Additional Information
Video Transcript
This video is going to give you an overview of premium email filtering in the Proofpoint portal. The quickest way to get into the Proofpoint portal, is to go into your LuxSci administration area, and click on the link right here. This takes you to the Proofpoint login. Enter your user name and password and log in.
Here is the administrative interface to Proofpoint. You have logs, users, and reports across the top, and subsections of these areas below.
Adding a New Domain
Often, when you add a new domain to your LuxSci system and it gets added to Proofpoint, you're going to have to verify the domain. This is a security measure to make sure that you only get email that is for domains that you actually own. In Proofpoint, click on the domain. Click on the pending domain pencil, to edit it. Go down here, make sure, "Verify via text record" is enabled, and see your verification code. Copy that. Put that into your DNS as a text record. Save your DNS settings. Come back here, and click "Verify Now," once it's all done and your DNS settings have had time to propagate. Now your domain has been verified and it will start receiving email within the next 30 minutes.
You should note that it takes up to 30 minutes for any changes in the Proofpoint portal to take effect. Currently, they take effect at the top and the bottom of every hour. For example, 1:00 and 1:30, 2:00 and 2:30.
Account-wide Settings
There are a number of account wide settings that you can configure, here underneath company settings. First, under filters, you can set up one off filters that control the flow of your inbound email through the filtering system. I click on that, you can create new filters that do things such as mastering types of attachments and then quarantine or block them, etc. Use this whenever you need something special to happen to your mail.
Even more useful than filters for everybody, are sender lists. Here, you can specific email addresses, domains, and IP addresses of people you never want to receive email from, people who are harassing you or known spammers. Even more importantly, you can exempt from SPAM filtering, certain domains, email addresses, and IP addresses. This is particularly important, for example, for allow listing your own servers, so that your own companies email does not get caught in SPAM filters.
If you use the URL defense system, which protects your users from malicious links in email messages, you can configure that here, specifying which domains are exempted, and what to do in the case of malicious URLs.
Click on SPAM, and you can change the thresholds for your SPAM filters, and what happens when messages are marked as SPAM.
Under Digest, you can control what happens with your SPAM quarantine digest email messages. In general, these are messages that your emails receive daily, that list all of the messages that are currently in their quarantine. Two settings commonly changed by administrators are if digests are received at all, and if messages that were previously sent to digests are also included in new digests. For example, do you only want to see recent SPAM from the last day in the digest, or do you want to see all quarantine messages that are in the queue, perhaps back for 30 days? You can also change how frequently these digests are sent, and what time they're sent, and how long your email messages are kept in the quarantine.
Users and Aliases
Users and Aliases are fundamental to the functionality of Proofpoint. Users correspond to actually physical people or addresses in your domains users on LuxSci. Aliases are other addresses that forward to that same user. For example, if your name is Joe or Joe Smith, you may have multiple addresses with similar variations of your name, one of which is your actual address, and the others are Aliases. Aliases are free, and address, each user, can have any number of Aliases. You can only have a number of users equal to the number of premium email filtering licenses you have purchased from LuxSci. So you have to be a little bit stingy with users. Each user, when you click on it, can have his own SPAM settings, digest settings, and other types of individual filters. They also have their own emergency inbox and separate reports. You can go into the Aliases tab, here, and add as many Aliases as you want for the particular user.
Functional Accounts are, essentially, users that get filtered for SPAM and viruses, that are good for distribution lists. I.e. addresses that forward to multiple people, or for Aliases that don't forward to an actual user in your account. I.e. an Alias that forwards to somebody else at Gmail or something. You can't log into a Functional Account, it can only be administrated by your main administrator here in Proofpoint.
What about new addresses? New email that comes into Proofpoint will automatically be discovered by the system. This is called SMTP discovery. When email coming into addresses that are not yet defined as users, Aliases, or functional accounts arrives, Proofpoint makes a note of it and filters it like usual. But after certain threshold, typically 10 messages for the same address, Proofpoint "discovers" that address and puts it in the SMTP discovery portal. On every Thursday, your main administrator will be sent an email, listing all of these newly discovered addresses. It's your job to go in, and for any newly discovered address that corresponds to an actual address that you care about, for example, a newly discovered user or Alias, you need to go in here and create a new user, or add the Alias to existing user, or create a Functional Account for that newly discovered address. You can always go into SMTP discovery, here, look at discovered list, and see what's there.
If you do nothing, and let the discovered email addresses languish, then after a few weeks and after a few emailed notices, they will be marked invalid. Essentially, proof point is saying, "Well, If you don't really care about these addresses enough to make any changes, then they must be invalid addresses, things that are really made up and related to SPAM." When that happens, they get converted from discovered list, to an invalid list. Addresses that have been marked "Invalid," have all their email bounced, with an error saying the address is invalid. You will know when that happens, because these address will no longer get new email. If that should happen to you, the solution is the same. You come in here, you remove them from the invalid area, and you add them as a user, an Alias, or a Functional Account. Wait 30 minutes, and the email will start flowing normally.
Logs
Going into the logs area, you can click on a user, and you can search the logs in Proofpoint for any email that went through to that user at any particular time in the last 30 days. So you can see what happened: Did a message arrive? Was it delivered to your email servers? Was it quarantined? What happened to it? You can find out. For email that comes through that's addressed to someone that's not yet a user, an Alias, or Functional Account, you need to use the non-licensed report. Here, you can search for email to these other, essentially, users being discovered and see what happened to that.
