Fallback Action for Email DLP

In the event that Netskope Email DLP cannot always scan an email for DLP because of conditions like file size, scan time limits and any other unexpected errors, fallback action gets triggered. The SMTP Proxy adds a header to the message and delivers the message to your next-hop mail server so that your mail server can quarantine, reject, flag, or deliver it according to your data security policy. The SMTP Proxy also records it in the event for the message.

How It Works

1.  A message reaches the SMTP Proxy and matches an Email DLP policy that requires DLP inspection.
2. The SMTP Proxy sends the message to DLP for scanning.
3.   In the event of a DLP scan failure, the SMTP Proxy adds the header x-netskope-fallback-action: true to the message and records the failure in the event.
4.  The SMTP Proxy forwards the message to your next-hop mail server.
5. Your mail server evaluates the header against your rules and applies the outcome you chose:

• Deliver: No rule matches the header, and the message is delivered unscanned.
• Quarantine: The rule holds the message for review.
• Reject: The rule rejects the message.
• Flag: The rule tags the message, for example by adding a label or changing the subject, and delivers it.

Configure Handling for Unscanned Messages

1. In your next-hop mail server, create a rule that matches the message header x-netskope-fallback-action with the value true.
2. Set the action for the rule: quarantine, reject, flag, or another handling that matches your data security policy.
3.  Send a test message that is larger than the DLP scan size limit through the SMTP Proxy.
4.  In the received message, confirm that the header x-netskope-fallback-action: true is present and that your rule applied. If the header is missing, check Skope IT for a DLP Scan Failed field on the event. If the field is absent, the scan did not fail, or Fallback Action is not enabled for your tenant. Contact your Netskope account team.
   

View Fallback Events

Events for messages that DLP could not scan appear in Skope IT with the Access Method SMTP Proxy. Each of these events carries two extra fields.