Standard Email Configuration

The Forcepoint Email Security Cloud service provides a standard configuration for all email accounts. The settings for the standard configuration are described below, as well as the reasoning behind the settings. As an administrator, you can customize policy settings to suit your needs. Do this by clicking Email, then following the instructions in Defining Email Policies.

Each table in this section represents a section in email configuration settings. Column 4 suggests various use cases for changing the standard setting.


1. Policy Management	Standard setting	Reason for standard setting	Consider changing setting if...
Policies	One policy has been set up with the standard account configuration shown in this document.	(see individual settings below)	Additional policies should be added to support aliases, or to support a domain (or domains) that require differing configurations.


2. General tab	Standard setting	Reason for standard setting	Consider changing setting if...
Notifications	Inbound: Recipient Outbound: Sender	Intended recipient needs visibility of blocking. Sender needs visibility of blocking.	Volume of notifications is too high, visibility is not required, or notifying sender is preferable.
Annotations	Inbound: on Outbound: on	Allows recipient to report spam easily and automatically. To give confidence to recipient that message is virus-free.	Transparency of Forcepoint Email Security Cloud service is important. Company-specific annotation is required.


3. Domains tab	Standard setting	Reason for standard setting	Consider changing setting if...
Domains	Registered domain is shown.	At least one valid domain name must be provided.	Additional domains are to be analyzed.


4. Connections tab	Standard setting	Reason for standard setting	Consider changing setting if...
Inbound Mail Routing Rules	No rules set up.	No inbound routing rules are provided at the time of registration.	Inbound mail is to be routed to different email servers depending on the recipients.
Default Inbound and Outbound Routes	Registered route information is shown.	At least one inbound and one outbound route must be provided.	More servers are to send email to or receive from the cloud service. An "A record" is needed if load balancing across servers is required.


5. Antivirus tab	Standard setting	Reason for standard setting	Consider changing setting if...
Active Content	Inbound: HTML: medium Outbound: HTML: off Inbound: Macro analyzer: high Outbound: Macro analyzer: off	Protect user from non-obvious active elements. Active HTML content is from trusted source. Protect user from suspicious macros. Macros are from trusted source.	HTML mail is not rendered correctly. HTML mail should be filtered. Too many relevant files are blocked. Additional security is required.
Encrypted messages	Inbound: password-protected zips: on Outbound: password-protected zips: off Inbound: Encrypted mail: on Outbound: Encrypted mail: off	Not possible to analyze content of password-protected zips. Files are from trusted source. Not possible to analyze encrypted mail. Messages are from trusted source.	Requirement to transmit password-protected zips Additional security required Requirement to exchange encrypted mail Additional security required
Executables	Inbound: Quarantine exe: on Outbound: Quarantine exe: on	Most administrators do not allow users to receive executables. Most administrators do not allow users to send executables.	Most users need to transmit executables. Most users need to transmit executables.


6. Antispam tab	Standard setting	Reason for standard setting	Consider changing setting if...
Existing Rules	Spam Score > 15.0 - discard Spam Score > 6.0 - quarantine	No false positives score as high as 15.0. System default spam threshold	Discarding of spam not required or score needs to be higher or lower Quarantining of spam not required or score needs to be higher or lower
Exceptions	Allowlist these addresses: off Blocklist this address: off	No allowlist entries are provided at the time of registration. No blocklist entries are provided at the time of registration.	Administrator may populate a allowlist for the account. Administrator may populate a blocklist for the account.
End Users	Allow users to populate their own allowlists and blocklists: on Allow users to obtain a copy of an email that has been quarantined as spam: on	Allow users some control over incoming senders for their own address Allow users safe control over spam email sent to their own address	No control or visibility is desired for end users. No control or visibility is desired for end users.
Keep Messages	Keep a copy of clean messages so they can be learnt from if later reported as spam: on	Cloud service keeps a private copy of the message for a short time to aid in spam-tuning when the 'Report this email as Spam' link is clicked.	No retention of clean messages for spam tuning is desired.


7. Content Filter tab	Standard setting	Reason for standard setting	Consider changing setting if...
Attachments	Inbound: Mask attachments with .eml extension	Unable to analyze .eml files	.eml files are not a concern or if more file extensions are to be added
	Outbound: Do not mask any attachments	Files are from trusted source.	Different file types are to be considered suspicious.
	Inbound: Quarantine messages containing nominated file types: off	Allow admin to populate list before applying it	Blocking of certain file types is required.
	Outbound: Quarantine messages containing nominated file types: off	Allow admin to populate list before applying it	Blocking of certain file types is required.
	Inbound: Quarantine messages containing files of unknown type: off	Cloud service can identify majority of file types	There is a need for quarantining unknown attachments.
	Outbound: Quarantine messages containing files of unknown type: off	Files are from trusted source	Outgoing attachments are to be considered suspicious.
	Inbound: Quarantine messages containing inappropriate images: off	Requires license for Forcepoint Email Security Image Analysis Module	There is a need to analyze images.
	Outbound: Quarantine messages containing inappropriate images: off	Requires license for Email Security Image Analysis Module	Outgoing images are to be considered suspicious.
	Inbound: Quarantine messages with images that could not be scanned: off	This setting can only be enabled when image quarantine is on.	There is a need to check large images.
	Outbound: Quarantine messages with images that could not be analyzed: off	Files are from trusted source	There is a need to quarantine and check large images.
	Inbound: Park attachments meeting nominated criteria: off	Most large attachments can be delivered successfully	There is a need to conserve users' mailbox size.
	Outbound: Park attachments meeting nominated criteria: off	Files are from trusted source	There is a need to conserve recipients' mailbox size.
Message Size	Inbound: Non-deliver > 50MB: on Outbound: Non-deliver > 50MB: on Inbound: Quarantine > 10MB: off Outbound: Quarantine > 10MB: off Inbound: Defer delivery: off Outbound: Defer delivery: off	Contractual maximum message size Contractual maximum message size Max message size usually acceptable Max message size usually acceptable Requires your policy to be applied Requires your policy to be applied	Lower limit is required. Lower limit is required. Lower the limit below the maximum size to conserve your bandwidth. Lower the limit below the maximum size to conserve recipient organization's bandwidth. There is a need to conserve your bandwidth during certain time periods. There is a need to assist with conserving recipient organization's bandwidth during certain time periods.
Content Filtering	Inbound: Filter using these lexical rules: on Outbound: Filter using these lexical rules: on Inbound: Quarantine messages if content analysis does not complete: off Outbound: Quarantine messages if content analysis does not complete: off	Allow new rule to be implemented immediately. Allow new rule to be implemented immediately. Cloud service rarely fails to complete lexical analysis. Cloud service rarely fails to complete lexical analysis.	Suspension of lexical filtering Suspension of lexical filtering There is a large number of lexical rules and regular expressions, which could mean analysis does not complete. There is a large number of lexical rules and regular expressions, which could mean analysis does not complete.