Does anyone know the mechanics of Safe Sender List, except that marking email safe? But what it actually does? Often safe senders list doesn’t help prevent marking emails as safe, I white list the email or domain but some emails are still being quarantined. When I check for senders’ SPF configuration they are correct, the email doesn’t contain any spam content but still gets classified as spam even if it’s on the Safe sender list. I would appreciate it if anyone has any feedback.
Thank you.
Are you asking regarding the Personal and/or Organizational safe-list?
These two options only affect spam/bulk classifiers, and do not affect blocked, malware, impostor, phish classifiers assuming you have your spam rule priority set up according to Proofpoint’s best practices.
Check the message headers and triggered rules in the quarantine, or in the new beta admin portal. You can see what the spam policy score is for each of those above classifiers.
I guarantee you it’s either one of 4 things.
If you use custom spam rules, and it’s quarantined because of #4, you can create a spam rule with the action being to reduce the malware, impostor, phish classifiers on matched messages. (although I don’t recommend this).
It might not help, but just to expand on what it’s doing: I have a country code rule blocking anything outside the US (I know, bound to be exceptions), but I added a domain to the org safe list and it still got caught by the country code rule. I had to make a rule higher in priority that immediately delivered the emails from that domain. Does it skip all threat detections? I don’t know.
The org safelist/personal safelist only affects spam/bulk classifiers. Denies via the custom spam rules or the email firewall will always take precedence over any allows via org/personal safelist.
