rules do not contain the %Subject% wildcard in the New Subject field, the new subject that does not contain the %Subject% wildcard overrides the new subjects entered in the preceding actions. For example, if the original subject is "XX Example" and you enter "[Before 1] %Subject%" as rule 1's New Subject and you enter "Test Example" as rule 2's New Subject, then the final modified subject will be "Test Example". For example, if the original subject is "XX Example" and you enter "[Before 1] %Subject%" as rule 1's New Subject and you enter "Test Example" as rule 2's New Subject and you enter "[Before 3] %Subject%" as rule 3's New Subject, then the final modified subject will be '[Before 3] XX Example". Note that rule 2 completely overrides rule 1, but rule 3 retains the new subject from rule 2 due to the wildcard in rule 3.
Bypass Hygiene	Delivers the email to the recipient, bypassing antivirus and antispam scanning.
Bypass Sender Rate Limiting	Bypasses the rate limits of the sender address. Rate limits are set in the outbound message analysis policy. This action is only available if the "Envelope From" condition is part of the custom rule.
Deliver	Delivers the email to the intended recipient, bypassing both AV/AS and Advanced Threat scanning.
Note Deliver must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Drop or Quarantine actions.
Drop	Drops the email and does not deliver it to its intended recipient.
Note Drop must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Deliver or Quarantine actions.
Quarantine	Routes the email to the quarantine. If you select the checkbox, Mark as spam, the email will appear with 'S' marked in red in your quarantine notifications. Please note that marking the email as spam will not make it releasable.
Note Quarantine must be the final rule configured. Once you configure this action, you cannot select subsequent actions for the rule. This action can not be configured along with Drop or Deliver actions.

Using regular expressions to configure custom rules

A regular expression, or regex, is a method for matching text with patterns. Regular expressions can be used to match against the following custom rule configuration options:

Envelope From
Subject
Keyword
HELO/EHLO Name
Body
Header Exists
Recipient
Reverse Domain
Attachment > File Name

To match only subject strings containing any regular expression, add ^ to the beginning of the word and $ to the end of the word. For example, if the regular expression is "Memorandum," users must spell it as "^Memorandum$". For more information, see online examples of regular expressions in Google Support.

Cloning Custom Rules

To clone an existing custom rule:

In the Configure Custom Rules page, click the Create Like link on the row of the rule you want to clone.
In the Create Rule page, modify settings as needed.
Click Save. Allow up to 10 minutes for the changes to take effect.

Changing rule priority

To change the priority of an existing custom rule:

Click the (increase) button to increase the priority of the rule or the (decrease) button to decrease the priority of the rule. The rule with priority 1 takes the most precedence. Save your changes. Allow up to 10 minutes for any changes made to take effect.

Deleting custom rules

To delete an existing rule:

Select the checkbox next to the rule and click the (delete) button.
Click to confirm. Allow up to 10 minutes for the changes to take effect.

Enabling or disabling custom rules

In the Configure Custom Rules page:

To enable an existing rule, check the box under the Enable column.
To disable an existing rule, uncheck the box under the Enable column.
Save your changes.

Modifying custom rules

To modify an existing custom rule:

Click the Edit link in the row where the rule is listed.
In the Edit Rule page, change the options as necessary.
Click Save. Allow up to 10 minutes for the changes to take effect.