Google Message Security for Google Apps Administration Guide - Manual (Page 263)

Approved and Blocked Sender Lists 263
The batch-command syntax to remove an address or domain from an approved/
blocked sender list is as follows:
modifyorg ORGNAME, approved_senders=-DOMAIN_OR_ADDRESS
or
modifyuser USER_ADDRESS, blocked_senders=-DOMAIN_OR_ADDRESS
Addresses or domains can be added and removed within one batch command.
Each address or domain needs its own operator (
+ or - ). Omitting the operator
adds the address or domain. You must escape each comma ( , ) in the list with a
backlash ( \ ).
The following example adds angel.com and investor.com to the HugeISP
organization-level approved sender list, and removes funds.com :
modifyorg HugeISP, approved_senders=+angel.com\,-funds.com\,
investor.com
Deciding Which Approved Senders to Add
Since adding an Approved Sender effectively allows traffic through filters, you
should be cautious when deciding which addresses and domains to add to your
Approved Senders list. Spammers can easily send emails that falsify the sender
address to take advantage of any such configuration.
You should add addresses or domains that send messages that often look like
spam but are not. Following is a process you can use to determine when to add
an address/domain to your Approved Senders list:
1. Use the Quarantine Delivery Activity Log to find message trends:
a. Go to Orgs and Users > Orgs.
b. Select an organization from the list
c. Click Reports.
d. Click Quarantine Delivery > Activity Log.
e. Click the link to either the daily or weekly log.
f. Look for trends in messages that have been delivered by your users. (For
example, look for multiple emails from the same sender, same sender
domain, or same subject.)
ORGNAME The name or IID of the organization associated with the
approved/blocked sender list
USER_ADDRESS The address of the user associated with the approved/
blocked sender list
ADDRESS_OR_DOMAIN The domain or email address to remove