Skip to main content
My preferencesSign out
Proofpoint, Inc.

How to quarantine encrypted attachments

Situation You have encrypted attachments being unchecked by Virus Scan or want to prevent encrypted attachments from being safely delivered to your users.
Solution Quarantine Encrypted Attachments Using a Filter. Create an inbound filter following the below steps.

General Information on scanning

By design, Proofpoint Essentials scans all messages for Viruses, and if licensed, goes through our Attachment Defense scanning. However, if there are no matches against a virus or Attachment Defense definition, the message resumes through our standard mail filtering.

Once in a message goes through our filtering, if an attachment is found, but we are unable to open to read the content, a subject tag is added to that particular email.

Subject Tag for Unknown Attachment Scan

Proofpoint Essentials adds in this subject tag if we cannot scan the attachment content: **UNCHECKED***

Quarantine Encrypted Attachments using a Filter

Here is how to create  a filter to quarantine an attachment that may be unknown.


  1. Navigate to Company Settings > Filters.
  2. Click New Filter.
  3. Give the filter a name, leave Direction set to Inbound, and click Continue.
    1. Under Filter Logic, select Attachment Name from the first If dropdown.
    2. Select Is from the next dropdown.
    3. Type the desired file extension in the blank field, such as *.zip.
  4. Click Add Another Condition.
    1. From the first dropdown, select Attachment Type.
    2. Select Is from the next dropdown.
    3. Click Manage.
    4. Click Other.
    5. Select Undecipherable attachments.
    6. Click Close.
  5. Select Quarantine from the Do dropdown.
  6. Click Save.

The filter will look similar to this:


For the Attachment Type selection, make sure this is selected per the above instructions.



You can enter as many attachment names as you want, such as *.doc, *.docx, *.xls.