How to Configure Email Filtering Policies in Proofpoint

Email filtering is the first line of defense against spam, phishing, and malicious content reaching your users. Proofpoint provides a powerful rules engine that allows administrators to create custom filtering policies tailored to their organization's security requirements.

Prerequisites

Before configuring email filtering policies, ensure you have:

• Administrator access to the Proofpoint Essentials console
• Understanding of your organization's email flow and security requirements
• List of trusted domains and known malicious patterns
• Defined security policies for handling suspicious emails

Understanding Proofpoint Filter Architecture

Proofpoint filters operate on a conditions-and-actions model:

Component	Description
Conditions	Criteria that trigger the filter (sender, subject, content, etc.)
Actions	What happens when conditions are met (quarantine, allow, notify)
Scope	Who the filter applies to (company, group, or user)
Direction	Whether the filter applies to inbound or outbound mail

Step 1: Access Filter Policies

1. Log in to the Proofpoint Essentials Admin Console
2. Navigate to Security Settings in the left sidebar
3. Click on Email
4. Select Filter Policies
5. You'll see tabs for Inbound and Outbound filters

Step 2: Create a New Inbound Filter

Basic Filter Setup

1. Click the Inbound tab
2. Click New Filter to create a new policy
3. Enter a descriptive Filter Name (e.g., "Block Suspicious Attachments")
4. Ensure Direction is set to Inbound
5. Click Continue to open the filter definition page

Define Filter Scope

Choose who this filter applies to:

• Company - Applies to all users in your organization
• Group - Applies to specific groups (e.g., Finance, Executives)
• User - Applies to individual email addresses

Best Practice: Start with company-wide filters for broad security rules, then create group or user-specific filters for targeted policies.

Configure Conditions

1. Click Add Condition to define when the filter triggers
2. Select a condition type from the dropdown:

Condition Type	Use Case
From Address	Filter based on sender email
From Domain	Filter entire sending domains
Subject Contains	Match specific subject line text
Header Contains	Match email header values
Attachment Name	Filter by attachment filename
Attachment Type	Block specific file types
Client IP	Filter by sending server IP
Client IP Country	Block emails from specific countries

3. Set the condition value (e.g., attachment type "is" executable)
4. Click Add Another Condition to combine multiple criteria

Set Filter Actions

1. Choose the Primary Action:

   • Quarantine - Hold the message for admin or user review
   • Allow - Deliver the message (use with secondary actions)
   • Reject - Permanently block the message
   • Nothing - Process secondary actions only

2. Configure Secondary Actions as needed:

   • Notify Recipient - Send notification about the filtered message
   • Notify Admin - Alert administrators
   • Add Header - Insert custom headers for downstream processing
   • Tag Subject - Prepend text to the subject line

3. Check Override Previous Destination if this filter should take priority

4. Check Stop Processing Additional Filters to prevent further rule evaluation

5. Click Save to activate the filter

Step 3: Create Common Security Filters

Block Executable Attachments

This filter quarantines emails with potentially dangerous file types:

1. Create a new inbound filter named "Block Executables"
2. Set scope to Company
3. Add condition: Attachment Type is Executable
4. Add condition: Attachment Type is Script
5. Set action: Quarantine with Require Admin Privileges to Release

Block Emails from Specific Countries

Filter emails originating from high-risk geographic regions:

1. Create a new inbound filter named "Geo IP Block"
2. Set scope to Company
3. Add condition: Client IP Country is [Select Country]
4. Set action: Quarantine
5. Enable Require Admin Privileges to Release

Block HTML Attachments

HTML attachments are commonly used in phishing attacks:

1. Create a new inbound filter named "Block HTML Files"
2. Add condition: Attachment Type is HTML
3. Set action: Quarantine

Note: You may need to add exceptions for legitimate business partners who send HTML attachments, such as certain financial institutions.

Quarantine Impersonation Attempts

Protect against business email compromise:

1. Create a new inbound filter named "Impersonation Protection"
2. Add condition: From Name Contains [Executive Names]
3. Add condition: From Domain is not [Your Domain]
4. Set action: Quarantine with admin notification

Step 4: Create Outbound Filters

Outbound filters help enforce compliance and prevent data leakage:

1. Click the Outbound tab
2. Click New Filter
3. Name the filter (e.g., "Encrypt Sensitive Data")
4. Set scope as appropriate

Trigger Encryption Based on Subject

1. Add condition: Subject Contains "[ENCRYPT]" or "[SECURE]"
2. Set action: Encrypt Message
3. This allows users to trigger encryption by including keywords in subject lines

Block Large Attachments

1. Add condition: Attachment Size is greater than 25 MB
2. Set action: Reject or Notify Sender

Step 5: Manage Filter Priority

Filter order matters because Proofpoint evaluates rules sequentially:

1. In the Filter Policies list, use drag-and-drop to reorder filters
2. Place more specific filters higher in the list
3. Place broad catch-all filters lower

Processing Order Example:

Priority	Filter	Description
1	Allow VIP Partners	Whitelist trusted senders
2	Block Known Threats	Quarantine identified threats
3	Block Geo IP	Filter by country
4	General Spam Filter	Catch remaining spam

Step 6: Test Your Filters

Before deploying filters organization-wide:

1. Create the filter with User scope targeting a test account
2. Send test emails that should trigger the filter
3. Verify the expected action occurs (check quarantine, delivery, etc.)
4. Review the Logs section to confirm filter activation
5. Adjust conditions as needed
6. Expand scope to groups, then company-wide

Troubleshooting Filter Issues

Filter Not Triggering

Symptoms: Emails that should be filtered are being delivered.

Solutions:

1. Verify the filter is enabled (toggle should be ON)
2. Check filter scope matches the affected users
3. Review conditions for typos or incorrect operators
4. Ensure the filter isn't being overridden by a higher-priority rule
5. Check if the sender is on a Safe Senders list

Too Many False Positives

Symptoms: Legitimate emails are being quarantined.

Solutions:

1. Review quarantined messages to identify patterns
2. Add exceptions for trusted senders or domains
3. Refine conditions to be more specific
4. Consider using Allow action for known-good patterns before the blocking rule

Filter Processing Issues

Symptoms: Inconsistent filter behavior or delays.

Solutions:

1. Review filter priority order
2. Remove redundant or conflicting rules
3. Simplify complex filter chains
4. Contact Proofpoint support if issues persist

Best Practices for Email Filtering

1. Document your filters - Maintain a record of all filter rules and their purposes
2. Review regularly - Audit filters quarterly to remove outdated rules
3. Monitor quarantine - Check quarantined messages daily for false positives
4. Layer defenses - Combine filters with sender lists and other security features
5. Train users - Educate staff about what filtered emails look like
6. Test before deploying - Always test new filters with limited scope first

Next Steps

After configuring email filtering:

1. Set up sender lists - Configure safe senders and block lists
2. Enable URL Defense - Protect against malicious links
3. Configure DLP - Prevent data loss
4. Review quarantine - Learn quarantine management

Additional Resources

• Proofpoint Essentials Help Portal
• Creating Custom Filters Documentation

---

Need help optimizing your Proofpoint email security? Inventive HQ provides expert Proofpoint configuration and management services. Contact us for a free security assessment.