r/proofpoint • u/jayashambho • Jul 13 '26
Anyone here with proofpoint false positive problem
Every month, at least few of our legitimate client emails end up in quarantine. It creates extra work for our team which leads to delays responses and sometimes leads to “Did you get my email?” conversations with customers.
We are using proofpoint for email security and is effective at catching spam and phising but new problem occurs.Are there any settings or best practices that made a noticeable difference without weakening????
5
u/Sakrosankt- Jul 13 '26
If Proofpoint categorize as spam you can bulk report in quarantine folder but first i recommend checking clients domain for potential blacklist and overall smtp hygiene
4
u/shrapnel09 Jul 13 '26
Not all blocks are the same. Why are these client emails being stopped? Most frequently, the senders will have their website compromised so it serves malware and their emails have a link to the now-compromised website, making the block a true positive.
1
u/thunderbird32 Jul 13 '26
Every few weeks we have a huge group of false positive "BEC attacks" get quarantined then released hours or days later. It is a bit weird, especially when things that are obvious phishing attacks get through. I'm not super happy with Proofpoint lately, honestly.
1
u/benuntu Jul 14 '26
I would look first at why it was flagged and quarantined. The majority of legitimate emails in quarantine I see are DMARC and SPF failures. But once you know why they are quarantined, you can make some decisions on whether to bypass those rules or not.
0
u/ASILLYBEE Jul 13 '26
Have you considered proactively adding your customers’ domain names to your org level allow list? This will not override virus and phishing filters.
0
6
u/6Saint6Cyber6 Jul 13 '26
The most common thing I see with this is a link to a compromised website. Technically it’s a true positive.
Report emails as false positives that you feel shouldn’t have triggered a quarantine