Email Security Fundamentals
Domain 1 tests how mail actually moves through Proofpoint Email Protection and where inspection, policy, and authentication fit. Expect questions on the SMTP envelope versus message headers, inbound and outbound paths, gateway placement, and the difference between spam, bulk email, phishing, malware, and business email compromise (BEC).
Core rules and concepts
- The SMTP envelope uses MAIL FROM and RCPT TO for routing and SPF; the visible From, Reply-To, and Return-Path are header fields and can differ.
- A gateway receives, inspects, applies policy, then delivers, quarantines, or rejects.
- Detection layers combine reputation, signatures, machine learning, URL Defense, Attachment Defense, sandboxing, and authentication results.
- Outbound filtering protects brand and deliverability; inbound filtering protects users.
- BEC often has no malware or malicious URL; identity deception and payment-change requests are the signal.
- Bulk mail is not automatically spam; classification depends on user consent, reputation, and content.
Worked example
A message has MAIL FROM [email protected], visible From "CEO [email protected]", and SPF pass for vendor.example. SPF authenticates the envelope domain, not the visible From. DMARC alignment fails unless vendor.example aligns with yourcompany.example. Treat this as possible BEC and apply impostor/BEC policy, not a generic spam rule.
Traps that cost marks
Equating SPF pass with a trusted visible sender; ignoring Reply-To; assuming quarantine is always right for bulk versus malware; forgetting that outbound traffic also passes policy and can leak data.