You can now write your own blocking rules for Cloudflare Email Security!

Hi, it's Shii! Today I'm sharing some news from the Cloudflare Changelog. It's an update to email security that lets you block messages by matching your own organization's specific dangerous phrases. Let's take a look!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, a new "Blocked content" area has been added under Policies & rules in Email security. This lets administrators create their own content-based blocking rules.

Creating a rule is simple: you can choose either a plain-text string match or a regular expression. This makes it possible to specifically target things like ongoing phishing campaigns, known-bad phrases, or content patterns unique to your organization.

Why it matters

Email security rules have generally relied on built-in detection logic. But in practice, every organization runs into its own specific danger patterns, like a particular scam phrasing that keeps showing up in emails sent to your company.

Being able to define your own conditions to block those organization-specific threats fills a gap that generic detection alone can't cover. It looks like a small feature, but Shii thinks it's genuinely practical.

What changes

With Blocked content rules, security teams can spot suspicious trends in the emails their organization receives and add a rule on the spot. If you notice a specific campaign or a recurring scam message, you don't have to wait for a generic rule update, you can block it yourselves right away.

Matching messages get marked with a malicious disposition and are stopped before they reach a user's inbox. Being able to shut dangerous emails out before anyone even sees them is reassuring.

Dive Deep

Let's look at the details a bit more closely!

• Matching methods: choose either a plain-text string match or a regular expression
• Search location: for each rule, choose whether to search the subject, the body, or subject and body
• Built-in validation: before saving, you can test your pattern against sample text with the built-in regular expression checker, so you can confirm it matches what you expect and avoid false positives
• What happens on a match: messages that match get a malicious disposition and are blocked from reaching users' inboxes

As for actions, only the block action is currently supported. There may be more action types down the line, but for now it's block only.

Blocked content rules are available on these plans:

• Email security Enterprise
• Email security Enterprise + PhishGuard

Wrap-up

• Cloudflare Email security added "Blocked content" rules
• You can match on the subject, body, or both, using either plain text or a regular expression
• You can test your pattern with the built-in regex checker before saving, which helps avoid false positives
• Matching emails get a malicious disposition and are blocked (only the block action is supported for now)
• Available on the Enterprise and Enterprise + PhishGuard plans

If you're on a Cloudflare Email security Enterprise plan and dealing with a recurring phishing pattern aimed at your company, this one's for you!