You want to apply one or more keyword filtering rules to one or more distribution groups. You select the distribution group from the list, however, the rule won't apply when an email is sent inbound. Applying the rule to a user instead of the distribution list works.
This behavior is by design. GFI MailEssentials is designed to work with security groups, and the Configuration UI should not really allow you to detect and add the distribution groups. This is already addressed with our development team and should be implemented in the near future.
Kindly change the group type from distribution to security in your Active Directory or create a test security group to confirm this behavior.
For more information about the difference between distribution groups and security groups as well as about mail-enabled security groups, please visit the following external resources: