What is the Proofpoint SPAM filter?
Proofpoint is an email auditing system that helps OUHSC defend our email system and network against email-borne viruses, worms and trojans, unsolicited commercial email or junk email commonly referred to as spam, adult content and phishing attacks. Proofpoint examines all email originating outside the campus. It does not audit email that was sent from inside the campus.
How can I manage my Proofpoint account?
You will receive a daily End User Digest from proofpoint-pps@ouhsc.edu. This email will provide you detail on emails that have been quarantined and messages sent to your mailbox. It also has a link that directs you to the proofpoint user interface allowing you to manage your account.
How can I opt out of receiving an End User Digest?
Open an End User Digest you have received previously or watch for a new Digest. Click the link titled Manage My Account.
Clicking this link will open a browser window that contains options for editing your Proofpoint account. Click Profile on the bottom left of the screen.
Under the My Settings window, you will need to uncheck Send digest with new messages in my End User Digest along with Send digest even when I have no messages in my End User Digest by clicking within the checkbox. This option controls the sending of the Daily Digest and is checked by default. If either option is not checked, you will not be sent a Daily Digest. Click Save.
How do I start receiving an End User Digest after I’ve requested to opt out of getting it?
Open an End User Digest you have received previously and click the link titled Manage My Account.
Note: If you do not have an End User Digest in your mailbox, you will need to go here and login to this site to continue with the commands below.
Click Profile on the bottom left of the screen.
Under the My Settings window, check either Send digest with new messages in my End User Digest or Send digest even when I have no messages in my End User Digest by clicking within the checkbox. Click Save.
How does the Proofpoint system work?
The Proofpoint system analyses a large number of attributes of an email to determine if it should be blocked. The Proofpoint system is very effective. Most messages score very high or very low, with only 1.5% falling between 20 and 80 on a scale of 1 (an undeniably valid message) to 100 (assuredly spam). This process is improved on a regular basis and updates are downloaded to our Proofpoint system. Technical information about the process is available at www.proofpoint.com.
What is quarantine?
When Proofpoint determines that an email should be blocked it places it in quarantine. This means that the email will not be sent to you. The email will be kept for a specific time period and then deleted. Emails that are blocked and placed in quarantine will be listed in the End User Digest message.
What does Score mean in the End User Digest?
The Proofpoint system analyses incoming email to determine if it should be blocked. The analysis renders a score for each email on a scale of 1 (an undeniably valid message) to 100 (assuredly spam).
What is the “Messages Sent to Your Inbox” list?
This is a list of all the emails sent to you from outside of campus that Proofpoint has determined to be legitimate email. These emails were not blocked, they were sent on to you and will be in your Outlook. If you think that an email in this list should be blocked in the future, click the "Report Spam" link next to the email. You can also add the sender to the Blocked Senders list.
What happens if I have a person on the safe sender list and they send me an email that contains a virus?
You will receive the email, but Proofpoint will remove the virus.
What is the difference between managing junk mail with Outlook and managing it with Proofpoint?
Both systems contain similar options and features, however the Proofpoint system audits messages and blocks email with unwanted content before they enter the campus email system. This reduces the load on the email system which makes it faster and more efficient. The processes that Proofpoint uses to audit email are much more advanced and effective than the those in Outlook. You can continue to use the features in Outlook to manage unwanted emails. However the new Proofpoint system will greatly improve the process of blocking unwanted email by stopping it before it gets to your Outlook program.
Does Proofpoint work differently for different operating systems?
No. The Proofpoint system, the End User Digests and the Account Management interface will work the same for all operating system and email clients.
Will Proofpoint block SPAM from my personal email account if I check it from work?
No. It only checks email that comes into the OUHSC Exchange email server, and has no effect on email that you get through your web browser. For these reasons, security policy prohibits checking third party email from the campus network.
What file extensions are being blocked by Proofpoint and Exchange?
The following file extensions are being blocked by Proofpoint and Exchange.
386, 3gr, add, ade, asp, bas, bat, chm, cmd, com, cpl, crt, dbx, dll, exe, fon, hlp, hta, inf, ins, isp, js, jse, lnk, mdb, mde, msc, msi, msp, mst, ocx, pcd, pif, reg, scr, sct, shs, shb, url, vb, vbe, vbs, vxd, wsc, wsf, wsh
Why doesn't Proofpoint stop the foreign language SPAM that I see in my mailbox?
Proofpoint's MLX engine can classify messages as spam based on a variety of methods and characteristics, such as text-based analysis, structural (e.g. headers, html structure) analysis, and other features (such as spam-like images). For emails in English as well as a number of other supported foreign languages, all three characteristics can be examined. Spam messages in other foreign languages, especially those in foreign character sets such as Cyrillic characters, can be classified based upon structural and other features, but not on textual analysis. Proofpoint does intend to broaden MLX's textual analysis coverage of foreign languages and character sets over time, but MLX currently does not have this for Cyrillic.
Proofpoint does harvest Cyrillic character set messages from their spam traps and customer submissions, and when they can find western language features (typically email addresses, URLs, phone numbers) they can block the messages based upon those features. Some of their customers have found it useful to create email firewall rules that look at the character set specified in the Content-type header of the message, and quarantine messages that have character sets like Cyrillic, Chinese, etc. These are general customers that do not do business in those languages and can therefore assume that messages with those character sets are not business-related and most likely spam. This assumption is not necessarily a good one for other customers with a diverse user base such as universities and ISP's.
All users should submit the spam they see, even those in foreign character sets. If Proofpoint can find useful characteristics, they will do something about it.
Why do I get an error when I try to report SPAM with my Proofpoint End User Digest?
If you are trying to report spam via your End User Digest and you receive the following error:
Invalid guid at /opt/proofpoint/pps-5.0.3.103/lib/Proofpoint/QuarantineCmdProcessor.pm line 1398
This is caused by using an outdated digest. The digest is only good for four (4) days to report messages as spam. You will have fourteen (14) days to release spam that has been quarantined. Please try to look at your digest daily to eliminate this from happening.
How can I manage my Proofpoint account?
Watch for the “End User Digest” message in your Inbox
This email will contain a link titled "Manage My Account".
Or, go to https://00272701.pphosted.com:10020/euweb/login and log in with your HSC username and password.
Clicking this link will open a browser window that contains options for editing your Safe Senders and Blocked Senders List.
To add to your Blocked Senders List, click “Blocked Senders List” on the left side under “My Lists”.
On the right side, click “New”
In the pop-up field, specify either an email address (johndoe@johndoe.com) or a domain (johndoe.com). Click “Save”.
The email address or domain will appear now in your blocked senders list and you will NOT be receiving emails from them.
If you notice that you’ve made a mistake, click the box next to the email address or domain you need to edit or delete. Edit will allow you to make changes to the email address or domain. Delete would remove it altogether.
To add to your Safe Senders List, click “Safe Senders List” on the left side under “My Lists”.
This works just like the Block Senders List, but allows those email addresses or domains to come to your Inbox (if IT is NOT blocking them).
If you would like to receive an up-to-date copy of the End User Digest, click the Options button on the toolbar and click “Request Digest”.
To view your profile, click the “Profile” button in the lower left corner.
It contains 2 profile options. The first option is "Send digest with new messages in my End User Digest." This option controls the sending of the Daily Digest and is checked by default. If this option is not checked, you will not be sent a Daily Digest. The second option is "Send digest even when I have no messages in my End User Digest." This option is not checked by default. Placing a check next to this option will cause an End User Digest to be sent to you even when there are no messages that have been audited. In order to change these options, click the checkmark boxes so that a checkmark appears next to the options you want and click "Save".
To view your latest quarantined items, click the “Quarantine” button in the lower left corner.
In the Quarantine pane, you can select an email and do one of the items in the row of icons at the top: Release (tells Proofpoint to release the email to your Inbox); Not Spam (tells Proofpoint that this email shouldn't be blocked); Safelist (adds the email address to your personal Safe Senders List); or Delete (deletes the email outright).
In the Quarantine window, you can also see all of the emails that were sent to you. In the Messages Sent to Your Mailbox pane, you can select an email and do one of the items in the row of icons at the top: Report Spam (reports the email as spam to Proofpoint); Report Phish (tells Proofpoint that this email was trying to get your HSC credentials); Blocklist (add the email address to your personal Blocked Senders List).