Content Security Policy: Frequently Asked Questions

Q: Why do I need to apply my policy?

A: Clearswift Gateway does not act on policy changes – or changes to its Configuration settings – until an administrator applies the configuration. Having to apply the configuration ensures that there is control in the change process. It also ensures that changes to the configuration are audited.

Q: How should I prioritize my content rules?

A: Content rules are applied in the numbered order displayed on the policy route. You should typically use more specific content rules later in the list.

Q: How does Clearswift Gateway determine the policy to invoke on a particular message?

A: Clearswift Gateway invokes the content rules applied to the first policy route in the Manage Policy Routes list whose mail route matches the message's From and To addresses.

Q: When is a content rule invoked on a message?

A: The content rule is invoked if it has been applied on the policy route to which Clearswift Gateway matches the message. (See the previous answer.)

Q: When does a content rule trigger, and what effect does this have?

A: A content rule triggers if the message on which it has been invoked satisfies all the conditions specified in the rule's "What to Look For?" clauses.

If one or more content rules are triggered, Clearswift Gateway performs the rules' "What to Do?" actions on the message, subject to the following conditions:

Clearswift Gateway can perform up to two disposal actions on the message — for example your policy could specify to relay copies of messages to an archive server, as well as deliver messages that trigger a rule. If the message triggers more than one content rule, the Gateway performs the disposal action of the highest priority triggered content rule that specifies a disposal action.

The priority of the content rules is determined by the order in which they are listed in the policy route.

Clearswift Gateway can perform up to two disposal actions on the message — for example your policy could specify to relay copies of messages to an archive server, as well as deliver messages that trigger a rule. If the message triggers more than one content rule, the Gateway performs the disposal action of the highest priority triggered content rule that specifies a disposal action.
If the message is held in a message area, you can release the message if you know that it is safe to do so. When a message is released, the Clearswift Gateway honors the original content security policy, and will apply the disposal actions (if any) of the next highest priority triggered rule.

Clearswift Gateway performs any additional actions specified by the triggered content rules, such as generating Inform messages, or adding annotations, unless the actions specify otherwise.

With some additional actions, such as "Generate an Inform", you can specify that Clearswift Gateway should perform the additional action only if the rule's disposal action is performed (or only if it is not performed).

Q: Why does a policy route need a default disposal action?

A: Clearswift Gateway uses the default disposal action for messages on a route that do not trigger any of the content rules.

Q: What is the difference between a What to Do Action and a Disposal Action?

A: A What to Do Action specifies an action to take if the rule is triggered, for example informing senders or recipients, or add annotations to the message.

A Disposal Action specifies how the message is disposed of, for example whether it is dropped, held in a message area or delivered.

Q: How can a single message have two disposal actions applied to it?

A: If you use two disposal actions with a content rule, the rule makes a copy of detected messages. One copy is dealt with by one of the disposal actions, and the other copy is dealt with by the other disposal action.