How to edit Safe and Blocked Sender Lists

Last updated
Save as PDF

Situation	You have identified domains and/or accounts which you would like to bypass spam scanning or go straight to Quarantine.
Solution	Go to Security Settings -> Email -> Sender Lists and enter preferences based on the below options. You can either: Manually add to lists Add directly from logs Edit Functional Account Sender List.

Situation

You have identified domains and/or accounts which you would like to bypass spam scanning or go straight to Quarantine.

Solution

Go to Security Settings -> Email -> Sender Lists and enter preferences based on the below options. You can either:

Manually add to lists
Add directly from logs
Edit Functional Account Sender List.

Mail flow order

One key thing to note prior to this is to know the mail flow order. See t his KB on the Mail flow order.

The approve and block sender list are part of the Filters. Some items cannot be bypassed for scanning.

Manually Adding to Global Sender lists

This KB is focused on adding to the sender list. If you need to create a filter, please see this KB: Safelisting Addresses

Navigate to Security Settings > Email > Sender Lists.
Both lists are available on this page. On the top is the Blocked Sender List, and the bottom is the Safe Sender List.
Blocked Senders: Messages from addresses or domains that you include on the Blocked Sender list WILL be quarantined.
Safe Senders: Messages from addresses or domains that you include on the Safe Sender list WILL NOT be quarantined.
To add addresses, domains (e.g., *@domain.com, *@*.domain.com) or IP addresses to the list, type them in the text box and use a line, comma or semi-colon to separate entries. IP addresses may contain wildcards (e.g., 10.20.*.20, 10.*.*.*, 10.*.0.*) and CIDR notation (e.g., 10.0.62.0/24).
Click Save.

CIDR notation

The Proofpoint Essentials service does not allow any specified CIDR range larger than a /24 network. Alternatively, for a /24, you can use the format: 10.0.0.*

If you need allow a network like: 10.10.0.0/16, you can use the format: 10.10.*.*

Order within list

We have noted that in the sender list itself, there is a hierarchy. Please see this KB on the filter order hierarchy.

For example, a CIDR block list entry is lower than a safe-listed SMTP address.

Adding from Logs

Adding IPs cannot be done from the logs and has to be manually done via the sender list page itself.

To avoid creating conflicting filters, this action can only be performed if a previous filter was not used.

Under Tools click Log Search.
From the logs page, do your search.
Under Actions, click Details.

Depending on what you searched for, drop down menus will appear on certain items
- Envelope Sender - not the same as the 'from.' This is typically used on mailing lists.
- 'From' Header - this is what you see on the from line in the message header
- Recipient - this is who the message is sent to.
Pending the action you chose, it will open the Sender List page and add to the proper list.

If the email has been Quarantined it is possible to:

Allow this address.
Allow this domain

If the email address has been delivered, it is possible to:

Block this address
Block this domain

Click Save to save your changes.

Users add entries to their sender lists via the digest. Admins can review specific user's sender lists.

Go to User Management > Users
Find the email address in question, and click on it (or the pencil icon).
At the top a new set of items appear. Click Sender Lists.
The page resembles the Global Sender Lists.
You can add and remove entries as needed at the user level.
Make sure to Save once done editing.

Functional Account Sender List

By design, functional accounts receive digests. If any user associated with the functional account receives a digest, they add to the list when pressing the associated action. Unfortunately, this is a hidden item, and this process below requires a manual process to reach the edit mode of the Functional Account Sender list.

Since this is all manual, here is example information to use:

Example Stack: US1

Customer ID: 789

User ID: 123

Functional Account ID: 456

A standard user has this URL: https://us1.proofpointessentials.com...accounts&u_id=123&fa=pr
A direct user's sender list looks like this: https://us1.proofpointessentials.com/i/789/users-and-groups/users/123/sender-lists

From the User Sender List section, do steps 1-3 and get a URL and for ease, copy it to a text file. It should look like one of the above.

Similar to the User Sender List, go to the User Management > Functional Accounts and choose the appropriate account you need to manage. Grab the URL of that Functional Account. May want to copy this to a text file.

A Functional Account URL looks like this: https://us1.proofpointessentials.com...accounts&u_id=456&fa=pr

Now we have to manually edit the direct user sender list URL for a functional account.

With the example data, it will look like this: https://us1.proofpointessentials.com/i/789/users-and-groups/users/456/sender-lists

Paste this URL into the browser, and it should be the sender list for the functional account you want.

Make sure to Save once done editing the entries on the page.