How to Edit Safe and Blocked Sender Lists

Situation – You have identified domains and/or accounts that you would like to bypass spam scanning or go straight to Quarantine.
Solution – Go to Security Settings -> Email -> Sender Lists and enter preferences based on the below options. You can either:

  • Manually add to lists
  • Add directly from logs
  • Edit Functional Account Sender List.

Mail Flow Order

One key thing to note before this is to know the mail flow order. See t his KB on the Mail flow order.

The approve and block sender list are part of the Filters. Some items cannot be bypassed for scanning.

This KB is focused on adding to the sender list. If you need to create a filter, please see this KB: Safelisting Addresses

  1. Navigate to Security Settings -> Email -> Sender Lists.
  2. Both lists are available on this page. On the top is the Blocked Sender List, and the bottom is the Safe Sender List.
    Blocked Senders: Messages from addresses or domains (Only Org Admins can add domains using wild cards) that you include on the Blocked Sender list WILL be quarantined.
    Safe Senders: Messages from addresses or domains (Only Org Admins can add domains using wild cards) that you include on the Safe Sender list WILL NOT be quarantined.
  3. To add addresses (e.g., emailaddress@domain.com, ) or IP addresses to the list, type them in the text box and use a line, comma or semi-colon to separate entries. IP addresses and CIDR notation (e.g., 10.0.62.0/24).
  4. Click Save.

CIDR notation

The Proofpoint Essentials service does not allow any specified CIDR range larger than a /24 network. Alternatively, for a /24, you can use the format: 10.0.0.*

If you need allow a network like: 10.10.0.0/16, you can use the format: 10.10.*.*

Order Within List

We have noted that in the sender list itself, there is a hierarchy. Please see this KB on the filter order hierarchy.

For example, a CIDR block list entry is lower than a safe-listed SMTP address.

Adding From Logs

Adding IPs cannot be done from the logs and has to be manually done via the sender list page itself.

To avoid creating conflicting filters, this action can only be performed if a previous filter was not used.

  1. Under Tools click Log Search.
  2. From the logs page, do your search.
  3. Under Actions, click Details.

clipboard_eed836cb724ffd85318928e1dd505a5a5.png

  1. Depending on what you searched for, drop down menus will appear on certain items
    • Envelope Sender – not the same as the ‘from.’ This is typically used on mailing lists.
    • ‘From’ Header – this is what you see on the from line in the message header
    • Recipient – this is who the message is sent to.
  2. Pending the action you chose, it will open the Sender List page and add to the proper list.

IF THE EMAIL HAS BEEN QUARANTINED IT IS POSSIBLE TO:

  • Allow this address.
  • Allow this domain

IF THE EMAIL ADDRESS HAS BEEN DELIVERED, IT IS POSSIBLE TO:

  • Block this address
  • Block this domain
  1.  Click Save to save your changes.

Users add entries to their sender lists via the digest. Admins can review specific user’s sender lists.

  1. Go to User Management Users
  2. Find the email address in question, and click on it (or the pencil icon).
  3. At the top a new set of items appear. Click Sender Lists.

    clipboard_e25adbb26440d130aeae49e1f9537a4cd.png
  4. The page resembles the Global Sender Lists.
  5. You can add and remove entries as needed at the user level.
  6. Make sure to Save once done editing.


Further articles:

About Sender Lists

Setting Up Sender Lists