Before You Start
Before continuing with the provisioning and configuration of the Proofpoint Essentials service, it is recommended that you have the information listed below.
INFORMATION NEEDED FOR CONFIGURING PROOFPOINT ESSENTIALS
- MX record(s) for domain(s) you are configuring
INFORMATION NEEDED FOR CONFIGURING G SUITE
- Proofpoint Essentials IPs, Smart Host and SPF
- Google admin account (Paid Service)
Setup Inbound Mail Flow
Proofpoint Essentials is deployed between the customer’s G Suite environment and the Internet. Inbound mail is routed to Proofpoint Essentials by changing the customer’s MX records. After email is processed by Proofpoint Essentials it is routed to G Suite.
CONFIGURE PROOFPOINT ESSENTIALS
Locate your MX record for the domain in G Suite
- Sign-In to the Google Admin console.
- From the dashboard go to Apps > G Suite > Gmail > Advanced Settings.
While on the General Settings tab, scroll down to Setup > MX records and make note of all the “Points to” values (you can also enter MX records in the search field).
These values will be necessary when you add your domains to Proofpoint Essentials.
Note: After you have all the MX records above, please login to your Moduscloud / Proofpoint accound and go to:
Account Management>Domains> and under Delivery destination add the MX records you have taken note before
Delivery Destination
ASPMX.L.GOOGLE.COM
ALT1.ASPMX.L.GOOGLE.COM
ALT2.ASPMX.L.GOOGLE.COM
ALT3.ASPMX.L.GOOGLE.COM
You need to enter one by one under Delivery Destination under Domains
After you added the above Destinations is very important to wait at least one hour before you continue with the steps below, the system needs to replicate the settings in order to be able to process the mail flow an deliver the messages to the above Destinations, if you continue before one hour you might get a bounced back message.
Configure Inbound Mail Gateway
- Sign-In to the Google Admin console.
- From the dashboard go to Apps > G Suite > Gmail > Advanced Settings. ( sames as Above)
- While on the General Settings tab, scroll down to the Spam > Inbound Gateway (you can also enter Inbound Gateway in the search field).
- Hover the cursor to the right of Inbound gateway. To create a new inbound gateway setting, click Configure.
- Under Gateway IPs, enter the IP addresses, then enable.
IMPORTANT: When pasting the IP addresses for the inbound gateway, make sure there is no white spaces at the beginning or the end of the IP addresses. Google Workspace will not provide an error message if there is a white space before or after the IP address.
- Check Automatically detect external IP.
| When this setting is enabled, Gmail scans the message header to locate the first occurrence of an IP address that is not listed in the Gateway IPs. This is referred to as the “external IP.” Gmail considers the “external IP” as the sending IP and uses this IP for SPF checks and spam evaluation. |
|---|
- Check Reject all mail not coming from gateway IPs.
- Check Require TLS for connection from the email gateways listed above.
- Click Add Setting.
IMPORTANT NOTE: The option to Reject all mail not from gateways IPS will only be enable after the MX records for the domain are changed and Pointing to Proofpoint / Moduscloud filter if you leave it checked and the MX records are not pointing to Proofpoint you might reject messages, so if very important to enable the setting only after you change the MX records to point to Proofpoint.
DKIM\DMARC Update Safety Settings
G Suite's safety settings allow organizations to enable or disable policies related to viewing and accessing email. This is important when addressing DKIM\DMARC scanning policies. If you have enabled some or all of these settings you may experience some inbound email issues. Please review the following steps to ensure your settings are supported.
- While signed into the Google Admin console, go to Apps > G Suite > Gmail.
- Click Safety to expand options.
| No changes to Attachments settings or Links and external images are required. You can leave these settings as they are. |
|---|
- If you have Spoofing and authentication settings enabled (either all or customized) consider the following setting:
- Protect against any unauthenticated emails
- Proofpoint Essentials has already scanned incoming emails for SPF and/or DKIM\DMARC issues. Emails with issues are scored accordingly and quarantined if they exceed your spam threshold.
- This setting can be disabled. If it is enabled it may cause unexpected delivery issues for incoming email.
- Protect against any unauthenticated emails
Setup Outbound Mail Flow
Proofpoint Essentials is deployed between the customer’s G Suite environment and the Internet. Outbound mail is routed to Proofpoint Essentials by configuring an outbound mail gateway. This will route all outbound mail to Proofpoint Essentials.
CONFIGURE PROOFPOINT ESSENTIALS
Enable Outbound Relaying
- Sign-in to the Proofpoint Essentials user interface.
- Click the Features tab.
- Check Enable Outbound Relaying.
- Click Save.
Add Service IP addresses to your Inbound Gateway
- While logged into the Proofpoint Essentials user interface, click the Domains tab.
- Click Managed Hosted Services.
Choose Google Apps.
Click Save.
CONFIGURE G SUITE
Configure Outbound Mail Gateway
- Sign-In to the Google Admin console.
- From the dashboard go to Apps > G Suite > Gmail > Advanced Settings.( same as Above)
- While on the General Settings tab, scroll down to the Routing > Outbound Gateway (you can also enter Outbound Gateway in the search field).
In the Outbound Gateway text field, enter the Proofpoint Essentials Smart host value.
Click Save.
Update Sender Policy Framework (SPF)
When sending outbound email through the Proofpoint Essentials gateway, recipients receive mail sent from Proofpoint Essentials rather than G Suite mail servers. If the recipient's mail service attempts to verify that the message came from your domain, it must confirm that the gateway server is an authorized mail server for your domain.
To enable this, you need to add the Proofpoint Essentials SPF record to your domain.
NOTE:
If you are doing outbound thru Proofpoint we need to implement a rule to avoid any Spoofing Domain False Positive.
s