How moving mail between Junk and the Inbox trains Check Point

Check Point does not only learn from its own engines. It also watches what your users do with their own mail: when someone moves a message between their Junk folder and their Inbox, Check Point takes that as a signal and quietly adjusts that user's trusted and blocked senders. It is automatic and it is per-user. Here is what each action does and what to keep in mind.

Moving mail from Junk to the Inbox trusts the sender

When a user moves a message from their Junk (or Promotions) folder into their Inbox, Check Point reads it as the user confirming that the sender is legitimate for them. It automatically adds that sender to the user's Trusted Senders list, so future mail from that sender is delivered rather than sent to Junk.

This only applies when Allow end-users to trust senders of Spam emails is enabled on the policy, which it is by default. It is also spam-only: if a message is classed as phishing or contains malware, it is still quarantined no matter where the user moves it.

Moving mail from the Inbox to Junk blocks the sender

The reverse also works. When a user moves a message from their Inbox to Junk, future emails from that sender to that same user are marked as Spam. Moving a message into the dedicated Graymail folder does the same for graymail, so future mail from that sender is treated as graymail. This builds a per-user block-list, which is not shown in the portal.

What to keep in mind

• It is per-user, not tenant-wide. It tunes that one person's trusted and blocked senders. It does not change the global model or affect anyone else's mail.
• It is not instant for new users. For someone just added, it can take up to 48 hours to take effect after they appear in the User Directory.
• It needs Microsoft 365 mailbox auditing. The learning relies on mailbox move operations generating audit logs in Microsoft 365, so mailbox auditing has to be on.
• Phishing and malware are unaffected. Trusting a sender only exempts spam. Genuinely malicious mail is still caught and quarantined.

Related

The end user quarantine digest