Views:

Rewrite email addresses of inbound or outbound traffic to help reroute emails, mask internal infrastructure, and align with organizational policies.

Configure email address modification rules to:
  • Rewrite sender or recipient addresses in both message envelopes and headers
  • Rewrite domains in email addresses
You can configure address or domain rewriting rules to replace the entire email address or only the domain portion of the address. The following table shows some examples.
Original address
New address
test@example.com
myname@mydomain.com
test1@example.com
test2@example.com
test@test.com
test@example.com
If an email address matches both an address rewriting rule and a domain rewriting rule in the same direction, the address rewriting rule takes precedence.
Note
Note
You can create only one rewriting rule for a domain or email address in one direction.
Address and domain rewriting rules apply to sender addresses for outbound traffic and recipient addresses for inbound traffic.
Rewriting occurs before policy matching and message delivery. Cloud Email Gateway Protection scans emails and applies security policies based on the rewritten domains and addresses, not the original ones.
Important
Important
Once rewriting rules are configured, existing inbound and outbound policy rules that reference original domains or email addresses will no longer apply. To ensure consistent enforcement, make sure appropriate inbound and outbound policy rules are in place for the rewritten domains and addresses.
For inbound emails, if message header addresses are rewritten, DKIM and DMARC (which relies on DKIM) verification in Cloud Email Gateway Protection and downstream MTAs may fail due to modifications to the message body.

Procedure

  1. Make sure that your account has the appropriate permissions and that you have added both the original and rewritten domains in Cloud Email Gateway Protection.
    Operation
    Account role type and permissions
    View and edit (add, modify, and delete) rewriting rules
    Roles with the Configure settings permission under Administration - Other Settings: can edit those rewriting rules where both the original and rewritten domains are within their domain visibility scope
    View rewriting rules only
    • Roles with the Configure settings permission under Administration - Other Settings and limited domain visibility: can only view those rewriting rules where at least one domain is outside their scope
    • Roles with the View permission under Administration - Other Settings: can view those rewriting rules where either the original and rewritten domain is within their scope
    View and edit settings
    Roles with the Configure settings permission under Administration - Other Settings and full domain visibility
    View settings only
    Roles with the View permission under Administration - Other Settings
    To add a domain to Cloud Email Gateway Protection, go to Domains.
  2. Add address rewriting rules or domain rewriting rules.
    • To add an address rewriting rule,
      1. On the Address rewriting tab, click Add.
      2. In the Address rewriting rule settings dialog, select the direction to apply the rule.
      3. Type the original email address.
      4. Type the new email address to replace the original email address.
      5. Click Save.
    • To add a domain rewriting rule,
      1. On the Domain rewriting tab, click Add.
      2. In the Domain rewriting rule settings dialog, select the direction to apply the rule.
      3. Type the original domain.
      4. Type the new domain to replace the original domain.
      5. Click Save.
      Note
      Note
      If a managed domain is deleted, the domain rewriting rules associated with the domain are unavailable.
    After you have configured one or more rules, you can:
    • Click the name of a rule to edit the rule.
    • Select one or more rules and click Delete to remove the selected rules.
  3. Specify the type of email addresses that Cloud Email Gateway Protection uses to match the address modification rules and rewrite upon rule match.
    1. Click the Settings tab.
    2. Select how Cloud Email Gateway Protection matches and rewrites addresses: envelope addresses, message header addresses, or both
      By default, all options are disabled, meaning address modification is turned off.
    3. Click Save.
    When a rewriting rule is matched,
    Selected option
    Inbound emails
    Outbound emails
    Envelope addresses
    Rewrites recipient envelope addresses
    Rewrites sender envelope addresses
    Message header addresses
    Rewrites addresses in the To and Cc fields
    Rewrites addresses in the From and Reply-To fields
Comments (0)