Automated End User Block List

Check Point Email Security now automatically block-lists senders for individual users based on their mailbox actions.

Following the recent release of automatic trusted sender learning, Check Point Email Security now introduces the opposite workflow. When end users move emails from the Inbox to Junk or Promotions, the sender is automatically treated as unwanted for that specific user. This helps organizations improve inbox accuracy while reducing manual work for security and helpdesk teams.

When a user moves an email from the Inbox to the Junk folder, future emails from that sender to the same user will be flagged as spam. Similarly, when a user moves an email to the dedicated graymail folder created by Check Point, future emails from that sender to the same user will be flagged as graymail.

This automated workflow gives end users more control over their inbox experience while keeping enforcement granular and policy-driven. Instead of requiring users to manually block senders or ask SOC and helpdesk teams for support, Check Point Email Security learns from user behavior and adapts future classification on a per-user basis – helping reduce inbox noise, improve productivity, and maintain strong email security controls.

The feature is enabled by default. To disable it, go to Security Settings > Security Engines > Anti-Phishing Configuration > Emails moved by end users to Junk/Promotions.

Note: At this stage, the list of block-listed senders per user is not visible in the portal.