在 Exchange Online 中管理邮件流规则Manage mail flow rules in Exchange Online

在 Exchange Online 组织中或没有 Exchange Online 邮箱的独立 Exchange Online Protection (EOP) 组织中,可以使用邮件流规则 (也称为传输规则) 来查找通过组织传递的邮件的特定条件,并针对这些条件采取措施。In Exchange Online organizations or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you can use mail flow rules (also known as transport rules) to look for specific conditions on messages that pass through your organization and take action on them.

本文介绍了如何创建、复制、调整顺序、启用或禁用、删除、导入导出规则,以及如何监视规则使用情况This article shows you how to create, copy, adjust the order, enable or disable, delete, or import or export rules, and how to monitor rule usage.

提示

若要确保规则以预期的方式工作,请确保全面测试每个规则以及规则之间的交互。To make sure your rules work the way you expect, be sure to thoroughly test each rule and interactions between rules.

对使用这些过程的方案感兴趣?Interested in scenarios where these procedures are used? 请参阅邮件流规则过程Exchange OnlineSee Mail flow rule procedures in Exchange Online

在开始之前,您需要知道什么?What do you need to know before you begin?

提示

是否有任何疑问?Having problems? 在 Exchange 论坛中寻求帮助。Ask for help in the Exchange forums. 请访问以下论坛Exchange Online或Exchange Online Protection。Visit the forums at Exchange Online or Exchange Online Protection.

创建邮件流规则Create a mail flow rule

您可以通过在邮件流策略中仅设置"数据丢失防护" (DLP) 策略 (邮件Exchange Online规则;不在独立 EOP) 、创建新规则或复制规则。You can create a mail flow rule by setting up a Data Loss Prevention (DLP) policy (in Exchange Online only; not in standalone EOP), creating a new rule, or by copying a rule. 可以使用 EAC Exchange或 PowerShell () 管理中心。You can use the Exchange admin center (EAC) or PowerShell.

备注

创建或修改邮件流规则后,在某些情况下,可能需要 30 分钟或更多的时间,才能将新的或更新的规则应用于电子邮件。After you create or modify a mail flow rule, it can take up to 30 minutes or more in some cases for the new or updated rule to be applied to email.

使用 DLP 策略创建邮件流规则Use a DLP policy to create mail flow rules

备注

本节不适用于独立 EOP 组织。This section does not apply to standalone EOP organizations.

每个 DLP 策略都是邮件流规则的集合。Each DLP policy is a collection of mail flow rules. 创建 DLP 策略后,可以使用下面的过程微调规则。After you create the DLP policy, you can fine-tune the rules using the procedures below.

  1. 创建 DLP 策略。Create a DLP policy.
  2. 修改 DLP 策略创建的邮件流规则。Modify the mail flow rules created by the DLP policy.

使用 EAC 创建邮件流规则Use the EAC to create a mail flow rule

EAC 允许您通过使用模板、复制现有规则或从头开始创建邮件流规则。The EAC allows you to create mail flow rules by using a template, copying an existing rule, or from scratch.

  1. Go to Mail flow > Rules.Go to Mail flow > Rules.

  2. 使用下列选项之一创建规则:Create the rule by using one of the following options:

    • 若要从模板创建规则,请单击" 添加添加  图标" 并选择模板。To create a rule from a template, click Add Add Icon and select a template.
    • 若要复制规则,请选择该规则,然后选择复制 复制  图标 To copy a rule, select the rule, and then select Copy Copy Icon.
    • 若要从头开始创建新规则,请 添加"添加  图标 ",然后选择"创建新规则"。To create a new rule from scratch, Add Add Icon and then select Create a new rule.
  3. "新建 规则"对话框中,命名规则,然后选择此规则的条件和操作:In the New rule dialog box, name the rule, and then select the conditions and actions for this rule:

    1. "应用此规则的条件..." 中,从可用条件列表中选择想要的条件。In Apply this rule if..., select the condition you want from the list of available conditions.

      • 某些条件要求您指定值。Some conditions require you to specify values. 例如,如果您选择" 发件人为..." 条件,则必须指定发件人地址。For example, if you select The sender is... condition, you must specify a sender address. 如果要添加单词或短语,请注意不允许尾部空格。If you're adding a word or phrase, note that trailing spaces are not allowed.
      • 如果未列出所需的条件,或者如果您需要添加例外,请选择"更多 选项"。If the condition you want isn't listed, or if you need to add exceptions, select More options. 将列出其他条件和例外。Additional conditions and exceptions will be listed.
      • 如果不想指定条件,并且希望此规则应用于组织的每封邮件,请选择 "[应用于所有邮件]" 条件。If you don't want to specify a condition, and want this rule to apply to every message in your organization, select [Apply to all messages] condition.
    2. "执行以下操作..." 中,从可用操作列表中选择您希望规则对匹配条件的邮件采取的操作。In Do the following..., select the action you want the rule to take on messages matching the criteria from the list of available actions.

      • 某些操作将要求您指定值。Some of the actions will require you to specify values. 例如,如果您选择" 将邮件转发给..." 条件,则需要在组织中选择一个收件人。For example, if you select the Forward the message for approval to... condition, you will need to select a recipient in your organization.
      • 如果未列出您想要的条件,请选择"更多 选项"。If the condition you want isn't listed, select More options. 将列出其他条件。Additional conditions will be listed.
    3. 指定此规则的规则匹配数据的显示方式在 DLP ( 邮件) 中的数据丢失防护中Specify how rule match data for this rule is displayed in the Data Loss Prevention (DLP) reports and the Mail protection reports.

      "使用严重性级别审核 此规则"下,选择一个级别以指定此规则的严重性级别。Under Audit this rule with severity level, select a level to specify the severity level for this rule. 邮件流规则组规则的活动报告按严重性级别匹配。The activity reports for mail flow rules group rule matches by severity level. 严重性级别只是使报告更易于使用的筛选器。Severity level is just a filter to make the reports easier to use. 严重性级别对处理规则的优先级没有影响。The severity level has no impact on the priority in which the rule is processed.

      备注

      如果您清除“使用以下严重性级别审核此规则”复选框,则规则匹配不会显示在规则报告中。If you clear the Audit this rule with severity level checkbox, rule matches will not show up in the rule reports.

    4. 设置规则的模式。Set the mode for the rule. 可以使用两种测试模式之一测试规则,而不会影响邮件流。You can use one of the two test modes to test the rule without impacting mail flow. 在两种测试模式中,当满足条件时,会向邮件跟踪添加一个条目。In both test modes, when the conditions are met, an entry is added to the message trace.

      • 强制:这将启用规则,并立即开始处理邮件。Enforce: This turns on the rule and it starts processing messages immediately. 将执行有关此规则的所有操作。All actions on the rule will be performed.
      • 使用 策略 使用技巧测试:这将启用规则,并且将发送任何策略提示操作 ( 使用策略 提示通知发件人) ,但不会执行与邮件传递相关的操作。Test with Policy Tips: This turns on the rule, and any Policy Tip actions ( Notify the sender with a Policy Tip) will be sent, but no actions related to message delivery will be performed. 需要数据丢失 (DLP) 才能使用此模式。Data Loss Prevention (DLP) is required in order to use this mode. 要了解详细信息,请参阅策略提示To learn more, see Policy Tips.
      • 不带策略使用技巧 测试:将仅强制执行"生成事件报告"操作。Test without Policy Tips: Only the Generate incident report action will be enforced. 不执行与邮件传递相关的操作。No actions related to message delivery are performed.
  4. 如果您对规则感到满意,请转到步骤 5。If you are satisfied with the rule, go to step 5. 如果要添加更多条件或操作,或者希望指定例外或设置其他属性,请单击"更多 选项"。If you want to add more conditions or actions, or if you want to specify exceptions or set additional properties, click More options. 单击" 更多选项" 后,填写以下字段以创建规则:After you click More options, complete the following fields to create your rule:

    1. 要添加更多条件,请单击“添加条件”。To add more conditions, click Add condition. 如果你有多个条件,可以通过单击其旁边的"删除 X" 来删除其中任何一个条件。If you have more than one condition, you can remove any one of them by clicking Remove X next to it. 请注意,单击"更多选项"后,可以使用更多 条件Note that there are a larger variety of conditions available once you click More options.

    2. 要添加更多操作,请单击“添加操作”。To add more actions, click Add action. 如果具有多个操作,可以通过单击其旁边的"删除 X" 来删除其中任何一个操作。If you have more than one action, you can remove any one of them by clicking Remove X next to it. 请注意,单击"更多选项"后,可以使用更多 操作Note that there are a larger variety of actions available once you click More options.

    3. 若要指定例外,请单击" 添加例外", 然后使用" 例外条件 ..."下拉列表选择例外。To specify exceptions, click Add exception, then select exceptions using the Except if... dropdown. 可以通过单击规则旁边的"删除 X"来从规则中删除 任何例外。You can remove any exceptions from the rule by clicking the Remove X next to it.

    4. 如果希望此规则在特定日期后生效,请单击"在下列日期激活此规则 :"并指定 日期。If you want this rule to take effect after a certain date, click Activate this rule on the following date: and specify a date. 请注意,规则仍在该日期之前启用,但不会得到处理。Note that the rule will still be enabled prior to that date, but it won't be processed.

      同样,您可以使规则在特定日期停止处理。Similarly, you can have the rule stop processing at a certain date. 为此,请单击" 在下列日期停用 此规则:"并指定日期。To do so, click Deactivate this rule on the following date: and specify a date. 请注意,该规则将保持启用状态,但它不会得到处理。Note that the rule will remain enabled, but it won't be processed.

    5. 可以选择避免在此规则处理邮件后应用其他规则。You can choose to avoid applying additional rules once this rule processes a message. 为此,请单击"停止处理更多规则"。To do so, click Stop processing more rules. 如果选择此选项,并且此规则处理了邮件,则不处理该邮件的后续规则。If you select this, and a message is processed by this rule, no subsequent rules are processed for that message.

    6. 如果无法完成规则处理,可以指定邮件的处理方式。You can specify how the message should be handled if the rule processing can't be completed. 默认情况下,将忽略该规则,并定期处理邮件,但您可以选择重新提交邮件进行处理。By default, the rule will be ignored and the message will be processed regularly, but you can choose to resubmit the message for processing. 为此,请选中" 如果规则处理无法完成, 则延迟邮件"复选框。To do so, check the Defer the message if rule processing doesn't complete check box.

    7. 如果规则分析发件人地址,则默认情况下仅检查邮件头。If your rule analyzes the sender address, it only examines the message headers by default. 但是,您可以将规则配置为同时检查 SMTP 邮件信封。However, you can configure your rule to also examine the SMTP message envelope. 若要指定检查内容,请单击"匹配邮件中的发件人地址 "的下列值之一To specify what's examined, click one of the following values for Match sender address in message:

      • :仅检查邮件头。Header: Only the message headers will be examined.
      • 信封:仅检查 SMTP 邮件信封。Envelope: Only the SMTP message envelope will be examined.
      • 头或信封:检查邮件头和 SMTP 邮件信封。Header or envelope: Both the message headers and SMTP message envelope will be examined.
    8. 您可以在"注释"框中向此规则 添加 注释。You can add comments to this rule in the Comments box.

  5. 请单击“保存”完成规则的创建。Click Save to complete creating the rule.

使用 Exchange Online PowerShell 创建邮件流规则Use Exchange Online PowerShell to create a mail flow rule

此示例使用 New-TransportRule cmdlet 创建一个新邮件流规则,该规则将""预置从组织外部发送到 External message to Sales DG: 销售部门通讯组的邮件。This example uses the New-TransportRule cmdlet to create a new mail flow rule that prepends "External message to Sales DG:" to messages sent from outside the organization to the Sales Department distribution group.

New-TransportRule -Name "Mark messages from the Internet to Sales DG" -FromScope NotInOrganization -SentTo "Sales Department" -PrependSubject "External message to Sales DG:"

以上过程中使用的规则参数和操作仅用于说明。The rule parameters and action used in the above procedure are for illustration only. 查看所有可用的邮件流规则条件和操作,以确定哪些条件符合您的要求。Review all the available mail flow rule conditions and actions to determine which ones meet your requirements.

如何判断是否生效?How do you know this worked?

若要验证是否成功创建了新的邮件流规则,请执行下列操作:To verify that you have successfully created a new mail flow rule, do the following:

  • 在 EAC 中,验证您创建的新邮件流规则是否列在"规则 "列表中。In the EAC, verify that the new mail flow rule you created is listed in the Rules list.

  • 从 Exchange Online PowerShell 中,通过运行以下命令验证是否成功创建了新邮件流规则 (下面的示例验证在 Exchange Online PowerShell 示例中创建的规则是否) :From Exchange Online PowerShell, verify that you created the new mail flow rule successfully by running the following command (the example below verifies the rule created in Exchange Online PowerShell example above):

    Get-TransportRule "Mark messages from the Internet to Sales DG"
    

查看或修改邮件流规则View or modify a mail flow rule

备注

创建或修改邮件流规则后,可能需要 30 分钟甚至更多时间,才能将新的或更新的规则应用于电子邮件。After you create or modify a mail flow rule, it can take up to 30 minutes and more in some case for the new or updated rule to be applied to email.

使用 EAC 查看或修改邮件流规则Use the EAC to view or modify a mail flow rule

  1. In the EAC, go to Mail flow > Rules.In the EAC, go to Mail flow > Rules.
  2. 当您在列表中选择某个规则时,该规则的条件、操作、例外和选择属性将显示在详细信息窗格中。When you select a rule in the list, the conditions, actions, exceptions and select properties of that rule are displayed in the details pane. 若要查看特定规则的所有属性,请双击它。To view all the properties of a specific rule, double click it. 这将打开规则编辑器窗口,您可以在其中更改规则。This opens the rule editor window, where you can make changes to the rule. 有关规则属性详细信息,请参阅本文前面使用 EAC 创建邮件流规则部分。For more information about rule properties, see Use the EAC to create a mail flow rule section, earlier in this article.

使用 Exchange Online PowerShell 查看或修改邮件流规则Use Exchange Online PowerShell to view or modify a mail flow rule

以下示例提供了组织中配置的所有规则的列表:The following example gives you a list of all rules configured in your organization:

Get-TransportRule

若要查看特定邮件流规则的属性,请提供该规则的名称或它的 GUID。To view the properties of a specific mail flow rule, you provide the name of that rule or its GUID. 将输出发送到 Format-List cmdlet 以设置属性格式通常很有帮助。It is usually helpful to send the output to the Format-List cmdlet to format the properties. 下面的示例返回名为 Sender 的邮件流规则的所有属性,该规则是 Marketing 的成员:The following example returns all the properties of the mail flow rule named Sender is a member of Marketing:

Get-TransportRule "Sender is a member of marketing" | Format-List

若要修改现有规则的属性,请使用 Set-TransportRule cmdlet。To modify the properties of an existing rule, use the Set-TransportRule cmdlet. 此 cmdlet 允许您更改与规则关联的任何属性、条件、操作或异常。This cmdlet allows you to change any property, condition, action or exception associated with a rule. 以下示例向规则"Sender is a member of marketing"添加例外,以便它不适用于用户 Kelly Rollin 发送的邮件:The following example adds an exception to the rule "Sender is a member of marketing" so that it won't apply to messages sent by the user Kelly Rollin:

Set-TransportRule "Sender is a member of marketing" -ExceptIfFrom "Kelly Rollin"

如何判断是否生效?How do you know this worked?

若要验证您是否已成功修改邮件流规则,请执行下列操作:To verify that you have successfully modified a mail flow rule, do the following:

  • 在 EAC 中的规则列表中,单击在"规则"列表中修改的规则并查看详细信息窗格。From the rules list in the EAC, click the rule you modified in the Rules list and view the details pane.

  • 从 Exchange Online PowerShell 中,通过运行以下命令列出您修改的属性以及规则名称来验证是否成功修改了邮件流规则 (下面的示例验证在 Exchange Online PowerShell 示例中修改的规则) :From Exchange Online PowerShell, verify that you modified the mail flow rule successfully by running the following command to list the properties you modified along with the name of the rule (the example below verifies the rule modified in Exchange Online PowerShell example above):

    Get-TransportRule "Sender is a member of marketing" | Format-List Name,ExceptIfFrom
    

邮件流规则属性Mail flow rule properties

您还可以使用 Set-TransportRule cmdlet 修改组织中现有的邮件流规则。You can also use the Set-TransportRule cmdlet to modify existing mail flow rules in your organization. 以下是在 EAC 中不可用的列表属性,您可以更改这些属性。Below is a list properties not available in the EAC that you can change. 有关使用 Set-TransportRule cmdlet 进行这些更改的信息,请参阅 Set-TransportRuleFor more information on using the Set-TransportRule cmdlet to make these changes see Set-TransportRule



EAC 中的条件名称Condition Name in the EAC PowerShell 中Exchange Online名称Condition name in Exchange Online PowerShell 说明Description
停止处理规则Stop Processing Rules StopRuleProcessingStopRuleProcessing 使您可以停止处理其他规则Enables you to stop processing additional rules
页眉/信封匹配Header/Envelope matching SenderAddressLocationSenderAddressLocation 使您可以检查 SMTP 邮件信封以确保邮件头和邮件头匹配Enables you to examine the SMTP message envelope to ensure the header and envelop match
审核严重性Audit severity SetAuditSeveritySetAuditSeverity 使您可以选择审核的严重性级别Enables you to select a severity level for the audit
规则模式Rule modes ModeMode 用于设置规则模式Enables you to set the mode for the rule

设置邮件流规则的优先级Set the priority of a mail flow rule

首先处理列表顶部的规则。The rule at the top of the list is processed first. 此规则的 优先级为 0。This rule has a Priority of 0.

使用 EAC 设置规则的优先级Use the EAC to set the priority of a rule

  1. In the EAC, go to Mail flow > Rules.In the EAC, go to Mail flow > Rules. 这将按规则处理的顺序显示规则。This displays the rules in the order in which they are processed.
  2. 选择一个规则,然后使用箭头将规则上移或下移列表。Select a rule, and use the arrows to move the rule up or down the list.

使用 Exchange Online PowerShell 设置规则的优先级Use Exchange Online PowerShell to set the priority of a rule

以下示例将"Sender is a member of Marketing"的优先级设置为 2:The following example sets the priority of "Sender is a member of Marketing" to 2:

Set-TransportRule "Sender is a member of Marketing" -Priority "2"

如何判断是否生效?How do you know this worked?

若要验证您是否已成功修改邮件流规则,请执行下列操作:To verify that you have successfully modified a mail flow rule, do the following:

  • 在 EAC 中的规则列表中,查看规则的顺序。From the rules list in the EAC, look at the order of the rules.

  • 在 Exchange Online PowerShell 中,验证规则的优先级 (以下示例验证在 Exchange Online PowerShell 示例中修改的规则) :From Exchange Online PowerShell, verify the priority of the rules (the example below verifies the rule modified in Exchange Online PowerShell example above):

    Get-TransportRule * | Format-List Name,Priority
    

启用或禁用邮件流规则Enable or disable a mail flow rule

创建规则时将启用这些规则。Rules are enabled when you create them. 可以禁用邮件流规则。You can disable a mail flow rule.

使用 EAC 启用或禁用邮件流规则Use the EAC to enable or disable a mail flow rule

  1. In the EAC, go to Mail flow > Rules.In the EAC, go to Mail flow > Rules.
  2. 若要禁用规则,请清除其名称旁边的复选框。To disable a rule, clear the check box next to its name.
  3. 若要启用已禁用的规则,请选中其名称旁边的复选框。To enable a disabled rule, select the check box next to its name.

使用 Exchange Online PowerShell 启用或禁用邮件流规则Use Exchange Online PowerShell to enable or disable a mail flow rule

以下示例禁用邮件流规则"Sender is a member of marketing":The following example disables the mail flow rule "Sender is a member of marketing":

Disable-TransportRule "Sender is a member of marketing"

以下示例启用邮件流规则"Sender is a member of marketing":The following example enables the mail flow rule "Sender is a member of marketing":

Enable-TransportRule "Sender is a member of marketing"

如何判断是否生效?How do you know this worked?

若要验证您是否已成功启用或禁用邮件流规则,请执行下列操作:To verify that you have successfully enabled or disabled a mail flow rule, do the following:

  • 在 EAC 中,查看"规则"列表中的 规则列表, 并检查 "打开 "列中复选框的状态。In the EAC, view the list of rules in the Rules list and check the status of the check box in the ON column.

  • 从 Exchange Online PowerShell 中,运行以下命令,该命令将返回组织中所有规则的列表及其状态:From Exchange Online PowerShell, run the following command which will return a list of all rules in your organization along with their status:

    Get-TransportRule | Format-Table Name,State
    

删除邮件流规则Remove a mail flow rule

使用 EAC 删除邮件流规则Use the EAC to remove a mail flow rule

  1. In the EAC, go to Mail flow > Rules.In the EAC, go to Mail flow > Rules.
  2. 选择要删除的规则,然后单击" 删除删除"  图标 Select the rule you want to remove and then click Delete Delete icon.

使用 Exchange Online PowerShell 删除邮件流规则Use Exchange Online PowerShell to remove a mail flow rule

以下示例删除邮件流规则"Sender is a member of marketing":The following example removes the mail flow rule "Sender is a member of marketing":

Remove-TransportRule "Sender is a member of marketing"

如何判断是否生效?How do you know this worked?

若要验证是否成功删除了邮件流规则,请执行下列操作:To verify that you have successfully removed the mail flow rule, do the following:

  • 在 EAC 中,查看"规则"列表中的规则,并验证已删除的规则是否不再显示。In the EAC, view the rules in the Rules list and verify that the rule you removed is no longer shown.

  • 在 Exchange Online PowerShell 中,运行以下命令并验证您删除的规则是否不再列出:From Exchange Online PowerShell, run the following command and verify that the rule you remove is no longer listed:

    Get-TransportRule
    

监视规则使用情况Monitor rule usage

如果您正在使用 Exchange Online 或 Exchange Online Protection,您可以通过使用规则报告来检查每一条规则的匹配次数。If you're using Exchange Online or Exchange Online Protection, you can check the number of times each rule is matched by using a rules report. 为了包含在报告中,必须选中规则的“使用以下严重性级别审核此规则”复选框。In order to be included in the reports, a rule must have the Audit this rule with severity level check box selected. 您可以联机查看报告,或下载所有Excel保护报告的最新版本。You can look at a report online, or download an Excel version of all the mail protection reports.

备注

虽然大部分数据会在 24 小时内出现在报告中,但有些数据可能需要长达 5 天才会出现。While most data is in the report within 24 hours, some data may take as long as 5 days to appear.

使用安全&合规中心查看规则报告Use the Security & Compliance Center to view a rules report

  1. 在安全 与&中心中,选择"报告仪表板 > "。In the Security & Compliance Center, select Reports > Dashboard.
  2. 然后选择 "Exchange规则"。Then select Exchange transport rule.

若要了解更多信息,请参阅 在安全与合规中心&邮件流报告To learn more, see View mail flow reports in the Security & Compliance Center.

下载Excel的最新版本Download an Excel version of the reports

有关下载报告的步骤,请参阅在安全与合规中心 &报告For steps to download reports, see Download existing reports in the Security & Compliance Center.

导入或导出邮件流规则集合Import or export a mail flow rule collection

必须使用 PowerShell Exchange Online或导出邮件流规则集合。You must use Exchange Online PowerShell to import or export a mail flow rule collection. 若要了解如何从 XML 文件导入邮件流规则集合,请参阅 Import-TransportRuleCollectionFor information about how to import a mail flow rule collection from an XML file, see Import-TransportRuleCollection.

若要了解如何将邮件流规则集合导出到 XML 文件,请参阅 Export-TransportRuleCollectionFor information about how to export a mail flow rule collection to an XML file, see Export-TransportRuleCollection.

需要更多帮助吗?Need more help?

Exchange Online 中的邮件流规则(传输规则)Mail flow rules (transport rules) in Exchange Online

Exchange Online 中的邮件流规则条件和例外(谓词)Mail flow rule conditions and exceptions (predicates) in Exchange Online

Exchange Online 中的邮件流规则操作Mail flow rule actions in Exchange Online

日记、传输和收件箱规则限制Journal, transport, and inbox rule limits