Message Tracking
Domain 5 tests how to trace a message through Proofpoint and interpret the result. Expect questions on search filters, Message-ID, envelope versus header addresses, timestamps, quarantine, rule hits, and delivery status.
Core rules
- Search by Message-ID for exact correlation; use sender, recipient, subject, and date to narrow a broader search.
- Envelope recipient is not always the visible To; distribution groups expand to many recipients.
- A trace shows the policy or filter that acted, the action taken, and the final disposition.
- Time zones matter; compare in UTC or the console's displayed zone, not the user's local clock.
- Use trace evidence in incident tickets and export results when retention is limited.
Worked example
A user reports a missing invoice. Trace by recipient and date shows the message arrived, matched a content filter for "invoice" with an attachment, and was quarantined. The fix is to correct the filter scope, release the message, and check for other affected recipients-not to blame the sender. The rule hit, not the delivery status alone, explains the outcome.
Traps that cost marks
Searching the display name only; assuming "delivered" means inbox delivery; ignoring group expansion; comparing local time against UTC logs; and failing to preserve trace output before retention expires.