Proofpoint Email Security Specialist flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Envelope sender

The MAIL FROM address used in the SMTP transaction. SPF evaluates this domain, and it can differ from the visible header From, which is what DMARC aligns against.

Header From

The address a recipient sees in the message header. DMARC requires this domain to align with a passing SPF or DKIM identifier for the message to pass DMARC.

Inline filtering

Synchronous inspection that holds the SMTP session until a verdict is reached, allowing the gateway to reject the message outright during the transaction rather than after acceptance.

Received header chain

Hop-by-hop trace headers added by each MTA. Read bottom-up, oldest first, to reconstruct the delivery path, per-hop delays, and originating client IP address.

Graymail

Bulk or automated mail such as newsletters and notifications that users often tolerate. It is not malicious, so aggressive blocking produces complaints and false-positive reports.

Time-of-click URL defense

Rewriting links so the destination is re-evaluated when the user clicks, catching URLs that were clean at delivery but weaponized later.

BEC detection signal

Identity deception indicators such as display-name spoofing, reply-to mismatch, and lookalike domains. BEC messages often carry no attachment or URL, so payload scanning alone misses them.

Lookalike domain

A domain crafted to resemble a legitimate one via homoglyphs, added or removed characters, alternate TLDs, or cousin registration, used to impersonate a trusted brand or internal executive.

Sandbox verdict

Result of detonating an attachment or URL in an isolated environment. Outcomes are malicious, suspicious, or clean; suspicious typically escalates to quarantine rather than silent delivery.

First-match-wins evaluation

Policy engines commonly evaluate rules top-down and stop at the first match, so rule order determines the outcome when conditions overlap.

Recipient-based policy

A rule scoped to a specific user, group, or domain that overrides global defaults. Verify the effective policy for the user, not just the global setting.

Safe-sender allowlist

An entry that bypasses spam and content scanning for a sender. It usually does not bypass malware scanning, so confirm the exact bypass scope before relying on it.

Tag-only staging

Deploying a new rule in monitor mode, adding a header or subject tag instead of quarantining, to measure false positives before enforcing the action.

SPF lookup limit

A maximum of 10 DNS-querying mechanisms per SPF check. include, a, mx, ptr, exists, and redirect all consume lookups; exceeding the limit returns permerror.

SPF softfail

The ~all qualifier, marking unauthorized senders as suspicious rather than rejected. DMARC treats softfail as a non-pass but not as strict fail.

DKIM selector

The s= value in the DKIM-Signature header. It locates the public key at selector._domainkey.domain, so key rotation requires updating that DNS record.

DKIM body hash

A hash of the canonicalized message body recorded in the DKIM-Signature. Any body modification in transit invalidates the signature and causes a DKIM failure.

DMARC alignment

The requirement that the header From domain match a passing SPF or DKIM identifier, either relaxed (organizational domain) or strict (exact domain).

DMARC pct tag

A DMARC record tag setting the percentage of failing messages to which the policy applies. pct=100 applies the policy to all failing mail.

DMARC aggregate report

XML reports sent to the rua address summarizing per-source-IP pass and fail counts and alignment results. They are used to inventory legitimate senders before enforcing reject.

ARC chain

A sealing mechanism that preserves authentication results across forwarders. It is a trust chain and does not replace DMARC alignment for the original sender.

Message-ID search

The most precise tracking key. Assigned by the originating system and preserved across hops, it uniquely identifies a message for trace and disposition lookup.

Disposition value

The final outcome recorded for a message: delivered, quarantined, blocked or rejected, deferred, or dropped after delivery. Distinguishing these is essential when tracing.

Module attribution

The tracking field naming which rule or module produced a verdict. It maps the disposition back to the exact policy section that fired.

Tracking retention

The finite window during which message logs and trace data remain searchable. Export evidence before it closes if an investigation needs it.

End-user quarantine release

Self-service action letting a recipient release a held message. Pair it with a report-phish option so releases still feed tuning and threat intelligence.

Incident scoping

Determining who received a campaign and when, using sender, subject pattern, URL or domain, attachment hash, and time window together to avoid over- or under-collection.

Retroactive message pull

Removing already-delivered messages from mailboxes after a verdict changes. It requires the message to remain retrievable in the tracking or archive store.

Containment block scope

Blocking the exact sender, IP, or URL first. Org-wide blocks on shared infrastructure risk blocking legitimate mail, so widen scope only after confirming.

Admin role separation

Assigning super admin, org admin, and read-only auditor roles so least privilege limits the blast radius if an admin account is compromised.

Directory-synced groups

User and group provisioning from the directory so recipient-based policies inherit membership automatically, avoiding manual drift between systems.

DMARC sender inventory

Reviewing aggregate report sources to list legitimate sending IPs and domains before moving the DMARC policy from none to quarantine or reject.