How to configure Email Security for Phishing mail?

Hi @itariant
Email Security function on ATP series support to scanning SMTP/POP3 email header by external DNSBL server. If sender email domain matched DNSBL block list, then unsafe mail will block by Email Security function.
If the mail is encrypted or include unsafe content, you can enable Reputation function to block traffic initials from Intranet to Internet. Since phishing mail include fake URL in mail content, it could prevent Intranet client access to unsafe web site.