Proofpoint Email Security Setup Guide India — MX Records, TAP, Microsoft 365 & DMARC

Proofpoint Email Security deploys as a cloud MX gateway between the internet and your Microsoft 365 or Exchange environment. All inbound email routes through Proofpoint's infrastructure for threat scanning before delivery. This guide covers the complete deployment process for Indian organisations — MX changes, Targeted Attack Protection (TAP) configuration, Microsoft 365 connector setup, SPF, DKIM, and DMARC.

Prerequisites

Proofpoint account provisioned — your subscription must be active and your domain added to Proofpoint Essentials or Business Protection admin console
DNS admin access — your domain registrar (GoDaddy, BigRock, Namecheap) or hosting provider DNS panel
Microsoft 365 Global Admin or Exchange Admin access
Current MX records noted — document existing records for rollback reference
SPF record backed up — copy your current TXT record

Step 1 — Add Your Domain to Proofpoint

For Proofpoint Essentials:

Log in to essentials.proofpoint.com
Go to Company Settings → Domains → Add Domain
Enter your domain name
Proofpoint provides a verification TXT record:

Type: TXT
Name: @  (or as instructed by Proofpoint)
Value: proofpoint-domain-verification=xxxxxxxxxxxxx
TTL: 3600

Add this to your DNS panel. Verification typically completes within 30–60 minutes.

For Proofpoint Enterprise:

Log in to the Proofpoint Administration console (provided during onboarding)
Navigate to Email Protection → Domains → Add Domain
Complete the domain verification process as directed

Step 2 — Change MX Records

Proofpoint provides organisation-specific MX hostnames in your admin console after domain verification. Your exact MX values are found in your Proofpoint console under Email Protection → Domains → your domain → Inbound Servers.

Typical Proofpoint MX format:

Type: MX  Priority: 10  Value: mx1-xxxxx.pphosted.com
Type: MX  Priority: 20  Value: mx2-xxxxx.pphosted.com

The xxxxx portion is unique to your Proofpoint cluster. Always use the values from your console.

Transition approach (reduces disruption):

Phase 1 — Add Proofpoint with higher priority, keep M365 as lower priority fallback:
  Priority 10:  mx1-xxxxx.pphosted.com   (Proofpoint — new)
  Priority 20:  mx2-xxxxx.pphosted.com   (Proofpoint — new)
  Priority 100: yourdomain-com.mail.protection.outlook.com  (M365 — temp fallback)

Phase 2 — Remove M365 MX after 24–48 hours:
  Priority 10:  mx1-xxxxx.pphosted.com
  Priority 20:  mx2-xxxxx.pphosted.com

DNS propagation takes 24–48 hours. Proofpoint's quarantine digest should show inbound mail within 2–4 hours of the MX change going live.

Step 3 — Configure Mail Routing to Microsoft 365

Tell Proofpoint where to deliver clean mail after scanning.

In Proofpoint Essentials:

Go to Company Settings → Outbound Servers (or Delivery Servers)
Set the delivery hostname:
- Microsoft 365: yourdomain-com.mail.protection.outlook.com
- On-premise Exchange: your Exchange server public hostname or IP

In Proofpoint Enterprise:

Go to Email Protection → Mail Routing → Delivery Routes
Configure your inbound delivery route to your M365 MX address
Enable TLS for the delivery connection (M365 supports TLS; enforce it)

Step 4 — Lock Down Microsoft 365 to Proofpoint IPs Only

Without this step, attackers can bypass Proofpoint by sending directly to your M365 MX record.

In Exchange Admin Center (admin.exchange.microsoft.com):

Go to Mail Flow → Connectors → + Add a connector
Set connection type to Partner organisation → Office 365
Name: Proofpoint Inbound
Sender domain/IPs: Add Proofpoint's egress IP ranges (get the current list from your Proofpoint console — they are updated periodically)
Apply to: all accepted domains
Action: Reject mail not from these IPs

Proofpoint egress IPs: In Proofpoint Essentials, the IP list is in Settings → IP Addresses. In Proofpoint Enterprise, it is documented in your admin guide or available from Proofpoint support.

Step 5 — Configure Targeted Attack Protection (TAP)

Targeted Attack Protection is Proofpoint's advanced threat defence layer — it covers URL rewriting, attachment sandboxing, and impersonation protection.

URL Defence

In Email Protection → Targeted Attack Protection → URL Defence
Enable URL rewriting for all inbound messages
Set action for malicious URLs at click time: Block (recommended)
Set action for suspicious URLs: Warn (allows user to proceed but shows a warning page)
Enable URL click tracking to build reporting on which users click potentially malicious URLs

URL Defence rewrites all links in inbound email. When a user clicks, Proofpoint scans the destination URL in real time against threat intelligence. If the URL became malicious after email delivery (a common evasion technique), Proofpoint blocks it at click time.

Attachment Defence

In Email Protection → Targeted Attack Protection → Attachment Defence
Enable sandbox analysis for: Office documents, PDFs, executables, archives (ZIP, RAR)
Set action for malicious attachments: Remove and notify
Set action for unscannable attachments: Quarantine (don't deliver files Proofpoint cannot inspect)
Enable Very Attached Files (VAF): Proofpoint's scanning of password-protected archives (a Proofpoint-specific capability — requires the sender to provide the password in the email body for scanning)

Impostor Email Defence (BEC Protection)

In Email Protection → Targeted Attack Protection → Impostor Email Defence
Enable display name impersonation detection
Add your VIP list — CEO, CFO, Finance Director, MD, procurement head (the roles most impersonated in BEC attacks)
Set action: Quarantine with admin notification (not just tag subject — BEC emails should not reach the inbox even with a warning)
Enable lookalike domain detection: catches domains like c1oudfy.com impersonating cloudfy.com

Step 6 — Configure Inbound Policies

Anti-spam:

Action for High Confidence Spam: Quarantine
Action for Spam: Quarantine or Tag Subject (organisation preference)
Quarantine digest frequency: Daily (users self-release false positives)
Permit list: Add trusted senders/domains that are consistently false-positived

Antivirus:

Action for malware: Quarantine and strip attachment
Action for encrypted archives that cannot be scanned: Quarantine

Graymail (newsletters and bulk commercial email): Proofpoint categorises graymail separately from spam. Configure a graymail policy to route it to a dedicated folder or tag the subject line — letting users manage newsletters without treating them as spam.

Step 7 — Update SPF Record

If routing outbound mail through Proofpoint (optional — Proofpoint can handle inbound only):

Current SPF (M365 only):

v=spf1 include:spf.protection.outlook.com -all

Updated SPF (M365 + Proofpoint outbound):

v=spf1 include:spf.protection.outlook.com include:pphosted.com ~all

If Proofpoint is inbound-only, no SPF change is needed for Proofpoint specifically.

Step 8 — DKIM Configuration

Enable Microsoft 365 DKIM signing in Exchange Admin Center → Email Authentication → DKIM. Add the CNAME records Microsoft provides to your DNS. This ensures M365-sent mail passes DKIM checks.

If routing outbound through Proofpoint, Proofpoint can also sign outbound messages — configure this under Email Protection → DKIM Signing in your Proofpoint console.

Step 9 — DMARC Policy Setup

Type: TXT
Name: _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r

Progress through p=none → p=quarantine → p=reject over 4–8 weeks as you verify all legitimate mail sources pass DMARC alignment.

Proofpoint's TAP dashboard provides sender visibility that helps identify legitimate mail sources sending on your domain's behalf before you enforce DMARC.

Post-Deployment Verification

Send a test email from an external address. Check headers for X-Proofpoint-* processing headers.
Verify SPF with MXToolbox or Google Admin Toolbox
Verify DKIM by sending to check-auth@verifier.port25.com
Verify the M365 bypass is closed — attempt SMTP connection directly to M365 MX from an IP outside Proofpoint's ranges; it should reject
Check TAP URL rewriting is active — links in inbound test email should be rewritten to urldefense.proofpoint.com format

Common Issues

Mail not flowing after MX change: Check DNS propagation with nslookup -type=MX yourdomain.com. Allow 24–48 hours for full propagation.

Quarantine receiving too many false positives: Adjust the spam sensitivity level down or add trusted sender domains to the Permit List.

TAP URL rewriting breaking internal links: Add internal domain patterns to the URL Defence safe list to exclude intranet URLs from rewriting.

DMARC aggregate reports showing failures after deployment: Identify the failing sender in the report. Common causes: marketing platform not in SPF, CRM sending from your domain without DKIM alignment.

Cloudfy Systems is an authorised Proofpoint email security partner in India. We handle end-to-end Proofpoint deployment — MX changes, TAP configuration, Microsoft 365 connector, SPF/DKIM/DMARC setup, and policy configuration. Contact us for a same-day INR deployment quote.