Blacklists - xorlab

Blacklists—accessible by selecting Settings → Lists → Blacklists in XCC—allow you to block email delivery based on specific indicators.

SubdomainsWhen you add a root (top-level) domain, e.g., example.com, to the list, all its subdomains will also be blacklisted. When you add a particular subdomain, e.g., site.example.com, only this subdomain will be blocked; any lower-level ones such as other.site.example.com won’t be affected.

Blocked senders

Customize any of the lists below to block emails from individuals, organizations, or top-level domains.

List name	Description	Accepted entries
Sender TLD blacklist	Use this list to block emails from entire top-level domains	TLD as `String`, e.g., `cloud`
Sender domain blacklist	Use this list to block emails from certain domains	Domain name as `String`
Sender address blacklist	Use this list to block emails from certain sender adresses	Email address as `String`
Exposed accounts local sender domains	Use this list to protect your exposed accounts from receiving emails from certain domains	Domain name as `String`

Blocked links

Customize any of the lists below to block emails that contain links matching specific criteria.

List name	Description	Accepted entries
Link domain blacklist	Use this list to block emails that contain a link from certain domains (or root domains) by the domain name	Domain name as `String`
Link IP blacklist	Use this list to block emails that contain a link from certain domains (or root domains) by the domain IP	Domain IP as `String`

Blocked files

Customize any of the lists below to block emails that contain files matching specific criteria.

List name	Description	Accepted entries
File extension blacklist (regex)	Use this list to block emails that contain files with certain extensions	File extension as `Regex`, e.g., `(?i)\.bat$` for case-insensitive matches.
File hash blacklist	Use this list to block emails that contain files matching certain SHA256 hash values	Hash value as `String`, e.g., `9db4 4391 dbfa 43bc 9b13 4440 00f6 9c77 a395 95c9 bac5 710e 0a78 a638 60b0 69a2`
File output blacklist (regex)	Use this list to block emails that contain files for which the `file` command matches certain patterns	Pattern as `Regex`, e.g., `Java archive data`

Blocked recipients

These are only usable with the DROP_recipient_address_droplist rule enabled.

List name	Description	Accepted entries
Recipient address droplist	All incoming emails to these recipient addresses will be dropped immediately, except when there is another guarded recipient not listed here.	Email address as `String`, e.g., `formeremployee@company.com`

​Blocked senders

​Blocked links

​Blocked files

​Blocked recipients

Blocked senders

Blocked links

Blocked files

Blocked recipients